Clarification on what counts as a security issue in PHP?

[lcfr-eth]

Description

I think it is worth having a discussion on what constitutes a security vulnerability in PHP.

It has been said countless times when reporting vulnerabilities in php-src which can lead to compromising the entire server that PHP does not consider specially crafted PHP that requires either an upload or eval() that can not be generically triggered as vulnerabilities.

Yet this got a CVE I assume which was requested by the PHP team?
GHSA-h96m-rvf9-jgm2

Yet https://ssd-disclosure.com/ssd-advisory-extract-double-free5-x-use-after-free7-x-8-x/
was never requested a CVE by the php team even though it has public exploits available that can compromise the security of an entire server.

I think some clarification is needed on when/why some bugs are "vulnerabilities" which gets a CVE requested while others are not.

Wrong section - I do not care.

PHP Version

ALL

Operating System

ALL

[iluuu1994]

Hi @lcfr-eth.

Yet this got a CVE I assume which was requested by the PHP team? GHSA-h96m-rvf9-jgm2

GHSA-h96m-rvf9-jgm2 internally documents a simpler reproducer.

$array = json_decode(file_get_contents('input.json')); // array of arrays
array_merge(...$array);

That's not particularly esoteric code. Realistically, input.json may be user-controlled.

Yet https://ssd-disclosure.com/ssd-advisory-extract-double-free5-x-use-after-free7-x-8-x/ was never requested a CVE by the php team even though it has public exploits available that can compromise the security of an entire server.

This inherently relies on crafted code. __destruct is already widely known to cause similar issues in many other cases. And while we would like to fix the root cause in the near future, it doesn't make sense to treat such sandbox escapes as security issues until that happens. PHP is also lacking other sandboxing features such as reliably restricting the file system and network. Hence, running untrusted PHP code on your machine isn't exactly a common case at the moment.

extract() is also not expected to receive user-controlled inputs:

Warning Do not use extract() on untrusted data, like user input (e.g. $_GET, $_FILES).

I hope that answers your questions.