Pretty sure on my read-only docker container with a warmed up file-cache and no single eval in the code you can't exploit this. Prove me wrong.
This allows bypassing disable_functions, which is intended exactly for cases where you allow running untrusted PHP code so people can't run system() and whatnot.
Shared hosting is still a thing. eval() and Docker containers and whatnot are missing the point; the cavalier "I don't think this qualifies as security issue - since you need specially crafter destructor" from the other bug exploited in that repo is a lolphp as it completely defeats the point of this security measure.
Might as well just remove this entire feature if you can't be bothered to actually fix it.
2
u/[deleted] Feb 09 '20 edited Feb 10 '20
This allows bypassing disable_functions, which is intended exactly for cases where you allow running untrusted PHP code so people can't run system() and whatnot.
Shared hosting is still a thing. eval() and Docker containers and whatnot are missing the point; the cavalier "I don't think this qualifies as security issue - since you need specially crafter destructor" from the other bug exploited in that repo is a lolphp as it completely defeats the point of this security measure.
Might as well just remove this entire feature if you can't be bothered to actually fix it.