oss-sec mailing list archives
Re: Re: CVE Request - roundcubemail
From: Raphael Geissert <atomo64+debian () gmail com>
Date: Tue, 16 Dec 2008 21:19:45 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Christian Hoffmann wrote:
On 2008-12-15 11:32, Florian Weimer wrote:Nowhere in the documentation it says that "" quotes are unsafe when combined with a sufficiently general capture pattern.Well yes, it would probably be better to have a big warning at this place, because this flag is very dangerous unless used properly and all use cases should be expressable through preg_replace_callback as well, which is hard to use improperly from a syntax point of view, as no evaluation of user-supplied data is ever going to happen. :) But I would not say that PHP or its docs are wrong because of this.
IMHO the docs are lacking a very important bit of information.
I cannot think of a case where single quotes could be easily circumvented somehow, but I'd never claim to be perfectly right here. Upstream added a perfectly fine fix, they replaced the /e usage by preg_replace_callback, so I don't see a reason why you would want to apply a different fix.
Of course, no different fix was planned (on roundcube). We were actually looking for something in PHP itself that could be treated as the origin of all those security issues. We have been thinking about disabling support for the e modifier, but that requires collaboration with upstreams (PHP and script writers) and looking for incompatibilities in existing software. Maybe it could be dropped from PHP6, now that register_globals, safe_mode, magic_quotes_gpc, and friends are being dropped as well. Cheers, - -- Raphael Geissert - Debian Maintainer www.debian.org - get.debian.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAklIb9EACgkQYy49rUbZzlp8oQCfQ8LLlThh+b018U2yENSZUqaY v6IAnRDzTKs0YZofI1KhsuDGe7u27VzE =wbnP -----END PGP SIGNATURE-----
Current thread:
- Re: Re: CVE Request - roundcubemail, (continued)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 13)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 13)
- Re: Re: CVE Request - roundcubemail Steven M. Christey (Dec 16)
- Re: Re: CVE Request - roundcubemail Jan Lieskovsky (Dec 17)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 17)
- Re: Re: CVE Request - roundcubemail Steven M. Christey (Dec 24)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 28)
- Re: Re: CVE Request - roundcubemail Jan Lieskovsky (Dec 15)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 15)
- Re: Re: CVE Request - roundcubemail Christian Hoffmann (Dec 15)
- Re: Re: CVE Request - roundcubemail Raphael Geissert (Dec 16)