$30 off During Our Annual Pro Sale. View Details »

今だからこそ振り返る register_globals / PHPerKaigi 2020

今だからこそ振り返る register_globals / PHPerKaigi 2020

Wataru MIYAGUNI

February 11, 2020
Tweet

More Decks by Wataru MIYAGUNI

Other Decks in Programming

Transcript

  1.    C    w SFHJTUFS@HMPCBMT͕࣮૷ w

    ͜ͷ࣌͸·ͩHQD@HMPCBMTͱ͍͏໊લͩͬͨ w (&5 1045 $00,*&͚ͩΛର৅ w ͦΕҎ֎ 4&44*0/ͱ͔ ΋ѻ͏͜ͱʹͳͬͨ ͷͰ1)1CFUBͰϦωʔϜ https://github.com/php/php-src/commit/ab16816e PHP 4.0 beta 3
  2.     ʙ PHP 4.0.6  ʙ೥લ൒ w

    ηΩϡϦςΟʹؔ͢Δ໰͍߹Θ͕ͤࡴ౸ ʮSFHJTUFS@HMPCBMT͕શ෦ѱ͍ةݥʯ ʮ໰୊ʹͳ͍ͬͯΔίʔυ͸
 ɹɹม਺ͷॳظԽ࿙ΕͳͲ؆୯ͳ΋ͷ΋͋Γɺ
 ɹɹ͜ͷઃఆΛແ͚ͩ͘͢Ͱ͸ղܾ͠ͳ͍ʯ w ͦͷޙ΋͍Ζ͍Ζ͋Γɻɻ ϝʔϦϯάϦετͷ౤ߘ 3BTNVT
  3.     ʙ PHP 4.0.6 (Con’t)  

    https://marc.info/?l=php-internals&m=99638397319055&w=2 w 1)1Ҏ߱ͷ1SPQPTBMΛ3BTNVT͕ ։ൃऀϝʔϦϯάϦετʹ౤ߘ ҎԼɺཁ໿  ɹʮσϑΥϧτ͸P⒎ʹ͠·͠ΐ͏ʯ ɹʮ(&5΍1045ʹରͯ͠ ҆શ͸౰વͱͯ͠ 
 ɹɹɹखܰʹΞΫηεͰ͖Δ࢓૊Έ͸࢒͓͖͍ͯͨ͠ʯ
  4.     ʙ PHP 4.0.6 (Con’t)  

    https://marc.info/?l=php-internals&m=99638397319055&w=2 w ✍1)1Ҏ߱ͷ1SPQPTBMΛ3BTNVT͕ ։ൃऀϝʔϦϯάϦετʹ౤ߘ ͜ΜͳจষͰ࢝·͍ͬͯ·ͨ͠ 5IFCFTUUIJOHBCPVU1)1JTUIBUJUIBTTVDIB TIBMMPXMFBSOJOHDVSWFUIBUOPOQSPHSBNNFST DBOXSJUFXFCBQQT 5IFXPSTUUIJOHBCPVU1)1JTUIBUJUIBTTVDI BTIBMMPXMFBSOJOHDVSWFUIBUOPO QSPHSBNNFSTXSJUFXFCBQQT WJB1SPQPTBMͷ๯಄
  5.        PHP 4.1.0 w

    ⚙εʔύʔάϩʔόϧม਺͕࣮૷ w @(&5΍@1045ͳͲ w ैདྷͷ)551@YYY@7"34ͱҧ͍ɺHMPCBMએݴͤͣʹ͢ ͙࢖͑ͯखܰ w ⚙JNQPSU@SFRVFTU@WBSJBCMFT ͕࣮૷ w SFHJTUFS@HMPCBMTͷػೳΛͪΐͬͱ҆શʹͨ͠ܗͰ࠶ݱ ͢Δؔ਺ https://www.php.net/releases/4_1_0.php
  6.        PHP 4.1.0 w

