Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83837
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.53 as permitted sender)
Message-ID: <54EE50CF.9090508@gmail.com>
Date: Wed, 25 Feb 2015 14:46:39 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Yasuo Ohgaki <yohgaki@ohgaki.net>, 
 "internals@lists.php.net" <internals@lists.php.net>
References: <CAGa2bXbt9FAdRtW1GxDyT+G-4bWBACTso_DOizcSHmmgmSVtmA@mail.gmail.com> <CAGa2bXb5QEKOggRbUnmVHuib=P_tJ9_W+QyMa_SCpc7RmSCgSA@mail.gmail.com>
In-Reply-To: <CAGa2bXb5QEKOggRbUnmVHuib=P_tJ9_W+QyMa_SCpc7RmSCgSA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [RFC][VOTE] Introduce script only include/require
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> I saw you voted "no".
> Could you share us the reason behind?

I think I did, in my past messages to the list, but maybe I was not
clear. I will repeat in short:

1. I think this RFC does not provide any security improvement, due to
extreme ease with which the measures in this RFC can be circumvented by
the attacker.

2. I think this RFC provides false sense of security for people that
create vulnerable code and lets them think it's OK to have variable
includes without adequate safety, since they are "protected" by these
changes.

3. I think it causes significant BC break which might be warranted in
case it provides major improvement in security, but IMO in the light of
the above it does not provide even minor one.

This is why I vote no and call everybody to do the same.
-- 
Stas Malyshev
smalyshev@gmail.com