今だからこそ振り返る register_globals / PHPerKaigi 2020

## Event

https://fortee.jp/phperkaigi-2020/timetable/2020-02-11

## URL listed on each slide

https://gist.github.com/gongo/2f32d2298e97f9b5ba5dfd597e748fe5

Transcript

1. ࠓ͔ͩΒͦ͜ৼΓฦΔ
   register_globals
   1)1FS,BJHJ
   5VF
   ٶᅳ౉@gongoZ
   

   View Slide

2. @gongoZ
   github.com/gongo
   SmartHR, Inc.
   ࣗݾ঺հ
   

   View Slide

3. ͋ΒΏΔ΋ͷΛ&NBDTͰ࠶ݱ͢Δͷ͕झຯͰ͢
   w "/&4&NVMBUPSXSJUUFOJO&NBDT-JTQ
   w ϑΝϛίϯΤϛϡϨʔλʔ
   w IUUQTHJUIVCDPNHPOHPFNBDTOFT
   w *NQMFNFOU+7.CZ&NBDT
   w
   &NBDT͕+7.ʹͳΔ
   w IUUQTHJUIVCDPNHPOHPFNBDTKWN
   ࣗݾ঺հ (Con’t)
   

   View Slide

4. SFHJTUFS@HMPCBMTͱ͸Կͳͷ͔
   SFHJTUFS@HMPCBMTͷੜ֔Λ௥ͬͯΈͨ
   SFHJTUFS@HMPCBMTແ͖ੈΛͲ͏ੜ͖Δ͔
   ΞδΣϯμ
   

   View Slide

5. SFHJTUFS@HMPCBMTͱ͸
   

   View Slide

6. 1)1ʙʹଘࡏ͍ͯͨ͠QIQJOJσΟϨΫςΟϒ
   register_globals ͱ͸?
   https://www.php.net/manual/ja/ini.core.php#ini.register-globals
   

   View Slide

7. register_globalsಈ࡞ྫ
   SFHJTUFS@HMPCBMT0⒎
   

   View Slide

8. register_globalsಈ࡞ྫ
   SFHJTUFS@HMPCBMT0O
   

   View Slide

9. register_globalsಈ࡞ྫ
   ϑΥʔϜͷ໊લ͕
   ͦͷ··ม਺໊ʹ
   

   View Slide

10. register_globals ͷޭ੷
    https://www.youtube.com/watch?v=wCZ5TJCBWMg&t=1339
    QIQ%BZͷΩʔϊʔτl:FBSTPG1)1zͰ
    3BTNVT͕SFHJTUFS@HMPCBMTʹ͍ͭͯݴٴ
    ʮSFHJTUFS@HMPCBMT͕ແ͚Ε͹

    ɹɹࠓͷ1)1ͷൃల͸ແ͔ͬͨʯ
    ʮಈతͳ8FCϖʔδͷߏஙʹ׳Ε͍ͯͳ͍
    ɹɹϢʔβ͕ଟ͍࣌୅ɺϑΥʔϜ໊ͦͷ··ͷ
    ɹɹม਺ΛࢀরͰ͖Δͷ͸ըظతͩͬͨʯ
    

    View Slide

11. 1)1ϚχϡΞϧηΩϡϦςΟάϩʔόϧม਺ͷొ࿥ػೳͷ࢖༻๏
    ޫ͕͋Ε͹ҋ΋͋Δ
    https://www.php.net/manual/ja/security.globals.php
    

    View Slide

12. ҆શͰͳ͍ίʔυྫ
    SFHJTUFS@HMPCBMT0⒎
    https://www.php.net/manual/ja/security.globals.php
    

    View Slide

13. ҆શͰͳ͍ίʔυྫ
    https://www.php.net/manual/ja/security.globals.php
    SFHJTUFS@HMPCBMT0O
    

    View Slide

14. PHP ʹؔ͢Δ༗໊ͳݴ༿
    (WebArchive) IPA ηΩϡΞϓϩάϥϛϯάߨ࠲ ୈ1ষ ΑΓྑ͍WebΞϓϦέʔγϣϯઃܭͷώϯτ
    
    

