Req #79541 [Fbk->Wfx]: Add ini option to disable URLs in getimagesize

Edit report at https://bugs.php.net/bug.php?id=79541&edit=1 ID: 79541 Updated by: requinix@php.net Reported by: mail at tomsommer dot dk Summary: Add ini option to disable URLs in getimagesize -Status: Feedback +Status: Wont fix Type: Feature/Change Request Package: GetImageSize related PHP Version: 7.4.5 Block user comment: N Private report: N New Comment: As blunt as his replies are, I agree with him. There are many ways that someone can misuse PHP and creating settings to disable each one is not the right answer. Better coding is. Whatever plugin or other mechanism is responsible for passing user input to getimagesize() needs to be updated to remove the vulnerability. Because that's essentially what this is: a vulnerability in the plugin. Standard practice in this situation is to give the administrator to choice of accepting all URLs or specifying a whitelist of domains to support. allow_url_fopen is PHP's security measure for disabling unwanted remote access, even if it affects everything. More settings just makes it harder to write portable code. Previous Comments: ------------------------------------------------------------------------ [2020-04-29 17:48:56] bugreports at gmail dot com > results in a http-request (or hundreds), chaining into poor performance etc. than disable url wrappers on the server > I realise a solution is proper validation, but Wordpress > plugins and user-code is rarely known for this garbage in, garbage out php is a programming language, you can't expect a programming language holding hands for every random "me too" developer, write bugreports for wodpress and the plugins a programming language is supposed to do what the developer say and shouldn't holding hands - how do you expect to behave the bad code when random ini options chnage basic behavior of the underlying prigramming language? ------------------------------------------------------------------------ [2020-04-29 17:44:44] mail at tomsommer dot dk Well, the problem is for instance Wordpress plugins where users submit URLs instead of file-paths, which goes directly into getimagesize() and thus results in a http-request (or hundreds), chaining into poor performance etc. I realise a solution is proper validation, but Wordpress plugins and user-code is rarely known for this. Thus as this can result in a server-problem, it would be great with a server-side toggle for it. ------------------------------------------------------------------------ [2020-04-29 17:42:27] bugreports at gmail dot com no, the whole https://www.php.net/manual/en/wrappers.php stuff is designed in a way that it don#t matter if the path is a physical file or a supported remote file and there is no sane reason to poke special handling into random function signatures > as it is often a sign of someone providing bad arguments (url instead of path) you are responsible to write code with validates input as developer ------------------------------------------------------------------------ [2020-04-29 17:42:05] mail at tomsommer dot dk Should be a separate option than allow_url_fopen ------------------------------------------------------------------------ [2020-04-29 17:42:03] requinix@php.net Thank you for this bug report. To properly diagnose the problem, we need a short but complete example script to be able to reproduce this bug ourselves. A proper reproducing script starts with <?php and ends with ?>, is max. 10-20 lines long and does not require any external resources such as databases, etc. If the script requires a database to demonstrate the issue, please make sure it creates all necessary tables, stored procedures etc. Please avoid embedding huge scripts into the report. Are you passing unvalidated input to getimagesize? If the problem is that someone is giving you a URL and you don't want them to, then the solution is to make sure that you don't let someone give you a URL. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=79541 -- Edit this bug report at https://bugs.php.net/bug.php?id=79541&edit=1