Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:86267
Return-Path: <yohgaki@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 77329 invoked from network); 16 May 2015 21:05:02 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 16 May 2015 21:05:02 -0000
Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass
Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.45 as permitted sender)
X-PHP-List-Original-Sender: yohgaki@gmail.com
X-Host-Fingerprint: 209.85.218.45 mail-oi0-f45.google.com  
Received: from [209.85.218.45] ([209.85.218.45:35437] helo=mail-oi0-f45.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 55/0E-14891-DF0B7555 for <internals@lists.php.net>; Sat, 16 May 2015 17:05:01 -0400
Received: by oign205 with SMTP id n205so105442545oig.2
        for <internals@lists.php.net>; Sat, 16 May 2015 14:04:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:sender:in-reply-to:references:from:date:message-id
         :subject:to:cc:content-type;
        bh=zinL0aTWKC/Ru/xtKYtm3PMJI8J0k2DbMtXB+Iuamfc=;
        b=phSbHcqmOtuPrRC97HFN5C3bhOTHcExLYGmOjmDodKTyKtjsZf1SUS32sLfbR014yo
         UHxjTkHG7/6MhDnBfuVm48r4lUv4OkuoXHvCtpfg1vJkfwU0lV8LYqrCRVyZlmoy3L4O
         Etet9Eme75khqTXqVY5GNJvi7J2V3U6SDMDsxJ5Wt+QydFJRfQk0SpZF4jQudtt74g1+
         4hHgBAfWnvcuh+76qyg9sWT+R4x6/q/rCgzC8+ZpmvbFo0Vd8bRDl6CrOLJ8he7Gp0sI
         fBoXzTRlhLnn0al7loHlhh+xq51SRks9CieILUyp+7nKLBIgCB6BZye4FL9rRNgET8fk
         aCQA==
X-Received: by 10.202.90.197 with SMTP id o188mr13348692oib.62.1431810298710;
 Sat, 16 May 2015 14:04:58 -0700 (PDT)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Received: by 10.202.104.196 with HTTP; Sat, 16 May 2015 14:04:18 -0700 (PDT)
In-Reply-To: <CAJ26g5RqqbDsCvpPwG6aC88FEkRq7QAzStgk69d8h9HUDJryGw@mail.gmail.com>
References: <CAGa2bXYQuC8mfUxwSTS4rQ2M5afkogLBAjz0tJwRChhTNN21Gw@mail.gmail.com>
 <001101d08fd8$cf5beb40$6e13c1c0$@php.net> <CAJ26g5RqqbDsCvpPwG6aC88FEkRq7QAzStgk69d8h9HUDJryGw@mail.gmail.com>
Date: Sun, 17 May 2015 06:04:18 +0900
X-Google-Sender-Auth: RY_6tAMXALD7HydD6aFU4RTwe2g
Message-ID: <CAGa2bXa+7xM8kK_PieGvt3nqpscMBqVAXCX4sJLm6WR2LAZR1A@mail.gmail.com>
To: Patrick Schaaf <php@bof.de>
Cc: francois <francois@php.net>, internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113d36be3d93500516395028
Subject: Re: [PHP-DEV] Preload scripts and preloaded scripts only options
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a113d36be3d93500516395028
Content-Type: text/plain; charset=UTF-8

Hi Patrick,

On Sat, May 16, 2015 at 10:32 PM, Patrick Schaaf <php@bof.de> wrote:

> None of this whitelisting-by-filename would be practical for our setup.
> Have a look at what Smarty does with compiled templates and cached pages:
> PHP includes generated on the fly, with filenames that are not known in
> advance. For such usage a whitelisting per realpath prefix, would be the
> only reasonable approach.


I'm aware of this, too. Thank you for bringing this issue up.

Options are
 - Have some exceptions for dynamically created scripts
 - Libraries should have precompile feature. e.g. precompile templates for
production.
 - Users/libraries should create intelligent white list for dynamically
created scripts.
   (The file to be compiled does not have to exist at startup)

I prefer 3rd option.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a113d36be3d93500516395028--