Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83853
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.48 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <54EE5A39.9040401@gmail.com>
References: <CAGa2bXbt9FAdRtW1GxDyT+G-4bWBACTso_DOizcSHmmgmSVtmA@mail.gmail.com>
 <CAGa2bXb5QEKOggRbUnmVHuib=P_tJ9_W+QyMa_SCpc7RmSCgSA@mail.gmail.com>
 <54EE50CF.9090508@gmail.com> <CALwr1GmoAxfbKvJYVLeL3wPXEKKbu1jKGkTFcG0KQ_Ogx172sA@mail.gmail.com>
 <54EE5A39.9040401@gmail.com>
Date: Thu, 26 Feb 2015 09:05:32 +0900
Message-ID: <CAGa2bXYXXVvfH2wdtL-pr6DX8=D5=czCJvW46xxodVvS8=9_-Q@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: =?UTF-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1135a514166bd1050ff28511
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Introduce script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1135a514166bd1050ff28511
Content-Type: text/plain; charset=UTF-8

Hi Stas,

On Thu, Feb 26, 2015 at 8:26 AM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> Padraic, I'm not really interested in another prolonged discussion,
> especially where my arguments are ignored or misconstrued and then
> dismissed. I have explained my opinion, if somebody has questions about
> the substance of my arguments or need me to clarify my points, rather
> than flat-out denial of what I am saying, they know where to find me. I
> think this RFC is bad. You think it's excellent. I tried to explain my
> point to you, judging by your responses, I failed to convey my meaning.
> I am probably bad at this, but I'm not going to become better by
> repeating the same over and over.
>

I'm not ignoring your discussion at all. That's why I was proposed context
based protection before. It turned out context based detection does not
work well at all with your discussion. So I switched back to original idea
which detects filename extension.

As I stated in the RFC, we have/had so many script/file inclusion
vulnerabilities
in past. F-Secure which is one of antivirus vendor reports image based PHP
script malware is increasing! We can easily find WordPress users who were
installed WebShell by attackers, for example.

What I'm proposing is to introduce effective mitigation (defense in depth)
against
_fatal_ security breach. Your discussion for this RFC does not negate the
protection proposed. IMHO.

If you don't like or don't need the protection, you can easily disable it
while
the protection can protect many programs/users against fatal security
breach.
(I'm not saying the proposal can prevent all kinds of codes/attacks)

I don't think attackers can circumvent the default configuration. If it
can,
please let me know. Please keep in mind that we are discussing for
include/require security.

I hope you realize the benefits of this proposal.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1135a514166bd1050ff28511--