Bug #81087 [NEW]: Disabled function must not be allowed to declare in script

From: mvorisek at mvorisek dot cz Operating system: any PHP version: 8.0.6 Package: *General Issues Bug Type: Bug Bug description:Disabled function must not be allowed to declare in script Description: ------------ See https://3v4l.org/DNoNp As of PHP 8.0 disabled function are removed before the script is run. But the function name can be redeclared in script which can imply a script security issue. Imagine proc_open (and all related) functions are disabled. Some 3rd party can redeclare this function. When some script checks for existence of that function, check passes and completely different implementation is run. This should be not possible. It is fine that function_exists returns false for disabled function, but injecting function with the same name must result in a fatal error. Test script: --------------- <?php var_dump(ini_get('disable_functions')); // string(22) "proc_open,phpinfo,mail" eval('function proc_open() { echo \'x\'; }'); proc_open(); Expected result: ---------------- see desc, fatal error Actual result: -------------- string(22) "proc_open,phpinfo,mail" x -- Edit bug report at https://bugs.php.net/bug.php?id=81087&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=81087&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=81087&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=81087&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=81087&r=needscript Try newer version: https://bugs.php.net/fix.php?id=81087&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=81087&r=support Expected behavior: https://bugs.php.net/fix.php?id=81087&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=81087&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=81087&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=81087&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=81087&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=81087&r=dst IIS Stability: https://bugs.php.net/fix.php?id=81087&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=81087&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=81087&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=81087&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=81087&r=mysqlcfg