Re: filesystem security questions

From:	Melvyn Sopacua	Date:	Sat, 08 Jun 2002 11:53:27 +0000
Subject:	Re: filesystem security questions
References:	1 2 3 4 5	Groups:	php.dev
Request:	Send a blank email to php-dev+get-85034@lists.php.net to get a copy of this message

Hi Rob, At 13:22 8-6-2002, Rob Richards shared with all of us:

right now I am using the following to test for a remote path:
    if (!strncasecmp(file,"http://", 7) || !strncasecmp(file,"ftp://", 6)) {
which could be expanded upon if additional protocols are added to libxml.

From a user's point of view: Sablotron uses scheme handlers, which can be registered for a certain protocol. This allows custom protocols to be added in php. Would love to see the same thing apply to domxml and if eventually resources between the different extensions could be passed arround, this would certainly help. One could do it like this for instance: <!ENTITY % dynamic SYSTEM "domxml://resourcename/rootnode/entityblock/entityname"> %dynamic; and vice-versa for xml-stylesheet PI's. The remote check would be static: if(!strncasecmp(file, "file://", 7)) || !strncasecmp(file, "sablot://", 9)) { Then through a case statement of 'known' schemes and any that require safe_mode could go through the streams. Any custom schemas that are registered in php, would have to call fopen/sockets/whatever and are handled by streams/safe_mode automatically. 2c. Met vriendelijke groeten / With kind regards, IDG.nl Melvyn Sopacua Webmaster