Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:86266
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.181 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <001101d08fd8$cf5beb40$6e13c1c0$@php.net>
References: <CAGa2bXYQuC8mfUxwSTS4rQ2M5afkogLBAjz0tJwRChhTNN21Gw@mail.gmail.com>
 <001101d08fd8$cf5beb40$6e13c1c0$@php.net>
Date: Sun, 17 May 2015 05:57:21 +0900
Message-ID: <CAGa2bXZxQGi5PdQpY0WsTOXsA7e26SexT93ZYvfNA5VuNdufFg@mail.gmail.com>
To: francois <francois@php.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113d1dc6624f9d051639378c
Subject: Re: [PHP-DEV] Preload scripts and preloaded scripts only options
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a113d1dc6624f9d051639378c
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Francois,

On Sat, May 16, 2015 at 10:04 PM, Fran=C3=A7ois Laupretre <francois@php.net=
>
wrote:

> > De : yohgaki@gmail.com [mailto:yohgaki@gmail.com] De la part de Yasuo
> > Ohgaki
> >
> > As some of you know that I'm trying to to eliminate script inclusion
> attack.
> > I come up with another idea which may have consensus.
> >
> > PHP compiler is fast enough for almost all apps without script
> preloading.
> > However, large sites take advantage of  opcache_compile_file() to
> maximize
> > the performance/response.
> >
> > How about have a preloaded scripts configuration?
> > In addition, how about have a option that allows preloaded script only?
> >
> > This way, PHP will execute only scripts listed in the "whitelist".
> > This is perfect solution for eliminating php script inclusion attacks.
> > In addition, users don't have to preload script one by one using
> > opcache_compile_file().
> >
> > These options may be PHP/Zend or opcache options.
>
> Does it mean you preload every script you could use ? In a typical
> application with potential access to, say, 4,000/5,000 PHP scripts, does =
it
> mean you will preload them all before running anything ? I hope it is not
> the case because it's generally impossible to know in advance which files
> you'll need. That's even the main benfit of autoloading.
>

The idea is preload everything in memory at startup. I'm thinking creating
the list like

find /var/www/myapp -name '*.php' > my_script_list

and use the list as white list.
We need to consider the case app has too many files for memory. Keeping
compiled
files in disk may be an option.


>
> An idea I had during a previous thread about script inclusion is a way to
> register a list of patterns that paths should match. The main script woul=
d
> register them and, then, every include/require would be filtered through
> the list. It just requires to run realpath() and match the result against=
 a
> set of patterns. Don't know the performance impact. Just an idea.
>

I think the idea is good enough. However, it seems there are people does
not like it
because it requires a little overhead.

Good part of new idea is it does not require any overhead (except startup
delay for
compiling all scripts before execution) It also maximize performance when
app starts.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a113d1dc6624f9d051639378c--