Re: Resolution for ver_export()/addslashes() encoding based script execution attack?

From:	Stas Malyshev	Date:	Wed, 26 Feb 2014 11:52:40 +0000
Subject:	Re: Resolution for ver_export()/addslashes() encoding based script execution attack?
References:	1 2 3 4 5 6 7	Groups:	php.internals
Request:	Send a blank email to [email protected] to get a copy of this message

Hi!

> The situation around var_export() is a bit more complicated.
> var_export() is used to create application configuration, cache data
> etc. so one might expect the PHP which created that to be able to read
> that, again. Doing this isn't easy, though, as it makes the generated
> file non-portable. 

Are you suggesting if var_export generates the data it may not be
readable by standard PHP? Or by PHP running with specific
script_encoding like SJIS? If the latter, I think var_export to generate
valid SJIS data is hard to achieve, since SJIS is not ASCII-compatible.
-- 
Stanislav Malyshev, Software Architect
SugarCRM: http://www.sugarcrm.com/
(408)454-6900 ext. 227


   

Thread (20 messages)

• Yasuo OhgakiMon, 24 Feb 2014 09:41:03 +0000
  • Nikita PopovMon, 24 Feb 2014 11:07:05 +0000
    • Yasuo OhgakiTue, 25 Feb 2014 05:07:02 +0000
      • Stas MalyshevTue, 25 Feb 2014 06:47:23 +0000
        • Yasuo OhgakiTue, 25 Feb 2014 10:36:11 +0000
          • Stas MalyshevTue, 25 Feb 2014 11:01:12 +0000
            • Johannes SchlüterTue, 25 Feb 2014 11:39:40 +0000
              • Yasuo OhgakiWed, 26 Feb 2014 06:15:01 +0000
                • Lester CaineWed, 26 Feb 2014 09:03:03 +0000
                  • Yasuo OhgakiWed, 26 Feb 2014 09:21:08 +0000
                    • Lester CaineWed, 26 Feb 2014 12:32:06 +0000
                      • Yasuo OhgakiWed, 26 Feb 2014 22:28:23 +0000
                        • Pádraic BradyThu, 27 Feb 2014 22:22:47 +0000
                          • Yasuo OhgakiThu, 27 Feb 2014 23:08:19 +0000
                            • Pierre JoyeFri, 28 Feb 2014 00:28:39 +0000
              • Stas MalyshevWed, 26 Feb 2014 11:52:40 +0000
                • Yasuo OhgakiWed, 26 Feb 2014 21:23:32 +0000
                  • Stas MalyshevFri, 28 Feb 2014 18:57:29 +0000
                    • Yasuo OhgakiSat, 01 Mar 2014 00:19:41 +0000
            • Yasuo OhgakiWed, 26 Feb 2014 05:25:45 +0000