Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83965
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.43 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXYf7Bi1QPya96t0Z3cQkTWBCOG2p2gCLZSUTY=_gNp_kw@mail.gmail.com>
References: <CAGa2bXYf7Bi1QPya96t0Z3cQkTWBCOG2p2gCLZSUTY=_gNp_kw@mail.gmail.com>
Date: Fri, 27 Feb 2015 15:56:17 +0900
Message-ID: <CAGa2bXZN_=NGsxateFQ_4L41MrKq6127shVyTh=dPAfTfXQ0yA@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1135a514de39b605100c5f0f
Subject: Re: [RFC][DISCUSSION] Remove allow_url_include INI
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1135a514de39b605100c5f0f
Content-Type: text/plain; charset=UTF-8

Hi all,

On Fri, Feb 27, 2015 at 12:44 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> This is RFC for removing "allow_url_include" INI option. [1]
>
> During "Script only include" RFC[2] discussion, stream wrapper issue is
> raised.
> I was thinking this issue as a separate issue, but it seems others are not.
>
> "Script only include" RFC does not cover stream wrapper hole. This RFC
> addresses
> the hole created by stream wrappers. Those who may be concerned this hole
> in "Script
> only include" RFC may reconsider your votes by this.
>
> Without this RFC, "Script only include" RFC may have infinite number of
> holes.
> This RFC closes them and make "Script only include" RFC more effective.
>
> I don't use phar on regular basis, feedback from phar users are
> appreciated.
> If you find yet another hole in [2], please let me know.
>
> [1] https://wiki.php.net/rfc/allow_url_include
> [2] https://wiki.php.net/rfc/script_only_include
>

Simpler approach could be specifying the prefix of URL (wrapper)

include('http://php.net', 'http://');

Pros:
 - Requires a lot less code modifications = less BC.
 - Simple string comparison is enough.
 - More specific which wrapper is used. (Only specified wrapper may be used)
 - More flexible when new wrapper is added. (No additional code is needed
for this)

Cons:
 - 'http://' looks redundant
 - 2nd parameter is used solely for specifying wrapper.
   i.e. Cannot use it for no embedded mode flag, etc. There may be pseudo
   wrapper like "noembed://", though.

Thoughts?

BTW, we are better to fix this regardless of
https://wiki.php.net/rfc/script_only_include
since we opened hole with Phar which looks like tar file that can be
executed as
PHP script. There are many servers that allow tar file uploads.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1135a514de39b605100c5f0f--