Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83848
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.51 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <54EE5634.1040300@seld.be>
References: <CAGa2bXbt9FAdRtW1GxDyT+G-4bWBACTso_DOizcSHmmgmSVtmA@mail.gmail.com>
	<CAGa2bXb5QEKOggRbUnmVHuib=P_tJ9_W+QyMa_SCpc7RmSCgSA@mail.gmail.com>
	<54EE50CF.9090508@gmail.com>
	<54EE5634.1040300@seld.be>
Date: Wed, 25 Feb 2015 23:24:27 +0000
Message-ID: <CALwr1Gmm0r2S3w-WOetJipKQNS3dGxHgkuo6HgAdUGYNXs-xUw@mail.gmail.com>
To: Jordi Boggiano <j.boggiano@seld.be>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Introduce script only include/require
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi Jordi,

On 25 February 2015 at 23:09, Jordi Boggiano <j.boggiano@seld.be> wrote:
> On 25/02/2015 22:46, Stanislav Malyshev wrote:
>>
>> 2. I think this RFC provides false sense of security for people that
>> create vulnerable code and lets them think it's OK to have variable
>> includes without adequate safety, since they are "protected" by these
>> changes.
>
> People that are clueless already do not validate anything and are *NOT*
> protected by this RFC. People that know what they are doing probably do n=
ot
> need this patch. So the way I see it it's a win for random crappy code ou=
t
> there, and a noop at worst for the others.

Not so. From a defense in depth perpsective (perhaps the programmer in
the next seat is error prone), I'd expect it to be enabled anyway. You
lose nothing by using it.

>> 3. I think it causes significant BC break which might be warranted in
>> case it provides major improvement in security, but IMO in the light of
>> the above it does not provide even minor one.
>
> A way to mitigate this might be to change the default to include a few mo=
re
> common extensions like phtml, inc, or whatever. As those are all commonly
> associated with PHP and offer no good reason to be allowed in user upload=
s,
> I guess it's safe.

No objections here for common extensions well established as being
intentionally PHP bearing files.

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com