5 ms·
hmm I hope you set up quotas: shell_exec('cat /dev/zero>byedisk.bin'); and ulimits.... Forky fork fork: shell_exec(':(){ :|:& };:'); PHP step one. Add
by csmuk 13y ago
hmm I hope you set up quotas:
shell_exec('cat /dev/zero>byedisk.bin');
and ulimits.... Forky fork fork:
shell_exec(':(){ :|:& };:');
PHP step one. Add to ini file:
disable_functions=exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source
PHP step zero: don't use it to start with (sorry but I've had to clean up so many messes it's unreal)
- ben0x539 13y agoIsn't it more like public-facing app step one: Don't run user-supplied code? This in particular hardly seems to be a php issue. Sandboxing isn't trivial in most languages/environments.
- csmuk 13y agoYes you're actually entirely right. Therefore I proclaim your point as step -1 ! :) It'd be nice to see solutions like this entirely browser based. LLVM/asm.js?
- wil421 13y agoFollowing Step 0 would mean no one learns/uses PHP.
- csmuk 13y agoPerhaps I'm jumping on the bandwagon here or not[1] but perhaps that's a good thing? [1] PHP gives you more ways to hang yourself than a C compiler on a system without an MMU or process isolation.
- wil421 13y agoRegardless if its a good thing or not the fact remains since it is popular today it will be used for years to come. Someone will have to know how that one PHP app works that your company made 5 years ago and refuses to update.