Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83854
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.48 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <2kmsealj38h1k995ninhqfr9q4fr4cascq@4ax.com>
References: <CAGa2bXbt9FAdRtW1GxDyT+G-4bWBACTso_DOizcSHmmgmSVtmA@mail.gmail.com>
 <CAGa2bXb5QEKOggRbUnmVHuib=P_tJ9_W+QyMa_SCpc7RmSCgSA@mail.gmail.com>
 <54EE50CF.9090508@gmail.com> <54EE5634.1040300@seld.be> <2kmsealj38h1k995ninhqfr9q4fr4cascq@4ax.com>
Date: Thu, 26 Feb 2015 09:18:29 +0900
Message-ID: <CAGa2bXYMrkmf=Oc71P4TqWf7pNJ8-UOdyvC-yx9KJfyLTg_NOw@mail.gmail.com>
To: Jan Ehrhardt <phpdev@ehrhardt.nl>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c131f65c8288050ff2b385
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Introduce script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c131f65c8288050ff2b385
Content-Type: text/plain; charset=UTF-8

Hi Jan,

On Thu, Feb 26, 2015 at 8:30 AM, Jan Ehrhardt <phpdev@ehrhardt.nl> wrote:

> Jordi Boggiano in php.internals (Wed, 25 Feb 2015 23:09:40 +0000):
> >On 25/02/2015 22:46, Stanislav Malyshev wrote:
> >> 2. I think this RFC provides false sense of security for people that
> >> create vulnerable code and lets them think it's OK to have variable
> >> includes without adequate safety, since they are "protected" by these
> >> changes.
> >
> >People that are clueless already do not validate anything and are *NOT*
> >protected by this RFC. People that know what they are doing probably do
> >not need this patch. So the way I see it it's a win for random crappy
> >code out there, and a noop at worst for the others.
> >
> >> 3. I think it causes significant BC break which might be warranted in
> >> case it provides major improvement in security, but IMO in the light of
> >> the above it does not provide even minor one.
> >
> >A way to mitigate this might be to change the default to include a few
> >more common extensions like phtml, inc, or whatever. As those are all
> >commonly associated with PHP and offer no good reason to be allowed in
> >user uploads, I guess it's safe.
>
> Better yet: allow all by default. Then there is no BC break and nothing
> changes for clueless people. People with clue can make their own choice
> to use or not to use.
>

Providing "secure default" is our responsibility, especially for fatal
security breach. IMHO. We've done that for allow_url_include, for example.
I hoped allow_url_include and NULL byte prevention could eliminate script
inclusions, but it didn't.

This RFC is more powerful than allow_url_include/NULL byte protection. In
fact, it makes PHP programs as safe as other languages with respect to
script inclusions when consistent configuration is used.

The feature can be disabled by users easily. The feature warns users
possible security breaches. I don't see reasons disabling the feature
by default.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c131f65c8288050ff2b385--