Re: Security implications of parsing env variables in .ini

This is a valid concern, as we are side-loading plugins in our software, where plugin information is defined in a .ini file. But somehow I thought that INI_SCANNER_TYPED was a bit like INI_SCANNER_RAW but also able to handle null/true/false values. Unfortunately it's not the case: php > var_export(parse_ini_string("secret=\${AWS_SECRET_ACCESS_KEY}", false, INI_SCANNER_TYPED)); array ( 'secret' => '42', ) If you want to be able to have false/true/null values without expanding variables and constants you are out of luck. Maybe we should have another constant to be able to disable both variable and constant expansion when using parse_ini_* functions, for example: parse_ini_file('file.ini', false, INI_SCANNER_TYPED & ~INI_SCANNER_EXPANSION); Or something similar.