Re: PHP File Upload Security Hole - Still No Fix?

Zeev Suraski <zeev@zend.com> wrote: > There's basically one question you should be asking yourself right now - > are you going to whine, or are you going to do something about changing > what you think to be wrong. What's the difference? These are policy issues, the only way to change them is to talk about them. > Personally, there are great deals of code that I don't particularly like > (the file upload code happens to be one of them), but most of PHP's core is > extremely clean *and* secure nowadays. I must admit most of my experience is with PHP 3. PHP 4 only started working on OpenBSD with the PHP 4.0.2 release the other day. But, the only issue that I have mentioned with the PHP source is that I don't think safe_mode is a good idea. (And yes, I think the source is ugly, but that's somewhat subjective.) > (binary safety to avoid buffer overflows, I found this interesting undocumented feature while looking at all this file upload stuff: php_variables.c:202-205 /* FIXME: XXX: not binary safe, discards returned length */ php_url_decode(var, strlen(var)); php_url_decode(val, strlen(val)); php_register_variable(var, val, array_ptr ELS_CC PLS_CC); Sheesh. "Warning: PHP may unexpectedly corrupt your data." > As for the actual patch - I have to admit that as it doesn't completely > eliminate this exploit family, it's not all that useful. It doesn't do anything at all! It was a complete waste of time. You might as well write a patch to fix the special case where the evil hacker's name is Ian. This is the main cause of my sarcasm in this thread. You're all trying very hard to give the impression that you simply don't know what you're doing. > I've been an advocate of track_vars for years now, and I too think that > register_globals is a disaster waiting to happen in some cases. I'm in > favour of documenting this and encourage people to turn it off Excellent. Put it in the manual! Make the next release have it turned off by default! For sure, put in really large letters in the release notes what you've done, but new users and new scripts should not continue to be written using register_globals. > There's no need for your one letter functions, There's no *need*, they just help the script author write scripts more easily and quickly, and encourages them to do things the right way. I thought PHP was all for this. (I can't imagine otherwise why you have such a vast number of built-in functions.) > which greatly reduce performance. Make them keywords. Use a special '%' syntax. Whatever. What you say here is simply untrue. > Finally, and I don't want to start an argument, but you should do something > about your tone. You people don't deserve me being nice to you. Be that as it may, this is a sarcasm-free posting. Rejoice. Cheers Jon