# Proposal: restrict the number of filters

- Thread: https://externals.io/message/125920
- Original archive: https://news-web.php.net/php.internals/125920
- Started by jvoisin on 2024-11-07T14:29:49+00:00
- Messages: 2
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #125920 — jvoisin — 2024-11-07T14:29:49+00:00

URL: https://externals.io/message/125920#125920

Hello,

Chaining filters is becoming an increasingly popular primitive to
exploit PHP applications:

-
https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-it.html
+ https://github.com/synacktiv/php_filter_chain_generator
-
https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle.html
+  https://github.com/synacktiv/php_filter_chains_oracle_exploit
- https://www.ambionics.io/blog/wrapwrap-php-filters-suffix +
https://github.com/ambionics/wrapwrap
- https://www.ambionics.io/blog/lightyear-file-dump +
https://github.com/ambionics/lightyear

They provide increasingly powerful primitives ranging from arbitrary
file read to arbitrary code execution, and are tedious to protect
against, as filters can be used in a lot of places.

The easiest way to kill this vector is to simply limit the number of
filters that can be chained, as attacks require a at least a couple of
them, while legitimate use usually use one or two tops, as highlighted
by arnaud-lb's analysis:
https://github.com/php/php-src/pull/16699#issuecomment-2462281938

I sent a pull-request to implement this:
https://github.com/php/php-src/pull/16699

What do y'all think about this?

-- 
Julien (jvoisin) Voisin
GPG: 04D041E8171901CC
dustri.org

---

## #125925 — Derick Rethans — 2024-11-07T16:40:32+00:00

URL: https://externals.io/message/125920#125925 · In reply to: #125920

> The easiest way to kill this vector is to simply limit the number of
> filters that can be chained, as attacks require a at least a couple of
> them, while legitimate use usually use one or two tops, as highlighted
> by arnaud-lb's analysis:
> https://github.com/php/php-src/pull/16699#issuecomment-2462281938
> 
> I sent a pull-request to implement this:
> https://github.com/php/php-src/pull/16699
> 
> What do y'all think about this?

I am not a fan of hardcoding arbitrary limits, or having an ini setting 
for such a limit. I especially think that the suggested limit of 5, or 
even 3, is not a good idea.

The example that the issue links to to fix a vulnaribility in is:

	include $_GET['page'];

Which is... yeah.

cheers,
Derick

-- 
https://derickrethans.nl | https://xdebug.org | https://dram.io

Author of Xdebug. Like it? Consider supporting me: https://xdebug.org/support

mastodon: @derickr@phpc.social @xdebug@phpc.social