4 ms·

The fact they're using `eval()` to execute variable assignment... They could've just used the WTF-feature in PHP with double dollar signs. $$var = $itm; would'v

The fact they're using `eval()` to execute variable assignment... They could've just used the WTF-feature in PHP with double dollar signs. $$var = $itm; would've been equivalent to their eval statement, but with less code and no RCE.

hypeatei 2y ago
The fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.
- dpcx 2y ago
  I'm curious about some specifics of why you wouldn't use PHP for _critical_ web infrastructure?
  - sebstefan 2y ago
    https://duckduckgo.com/?q=hash+site:reddit.com/r/lolphp https://duckduckgo.com/?q=hash+site:reddit.com/r/lolphp https://duckduckgo.com/?q=crypt+site:reddit.com/r/lolphp https://duckduckgo.com/?q=crypt+site:reddit.com/r/lolphp >crc32($str) and hash("crc32",$str) use different algorithms .. >Password_verify() always returns true with some hash >md5('240610708') == md5('QNKCDZO') >crypt() on failure: return <13 characters of garbage > strcmp() will return 0 on error, can be used to bypass authentication > crc32 produces a negative signed int on 32bit machines but positive on 64bit mahines >5.3.7 Fails unit test, released anyway The takeaway from these titles is not the problems themselves but the pattern of failure and the issue of trusting the tool itself. Other than that if you've used php enough yourself you will absolutely find frustration in the standard library If you're looking for something more exhaustive there's the certified hood classic "PHP: A fractal of bad design" article as well that goes through ~~300+~~ 269 problems the language had and/or still has. https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ Though most of it has been fixed since 2012, there's only so much you can do before the good programmers in your community (and job market) just leave the language. What's left is what's left.
    - rty32 2y ago
      People keep saying "oh it's php 5.3 and before that are bad, things are much better now", but ...
- bell-cot 2y ago
  Modern PHP is about as solid as comparable languages. It's two biggest problems are: Lingering bad reputation, from the bad old days Minimal barrier to entry - which both makes it a go-to for people who should not be writing production code in any language, and encourages many higher-skill folks to look down on it
- KMnO4 2y ago
  Any language can be insecure. There’s nothing inherently bad about PHP, other than it’s the lowest-hanging fruit of CGI languages and has some less-than-ideal design decisions.
  - sebstefan 2y ago
    Don't just swipe the "less-than-ideal design decisions" under the rug
- krageon 2y ago
  It's very easy to make PHP safe, certainly now that we've passed the 7 mark and we have internal ASTs. Even when using eval, it's beyond trivial to not make gross mistakes.
  - deleted 2y ago
    [deleted]
- XCSme 2y ago
  Wouldn't "eval" in any language result in RCE? Isn't that the point of eval, to execute the given string command?
  - account42 2y ago
    Fully compiled languages don't even have an eval at all.
    - sebstefan 2y ago
      Not with that attitude Start shipping the compiler with your code for infrastructure-agnostic RCEs
      - adolph 2y ago
        When you turn pro you call it security software and add it to the kernel.
    - lambda 2y ago
      No, but they have system or the like, which is effectively the same, just being evaluated by the shell. https://man7.org/linux/man-pages/man3/system.3.html https://man7.org/linux/man-pages/man3/system.3.html
      - mdaniel 2y ago
        And thanks to the magic of "shoving strings from the Internet into a command line", poof, RCE! It bit GitLab twice
        xrisk 2y ago
        What incident are you referring to?
        mdaniel 2y ago
        https://gitlab.com/gitlab-org/gitlab/-/issues/327121 https://gitlab.com/gitlab-org/gitlab/-/issues/327121 is the first one, and I'm having trouble locating up the second (possibly due to the search pollution from the first one) but there are a bunch of "Exiftool has been updated to version [0-9.]+ in order to mitigate security issues" style lines in their security releases feed so it's possible they were bitten by upstream Exiftool CVEs Anyway, turns out that shelling out to an external binary fed with bytes from the Internet is good fun

hypeatei 2y ago

The fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.

dpcx 2y ago
I'm curious about some specifics of why you wouldn't use PHP for _critical_ web infrastructure?
- sebstefan 2y ago
  https://duckduckgo.com/?q=hash+site:reddit.com/r/lolphp https://duckduckgo.com/?q=hash+site:reddit.com/r/lolphp https://duckduckgo.com/?q=crypt+site:reddit.com/r/lolphp https://duckduckgo.com/?q=crypt+site:reddit.com/r/lolphp >crc32($str) and hash("crc32",$str) use different algorithms .. >Password_verify() always returns true with some hash >md5('240610708') == md5('QNKCDZO') >crypt() on failure: return <13 characters of garbage > strcmp() will return 0 on error, can be used to bypass authentication > crc32 produces a negative signed int on 32bit machines but positive on 64bit mahines >5.3.7 Fails unit test, released anyway The takeaway from these titles is not the problems themselves but the pattern of failure and the issue of trusting the tool itself. Other than that if you've used php enough yourself you will absolutely find frustration in the standard library If you're looking for something more exhaustive there's the certified hood classic "PHP: A fractal of bad design" article as well that goes through ~~300+~~ 269 problems the language had and/or still has. https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ Though most of it has been fixed since 2012, there's only so much you can do before the good programmers in your community (and job market) just leave the language. What's left is what's left.
  - rty32 2y ago
    People keep saying "oh it's php 5.3 and before that are bad, things are much better now", but ...
bell-cot 2y ago
Modern PHP is about as solid as comparable languages. It's two biggest problems are: Lingering bad reputation, from the bad old days Minimal barrier to entry - which both makes it a go-to for people who should not be writing production code in any language, and encourages many higher-skill folks to look down on it
KMnO4 2y ago
Any language can be insecure. There’s nothing inherently bad about PHP, other than it’s the lowest-hanging fruit of CGI languages and has some less-than-ideal design decisions.
- sebstefan 2y ago
  Don't just swipe the "less-than-ideal design decisions" under the rug
krageon 2y ago
It's very easy to make PHP safe, certainly now that we've passed the 7 mark and we have internal ASTs. Even when using eval, it's beyond trivial to not make gross mistakes.
- deleted 2y ago
  [deleted]
XCSme 2y ago
Wouldn't "eval" in any language result in RCE? Isn't that the point of eval, to execute the given string command?
- account42 2y ago
  Fully compiled languages don't even have an eval at all.
  - sebstefan 2y ago
    Not with that attitude Start shipping the compiler with your code for infrastructure-agnostic RCEs
    - adolph 2y ago
      When you turn pro you call it security software and add it to the kernel.
  - lambda 2y ago
    No, but they have system or the like, which is effectively the same, just being evaluated by the shell. https://man7.org/linux/man-pages/man3/system.3.html https://man7.org/linux/man-pages/man3/system.3.html
    - mdaniel 2y ago
      And thanks to the magic of "shoving strings from the Internet into a command line", poof, RCE! It bit GitLab twice
      - xrisk 2y ago
        What incident are you referring to?
        mdaniel 2y ago
        https://gitlab.com/gitlab-org/gitlab/-/issues/327121 https://gitlab.com/gitlab-org/gitlab/-/issues/327121 is the first one, and I'm having trouble locating up the second (possibly due to the search pollution from the first one) but there are a bunch of "Exiftool has been updated to version [0-9.]+ in order to mitigate security issues" style lines in their security releases feed so it's possible they were bitten by upstream Exiftool CVEs Anyway, turns out that shelling out to an external binary fed with bytes from the Internet is good fun