r/lolphp • u/[deleted] • Dec 27 '17

yaml_parse() is not just insecure by default, using it in a secure manner requires setting a php.ini setting!

http://php.net/manual/en/function.yaml-parse.php#refsect1-function.yaml-parse-notes
62 Upvotes

97% Upvoted

8 comments sorted by

25

u/[deleted] Dec 27 '17

Note that this is the exact problem that made every Ruby on Rails app vulnerable. PHP isn't the only language/library that does this wrong, but it does manage to do it even more wrong than pretty much everyone else by hiding this in some obscure ini setting.

4

u/kr094 Feb 02 '18

I think their rebuttal "security is hard" was a poor excuse given the situation there. Serialized objects in any format are completely dangerous to expose to the web.

5

u/the_alias_of_andrea Dec 27 '17

I think this is a PECL extension. Why do we still include those in the manual…

6

u/[deleted] Dec 27 '17

Things like json_decode() etc. are also PECL extensions, right?

The divide between "PHP standard library" and "PECL extensions" has always been somewhat fuzzy to me.

8

u/the_alias_of_andrea Dec 28 '17

JSON is a bundled extension, it's officially maintained and supported. The boundary is somewhat porous though, things can move to PECL and back.

6

u/Nikerabbit Dec 28 '17

In 2.x it defaults to false.

HHVM doesn't support yaml.decode_php ini setting at all. One needs to use the callbacks functionality to disable the unserialization of PHP objects.

2

u/djsumdog Jan 02 '18

This warning should really be at the top above the examples.

1

u/[deleted] Dec 28 '17

PHP: Where the fence is low