Bug #81087 [Fbk]: Disabled function must not be allowed to declare in script

Edit report at https://bugs.php.net/bug.php?id=81087&edit=1 ID: 81087 Updated by: krakjoe@php.net Reported by: mvorisek at mvorisek dot cz Summary: Disabled function must not be allowed to declare in script Status: Feedback Type: Bug Package: *General Issues Operating System: any PHP Version: 8.0.6 Block user comment: N Private report: N New Comment: *because it wants Previous Comments: ------------------------------------------------------------------------ [2021-05-27 17:37:55] krakjoe@php.net If a third party has the access necessary to declare a new function, isn't it too late to plug the security hole you imagine this opens up ? It's now a possibility for normal code to disable an inbuilt function because it wasn't to declare another implementation, I'm not sure why we should not allow that. ------------------------------------------------------------------------ [2021-05-27 17:30:42] mvorisek at mvorisek dot cz Description: ------------ See https://3v4l.org/DNoNp As of PHP 8.0 disabled function are removed before the script is run. But the function name can be redeclared in script which can imply a script security issue. Imagine proc_open (and all related) functions are disabled. Some 3rd party can redeclare this function. When some script checks for existence of that function, check passes and completely different implementation is run. This should be not possible. It is fine that function_exists returns false for disabled function, but injecting function with the same name must result in a fatal error. Test script: --------------- <?php var_dump(ini_get('disable_functions')); // string(22) "proc_open,phpinfo,mail" eval('function proc_open() { echo \'x\'; }'); proc_open(); Expected result: ---------------- see desc, fatal error Actual result: -------------- string(22) "proc_open,phpinfo,mail" x ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81087&edit=1