    ⚙εʔύʔάϩʔόϧม਺͕࣮૷ w @(&5΍@1045ͳͲ w ैདྷͷ)551@YYY@7"34ͱҧ͍ɺHMPCBMએݴͤͣʹ͢ ͙࢖͑ͯखܰ w ⚙JNQPSU@SFRVFTU@WBSJBCMFT ͕࣮૷ w SFHJTUFS@HMPCBMTͷػೳΛͪΐͬͱ҆શʹͨ͠ܗͰ࠶ݱ ͢Δؔ਺ https://www.php.net/releases/4_1_0.php JNQPSU@SFRVFTU@WBSJBCMFT ͷྫ https://www.php.net/manual/en/function.import-request-variables
  7.        PHP 4.2.0 w

    ⚙SFHJTUFS@HMPCBMT͕σϑΥϧτͰ0''ʹ https://www.php.net/releases/4_2_0.php
  8.        PHP 5.3.0 w

    ⚙SFHJTUFS@HMPCBMT͕%FQSFDBUFEʹ https://www.php.net/releases/5_3_0.php
  9.        PHP 5.4.0 w

    (PPECZFSFHJTUFS@HMPCBMT w Ұॹʹফ͑ͨػೳ w NBHJD@RVPUFT w TBGF@NPEF https://www.php.net/releases/5_4_0.php ⚰
  10.  SFHJTUFS@HMPCBMTґଘΛແ͘͠ɺ৽͍͠ਓੜΛ࢝ΊΔ w ਖ਼߈๏  Կ΋͠ͳ͍ 1)1·ͰͷΞοϓσʔτʹཹΊΔ  w SFHJTUFS@HMPCBMTҎ֎ͷ੬ऑੑʹ΋ରԠͰ͖ͳ͍

     SFHJTUFS@HMPCBMTΛ࠶ݱ͢ΔίʔυΛॻ͍ͯɺ1)1ͷόʔ δϣϯΛ্͛Δ w ⚔मཏͷಓ register_globals Λ࢖͍ͬͯͨ ΞϓϦ͸Ͳ͏ੜ͖࢒Ε͹͍͍͔? ͬͪ͜ͷ࿩Λ͠·͢
  11. register_globals ͷػೳ  ॳڃฤ w ࢓༷  w ରԠ 

     தڃฤ w ࢓༷  w ରԠ   ্ڃฤ w ࢓༷  w ରԠ
  12. register_globals ͷػೳ  ॳڃฤ w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪ w ରԠ  

    தڃฤ w ࢓༷  w ରԠ   ্ڃฤ w ࢓༷  w ରԠ
  13. register_globals ͷػೳ  ॳڃฤ w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪ w ରԠWBSJBCMFT@PSEFSʹै͏  தڃฤ

    w ࢓༷@4&44*0/ʹ͸஫ҙ w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏  ্ڃฤ w ࢓༷  w ରԠ
  14. register_globals ͷػೳ  ॳڃฤ w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪ w ରԠWBSJBCMFT@PSEFSʹै͏  தڃฤ

    w ࢓༷@4&44*0/ʹ͸஫ҙ w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏  ্ڃฤ w ࢓༷@'*-&4ʹ͸ཁ஫ҙ w ରԠ
  15. register_globals ͷػೳ  ॳڃฤ w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪ w ରԠWBSJBCMFT@PSEFSʹै͏  தڃฤ

    w ࢓༷@4&44*0/ʹ͸஫ҙ w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏  ্ڃฤ w ࢓༷@'*-&4ʹ͸ཁ஫ҙ w ରԠ͕Μ͹Ζ
  16. register_globals ͷػೳ  ॳڃฤ w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪ w ରԠWBSJBCMFT@PSEFSʹै͏  தڃฤ

    w ࢓༷@4&44*0/ʹ͸஫ҙ w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏  ্ڃฤ w ࢓༷@'*-&4ʹ͸ཁ஫ҙ w ରԠ͕Μ͹Ζ w ͜Εશͯߟྀ͢Δͷେม w ΋͔ͨ͠͠Βଞʹ΋͋Δͷ͔ͳ  w ࣗྗͰରԠ͢Δͷ͸΋͏ແཧͳΜ͡Ό ͦΜͳ͋ͳͨʹ ͪΐͬͱͨ͠࿕ใ͕