Re: Re: [RFC][DISCUSSION] script() and script_once()

Hi Pierre, On Fri, Feb 6, 2015 at 12:40 PM, Pierre Joye <pierre.php@gmail.com> wrote: > > Even if uploaded files are stored under non web root dir, attackers can > use > > path > > traversal or even full path with bad code. As long as PHP can access, > > attacker > > can access to files for inclusion attacks. Compression/encryption > prevents > > attack files executing via script()/require(). Does this answer to you? > > Not really. One will have to use exec and call php and the desired > file as a well configured server won't allow exec of php in the upload > or tmp dir, via the web server. It does not mean they are outside a > web doc root, only that no php (or other) will ever be executed from > there. > With SElinux, we can restrict access. However, PHP should be able to read/write uploaded files. PHP just read and execute them with include. Is windows possible to prevent PHP to load script and execute? While allowing write/read access? I have similar idea for PHP to have data only dirs. > > Also PHP is one part of the big picture, so I will simply summarize it > as "as long as one can access" instead of "as long as PHP can access". > That says all we need to know about emulating (badly anyway) OS > security features in PHP. > > > I realized that I didn't think of byte compiler format. I have to > research > > it. > > IIRC, Zend allows to have custom script loader. > > Could anyone give some pointers to look around? or give some ideas? > > PHK and Phar f.e. Thank you. I'll check PHK. I guess I should check Zend product, too. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net