Req #72999 [NEW]: assert_options should allow to disable evaluation of strings in assert()
From: php dot bohwaz at miam dot kd2 dot org
Operating system: All
PHP version: 5.6.25
Package: Unknown/Other Function
Bug Type: Feature/Change Request
Bug description:assert_options should allow to disable evaluation of strings in assert()
Description:
------------
assert() being able to evaluate its first argument if it is a string can
lead to security problems, especially on shared hosting where assertions
are usually enabled by default.
This way assert() may be used as a way to execute malicious code.
A good idea for the next PHP 7 release would be to add an option to
assert_options() to be able to disable the eval() feature of assert()
for strings. An example of this idea:
<?php
assert_options(ASSERT_EVAL, false);
assert('print("OK");'); // evaluated as string => true, assertion
successful
?>
And on the next major PHP version we could then disable evaluation by
default (BC break), and still let users enable that if needed. This
would improve default security of PHP installations.
Test script:
---------------
<?php
// Example of possible remote code execution
function getUser($id)
{
assert($id, 'User ID is not present');
}
getUser($_GET['id']);
--
Edit bug report at https://bugs.php.net/bug.php?id=72999&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72999&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72999&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72999&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=72999&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=72999&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=72999&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=72999&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=72999&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=72999&r=support
Expected behavior: https://bugs.php.net/fix.php?id=72999&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=72999&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=72999&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=72999&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72999&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=72999&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=72999&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=72999&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=72999&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=72999&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=72999&r=mysqlcfg
Thread (2 messages)
- php dot bohwaz at miam dot kd2 dot org