    View Slide

15. w ✨͍͢͝ػೳ
    w ྑ͘΋ѱ͘΋1)1Λൃలཱͤͨ͞໾ऀ
    ·ͱΊ
    register_globals ͱ͸?
    ཱ໾ऀͷҰੜΛ
    ௥͍͔͚ͯΈ͍ͨʂʂ
    

    View Slide

16. register_globals ͷҰੜ
    

    View Slide

17. 
    
    register_globalsͷҰੜ
    

    View Slide

18. 
    
    C
    
    
    w SFHJTUFS@HMPCBMT͕࣮૷
    w ͜ͷ࣌͸·ͩHQD@HMPCBMTͱ͍͏໊લͩͬͨ
    w (&5 1045 $00,*&͚ͩΛର৅
    w ͦΕҎ֎ 4&44*0/ͱ͔
    ΋ѻ͏͜ͱʹͳͬͨ
    ͷͰ1)1CFUBͰϦωʔϜ
    https://github.com/php/php-src/commit/ab16816e
    PHP 4.0 beta 3
    

    View Slide

19. 
    ʙ PHP 4.0.6
    
    
    ʙ೥લ൒
    w ηΩϡϦςΟʹؔ͢Δ໰͍߹Θ͕ͤࡴ౸
    ʮSFHJTUFS@HMPCBMT͕શ෦ѱ͍ةݥʯ
    ʮ໰୊ʹͳ͍ͬͯΔίʔυ͸

    ɹɹม਺ͷॳظԽ࿙ΕͳͲ؆୯ͳ΋ͷ΋͋Γɺ

    ɹɹ͜ͷઃఆΛແ͚ͩ͘͢Ͱ͸ղܾ͠ͳ͍ʯ
    w
    ͦͷޙ΋͍Ζ͍Ζ͋Γɻɻ
    ϝʔϦϯάϦετͷ౤ߘ
    3BTNVT
    

    View Slide

20. 
    ʙ PHP 4.0.6 (Con’t)
    
    
    
    https://marc.info/?l=php-internals&m=99638397319055&w=2
    w 1)1Ҏ߱ͷ1SPQPTBMΛ3BTNVT͕
    ։ൃऀϝʔϦϯάϦετʹ౤ߘ ҎԼɺཁ໿
    
    ɹʮσϑΥϧτ͸P⒎ʹ͠·͠ΐ͏ʯ
    ɹʮ(&5΍1045ʹରͯ͠ ҆શ͸౰વͱͯ͠
    

    ɹɹɹखܰʹΞΫηεͰ͖Δ࢓૊Έ͸࢒͓͖͍ͯͨ͠ʯ
    

    View Slide

21. 
    ʙ PHP 4.0.6 (Con’t)
    
    
    
    https://marc.info/?l=php-internals&m=99638397319055&w=2
    w ✍1)1Ҏ߱ͷ1SPQPTBMΛ3BTNVT͕
    ։ൃऀϝʔϦϯάϦετʹ౤ߘ
    ͜ΜͳจষͰ࢝·͍ͬͯ·ͨ͠
    5IFCFTUUIJOHBCPVU1)1JTUIBUJUIBTTVDIB
    TIBMMPXMFBSOJOHDVSWFUIBUOPOQSPHSBNNFST
    DBOXSJUFXFCBQQT
    5IFXPSTUUIJOHBCPVU1)1JTUIBUJUIBTTVDI
    BTIBMMPXMFBSOJOHDVSWFUIBUOPO
    QSPHSBNNFSTXSJUFXFCBQQT
    WJB1SPQPTBMͷ๯಄
    

    View Slide

22. 
    
