On Fri, Feb 6, 2015 at 11:08 AM, Yasuo Ohgaki <yohg...@ohgaki.net> wrote:
> > On Fri, Feb 6, 2015 at 12:40 PM, Pierre Joye <pierre....@gmail.com> wrote: >> >> > Even if uploaded files are stored under non web root dir, attackers can >> > use >> > path >> > traversal or even full path with bad code. As long as PHP can access, >> > attacker >> > can access to files for inclusion attacks. Compression/encryption >> > prevents >> > attack files executing via script()/require(). Does this answer to you? >> >> Not really. One will have to use exec and call php and the desired >> file as a well configured server won't allow exec of php in the upload >> or tmp dir, via the web server. It does not mean they are outside a >> web doc root, only that no php (or other) will ever be executed from >> there. > > > With SElinux, we can restrict access. However, PHP should be able to > read/write > uploaded files. PHP just read and execute them with include. Again, I am talking about executing files. You can exclude a file, path, folder for being invoked with a handler or similar things on a web server. It has nothing to do with the PHP ability to access this file as normal data. That won't prevent a file_get_contents+eval but you get the idea. > Is windows possible to prevent PHP to load script and execute? While > allowing write/read access? Yes and no. It is a web server role. Linux allows access restrictions too, windows only provides a much more fine grained ACL. But again, it is not what I am referring to. > I have similar idea for PHP to have data only dirs. We have that already, not for php, but for web servers. This is their job to deal with that. >> >> >> Also PHP is one part of the big picture, so I will simply summarize it >> as "as long as one can access" instead of "as long as PHP can access". >> That says all we need to know about emulating (badly anyway) OS >> security features in PHP. >> >> > I realized that I didn't think of byte compiler format. I have to >> > research >> > it. >> > IIRC, Zend allows to have custom script loader. >> > Could anyone give some pointers to look around? or give some ideas? >> >> PHK and Phar f.e. > > > Thank you. I'll check PHK. > I guess I should check Zend product, too. > > Regards, > > -- > Yasuo Ohgaki > yohg...@ohgaki.net -- Pierre @pierrejoye | http://www.libgd.org -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php
