3 ms·

> `is_uploaded_file` and `move_uploaded_file` are the band-aid It's not a band-aid. When a file is uploaded (see RFC 1867) via HTTP POST, PHP internally alloca

by meritt 6y ago

> `is_uploaded_file` and `move_uploaded_file` are the band-aid It's not a band-aid. When a file is uploaded (see RFC 1867) via HTTP POST, PHP internally allocates a hash table that tracks which files on the filesystem have been uploaded. When the process terminates, it uses that hashtable to remove any remaining uploaded files in the tmp space. move_uploaded_file() confirms that the filename was indeed created as a result of an upload, and additionally removes that entry from the hash table.

huhtenberg 6y ago
> move_uploaded_file() confirms that the filename was indeed created as a result of an upload, and additionally removes that entry from the hash table. In other words, move_uploaded_file() protects against moving a non-uploaded file or moving one more than once. So it's for an upload processing code that, at some point, is becoming unsure of what the heck it is doing. It is a band-aid.
- meritt 6y ago
  Edit: You know what? Fuck you. I'm done trying to help explain why you're incorrect.
  - huhtenberg 6y ago
    > You're creating a memory leak A resource leak. That's assuming that you are referring to temp files not getting removed once the POST handler exits... which is not how it works. https://www.php.net/manual/en/features.file-upload.post-method.php https://www.php.net/manual/en/features.file-upload.post-meth... The file will be deleted from the temporary directory at the end of the request if it has not been moved away or renamed. > the internal rfc1867 uploaded files hash table. This RFC does not talk about life cycle management of uploaded files at all, leave alone such specifics as hash tables.
    - meritt 6y ago
      Edit: You know what? Fuck you. I'm done trying to help explain why you're incorrect.
      - huhtenberg 6y ago
        Ah, the good old trick of descending to incivility when lacking factual responses. Well done! Edit - and editing comments post-factum by pointing at kilobytes of source code.
        deleted 6y ago
        [deleted]
        pedrocx486 6y ago
        Consider me impressed, you just posted here common sense and basic knowledge and yet triggered them hard. (Two comments in a row even.) Is there a way to call Dang to have a look at those offensive comments? :-)
        dang 6y ago
        You can flag a comment by clicking on its timestamp to go to its page, then click 'flag' at the top. In egregious cases, email us at hn@ycombinator.com.
      - dang 6y ago
        Yikes, please don't go on tilt like this on HN, regardless of how frustrating a conversation has become. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- eganist 6y ago
  > In other words, move_uploaded_file() protects against moving a non-uploaded file or moving one more than once. Sure. > So it's for an upload processing code that, at some point, is becoming unsure of what the heck it is doing. How do you get to this conclusion from the above? > It is a band-aid. Nope. Uploaded file checking would seem to be necessary, though rather than requiring the developer to implement it, there's some lang-sec value in php doing the check automatically with any $_FILES references and instead allowing the developer to suppress it. That's an area where implementation can be refined, but it doesn't make the current solution a band-aid by any stretch. Edit: as an example, I'd much rather see the example given in php docs actually implemented as part of the framework rather than delegated to the developer. But aside from just dumping all uploaded files in one quarantined location, this solution is a functional pattern. https://www.php.net/manual/en/function.is-uploaded-file.php https://www.php.net/manual/en/function.is-uploaded-file.php (I'm not a php dev, and docs on the relevant functions date back to 2003, so for all I know, this has been rectified in the intervening 17 years)

by meritt 6y ago

huhtenberg 6y ago

> move_uploaded_file() confirms that the filename was indeed created as a result of an upload, and additionally removes that entry from the hash table. In other words, move_uploaded_file() protects against moving a non-uploaded file or moving one more than once. So it's for an upload processing code that, at some point, is becoming unsure of what the heck it is doing. It is a band-aid.

meritt 6y ago
Edit: You know what? Fuck you. I'm done trying to help explain why you're incorrect.
- huhtenberg 6y ago
  > You're creating a memory leak A resource leak. That's assuming that you are referring to temp files not getting removed once the POST handler exits... which is not how it works. https://www.php.net/manual/en/features.file-upload.post-method.php https://www.php.net/manual/en/features.file-upload.post-meth... The file will be deleted from the temporary directory at the end of the request if it has not been moved away or renamed. > the internal rfc1867 uploaded files hash table. This RFC does not talk about life cycle management of uploaded files at all, leave alone such specifics as hash tables.
  - meritt 6y ago
    Edit: You know what? Fuck you. I'm done trying to help explain why you're incorrect.
    - huhtenberg 6y ago
      Ah, the good old trick of descending to incivility when lacking factual responses. Well done! Edit - and editing comments post-factum by pointing at kilobytes of source code.
      - deleted 6y ago
        [deleted]
      - pedrocx486 6y ago
        Consider me impressed, you just posted here common sense and basic knowledge and yet triggered them hard. (Two comments in a row even.) Is there a way to call Dang to have a look at those offensive comments? :-)
        dang 6y ago
        You can flag a comment by clicking on its timestamp to go to its page, then click 'flag' at the top. In egregious cases, email us at hn@ycombinator.com.
    - dang 6y ago
      Yikes, please don't go on tilt like this on HN, regardless of how frustrating a conversation has become. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
eganist 6y ago
> In other words, move_uploaded_file() protects against moving a non-uploaded file or moving one more than once. Sure. > So it's for an upload processing code that, at some point, is becoming unsure of what the heck it is doing. How do you get to this conclusion from the above? > It is a band-aid. Nope. Uploaded file checking would seem to be necessary, though rather than requiring the developer to implement it, there's some lang-sec value in php doing the check automatically with any $_FILES references and instead allowing the developer to suppress it. That's an area where implementation can be refined, but it doesn't make the current solution a band-aid by any stretch. Edit: as an example, I'd much rather see the example given in php docs actually implemented as part of the framework rather than delegated to the developer. But aside from just dumping all uploaded files in one quarantined location, this solution is a functional pattern. https://www.php.net/manual/en/function.is-uploaded-file.php https://www.php.net/manual/en/function.is-uploaded-file.php (I'm not a php dev, and docs on the relevant functions date back to 2003, so for all I know, this has been rectified in the intervening 17 years)