Debian Bug report logs - #639230
[php5] README.Debian.security: unclear reference to unserialize() risk

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Filipus Klutiero <chealer@gmail.com>

To: submit@bugs.debian.org

Subject: [php5] README.Debian.security: unclear reference to unserialize() risk

Date: Thu, 25 Aug 2011 03:05:25 -0400

Package: php5
Version: 5.3.8-1
Severity: minor

README.Debian.security contains:

> Most specifically, the security team will not provide
> support for flaws in:
>
> - problems which are not flaws in the design of php but can be problematic
>   when used by sloppy developers (for example: not checking the contents
>   of a tar file before extracting it, using unserialize() on
>   untrusted data, or relying on a specific value of short_open_tag).

It is unclear to me how using unserialize() on untrusted data would 
create a particular risk. Do you perhaps mean extract()?

Message #10 received at 639230-done@bugs.debian.org (full text, mbox, reply):

From: "Thijs Kinkhorst" <thijs@debian.org>

To: 639230-done@bugs.debian.org

Subject: Re: [php5] README.Debian.security: unclear reference to unserialize() risk

Date: Tue, 31 Jan 2012 14:41:07 +0100

Hi,

> README.Debian.security contains:

> > Most specifically, the security team will not provide
> > support for flaws in:
> >
> > - problems which are not flaws in the design of php but can be
problematic
> >   when used by sloppy developers (for example: not checking the contents
> >   of a tar file before extracting it, using unserialize() on
> >   untrusted data, or relying on a specific value of short_open_tag).

> It is unclear to me how using unserialize() on untrusted data would
> create a particular risk. Do you perhaps mean extract()?

README.Debian.security is designed to be a brief overview of what is
supported. Users that want to know more about *why* a certain technique
can be risky, can refer to the PHP manual. On the topic of unserialize(),
this writes:

"If the variable being unserialized is an object, after successfully
reconstructing the object PHP will automatically attempt to call the
__wakeup() member function (if it exists)."

which should clearly illustrate the risk with unserializing untrusted data.


Cheers,
Thijs

Message #15 received at 639230@bugs.debian.org (full text, mbox, reply):

From: Filipus Klutiero <chealer@gmail.com>

To: 639230@bugs.debian.org

Subject: Re: Re: [php5] README.Debian.security: unclear reference to unserialize() risk

Date: Tue, 31 Jan 2012 18:38:47 -0500

On -28163-01--10 14:59, Thijs Kinkhorst wrote:
> Hi,
>
>> README.Debian.security contains:
>>> Most specifically, the security team will not provide
>>> support for flaws in:
>>>
>>> - problems which are not flaws in the design of php but can be
> problematic
>>>    when used by sloppy developers (for example: not checking the contents
>>>    of a tar file before extracting it, using unserialize() on
>>>    untrusted data, or relying on a specific value of short_open_tag).
>> It is unclear to me how using unserialize() on untrusted data would
>> create a particular risk. Do you perhaps mean extract()?
> README.Debian.security is designed to be a brief overview of what is
> supported. Users that want to know more about *why* a certain technique
> can be risky, can refer to the PHP manual. On the topic of unserialize(),
> this writes:
>
> "If the variable being unserialized is an object, after successfully
> reconstructing the object PHP will automatically attempt to call the
> __wakeup() member function (if it exists)."
>
> which should clearly illustrate the risk with unserializing untrusted data.

Thank you Thijs.

I understand from Thijs's comment that the README is alluding to the 
built-in unserialize() function: 
http://ca.php.net/manual/en/function.unserialize.php
Assuming that is correct, please consider this report a reminder to clarify.

Regarding the risks in the unserialize() function, I happen to think the 
quoted passage is far from a clear illustration and reported upstream 
about this in https://bugs.php.net/bug.php?id=60941

Message #20 received at 639230@bugs.debian.org (full text, mbox, reply):

From: "Thijs Kinkhorst" <thijs@debian.org>

To: "Filipus Klutiero" <chealer@gmail.com>, 639230@bugs.debian.org

Subject: Re: [php-maint] Bug#639230: Re: [php5] README.Debian.security: unclear reference to unserialize() risk

Date: Thu, 2 Feb 2012 10:17:33 +0100

On Wed, February 1, 2012 00:38, Filipus Klutiero wrote:
>>>>    when used by sloppy developers (for example: not checking the
>>>> contents
>>>>    of a tar file before extracting it, using unserialize() on
>>>>    untrusted data, or relying on a specific value of short_open_tag).

> I understand from Thijs's comment that the README is alluding to the
> built-in unserialize() function:
> http://ca.php.net/manual/en/function.unserialize.php
> Assuming that is correct, please consider this report a reminder to
> clarify.

Thanks, but given that unserialize is followed by () it should make it
clear we're referring to a specific function, and the whole document is
clearly in the context of the PHP interpreter. Googling for "php
unserialize" instantly yields the relevant documentation for those who
want to know more. I prefer to keep this brief so it actually gets read,
and don't think further clarification is necessary.


Thijs

Message #25 received at 639230@bugs.debian.org (full text, mbox, reply):

From: Filipus Klutiero <chealer@gmail.com>

To: 639230@bugs.debian.org

Subject: Re: [php-maint] Bug#639230: Re: [php5] README.Debian.security: unclear reference to unserialize() risk

Date: Thu, 02 Feb 2012 12:43:54 -0500

On 2012-02-02 04:17, Thijs Kinkhorst wrote:
> On Wed, February 1, 2012 00:38, Filipus Klutiero wrote:
>>>>>     when used by sloppy developers (for example: not checking the
>>>>> contents
>>>>>     of a tar file before extracting it, using unserialize() on
>>>>>     untrusted data, or relying on a specific value of short_open_tag).
>> I understand from Thijs's comment that the README is alluding to the
>> built-in unserialize() function:
>> http://ca.php.net/manual/en/function.unserialize.php
>> Assuming that is correct, please consider this report a reminder to
>> clarify.
> Thanks, but given that unserialize is followed by () it should make it
> clear we're referring to a specific function, and the whole document is
> clearly in the context of the PHP interpreter.

It is clear that it refers to a specific function, but it is unclear 
which, it could also refer to Serializable::unserialize().
> Googling for "php
> unserialize" instantly yields the relevant documentation for those who
> want to know more. I prefer to keep this brief so it actually gets read,
> and don't think further clarification is necessary.
>

If we want brevity, I recommend dropping the examples. In fact, from 
what I understand, the entire item should be scrapped.

Send a report that this bug log contains spam.