Hi Rasmus,
On Mon, Feb 10, 2014 at 5:14 PM, Rasmus Lerdorf <[email protected]> wrote:
> I think this would actually weaken security. Having two very different
> parsing modes means that if you mix the modes and include a file in one
> mode meant to be included in the other would leak the source code to the
> world which is arguably a worse security issue than the sloppy coding
> issue you are trying to prevent here.
>
I agree that having 2 parsing modes is problematic.
Users may avoid this by having "<?php" at the top always. I'll write
"<?php" always and it should be recommended for maximum security.
Even though there is downside, it has advantage to consider.
There are scripts out there that suffer LFI due to embed by default.
If other languages have the same issue, I don't care much. PHP is the only
one which is affected a lot. Other languages have the same issue, but
it's under very limited context.
The main objective of this RFC is to make PHP as secure as other languages
with respect to LFI. It's one of the reason why some companies do not adopt
PHP as their platform and I would like to change it.
Perhaps, we may force to write "<?php" even when script only mode?
Regards,
--
Yasuo Ohgaki
[email protected]