    
    
    PHP 4.1.0
    w ⚙εʔύʔάϩʔόϧม਺͕࣮૷
    w @(&5΍@1045ͳͲ
    w ैདྷͷ)551@YYY@7"34ͱҧ͍ɺHMPCBMએݴͤͣʹ͢
    ͙࢖͑ͯखܰ
    w ⚙JNQPSU@SFRVFTU@WBSJBCMFT
    ͕࣮૷
    w SFHJTUFS@HMPCBMTͷػೳΛͪΐͬͱ҆શʹͨ͠ܗͰ࠶ݱ
    ͢Δؔ਺
    https://www.php.net/releases/4_1_0.php
    

    View Slide

23. 
    
    
    
    PHP 4.1.0
    w ⚙εʔύʔάϩʔόϧม਺͕࣮૷
    w @(&5΍@1045ͳͲ
    w ैདྷͷ)551@YYY@7"34ͱҧ͍ɺHMPCBMએݴͤͣʹ͢
    ͙࢖͑ͯखܰ
    w ⚙JNQPSU@SFRVFTU@WBSJBCMFT
    ͕࣮૷
    w SFHJTUFS@HMPCBMTͷػೳΛͪΐͬͱ҆શʹͨ͠ܗͰ࠶ݱ
    ͢Δؔ਺
    https://www.php.net/releases/4_1_0.php
    JNQPSU@SFRVFTU@WBSJBCMFT
    ͷྫ
    https://www.php.net/manual/en/function.import-request-variables
    

    View Slide

24. 
    
    
    
    
    
    PHP 4.2.0
    w ⚙SFHJTUFS@HMPCBMT͕σϑΥϧτͰ0''ʹ
    https://www.php.net/releases/4_2_0.php
    

    View Slide

25. 
    
    
    
    
    
    PHP 5.3.0
    w ⚙SFHJTUFS@HMPCBMT͕%FQSFDBUFEʹ
    https://www.php.net/releases/5_3_0.php
    

    View Slide

26. 
    
    
    
    
    
    PHP 5.4.0
    w (PPECZFSFHJTUFS@HMPCBMT
    w Ұॹʹফ͑ͨػೳ
    w NBHJD@RVPUFT
    w TBGF@NPEF
    https://www.php.net/releases/5_4_0.php
    ⚰
    

    View Slide

27. 
    
    register_globals ͸ҰੜΛऴ͕͑ͨ…
    
    C
    
    
    
    ⚰
    

    View Slide

28. 
    
    register_globals ͸ҰੜΛऴ͕͑ͨ…
    Y ʜ
    ⚰
    SFHJTUFS@HMPCBMT͕࢖ΘΕ͍ͯͨ
    ΞϓϦͷਓੜ͸ଓ͘ʂʂ
    

    View Slide

29. register_globals ͷͳ͍
    ੈքͰੜ͖͍ͯͨ͘Ίʹ
    

    View Slide

30. SFHJTUFS@HMPCBMTґଘΛແ͘͠ɺ৽͍͠ਓੜΛ࢝ΊΔ
    w ਖ਼߈๏
    Կ΋͠ͳ͍ 1)1·ͰͷΞοϓσʔτʹཹΊΔ
    
    w SFHJTUFS@HMPCBMTҎ֎ͷ੬ऑੑʹ΋ରԠͰ͖ͳ͍
    SFHJTUFS@HMPCBMTΛ࠶ݱ͢ΔίʔυΛॻ͍ͯɺ1)1ͷόʔ
    δϣϯΛ্͛Δ
    w ⚔मཏͷಓ
    register_globals Λ࢖͍ͬͯͨ
    ΞϓϦ͸Ͳ͏ੜ͖࢒Ε͹͍͍͔?
    ͬͪ͜ͷ࿩Λ͠·͢
    

    View Slide

31. php.net Ͱௐ΂ͯΈ·ͨ͠
    https://www.php.net/manual/en/faq.misc.php
    )PXEP*EFBMXJUIregister_globals
    

    View Slide

32. ͜ͷख๏͸ؒҧ͍ͬͯ·͢
    Կ͕ؒҧ͍ͬͯΔͷ͔ɺͲ͏͢Ε͹໰୊ͳ͍࠶ݱ
    ίