Re: Re: [RFC] No PHP tags

Hi Lester, On Wed, Feb 12, 2014 at 2:56 PM, Lester Caine <lester@lsces.co.uk> wrote: > Lester Caine wrote: > >> can you really protect them anyway? >> > Yasuo > Have you actually looked at the 'Some recent LFI issues' that are listed? > I don't thing any one of them would have been protected from by this > change? Providing a php page that can DISPLAY or run any file that it can > read is not going to be protected from by switching embedding off? 1st one is file upload vulnerability. I'll replace it something else. 2nd one is http://seclists.org/bugtraq/2012/Apr/53 $filepath = "$path_to_citrus/$load.php"; if (file_exists($filepath)) { include('./'.$load.'.php'); I'm not sure what they are loading. script() prevents from reading /etc/passwd or any other files. 3rd one is https://localhost/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=../../../../../../../../etc/passwd%00 It could also be protected by script(). 4th one is http://TARGET/onefilecms/onefilecms.php?f=../../../../etc/passwd The same as 3rd one. It works well for LFI. Important thing is include()/require() needs extra care to make sure it's secure. I would suggest to validate all inputs, but user may have invalid validation. Single mistake could be serious disaster. It's better if there is script() for sure. (Defense in depth) Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net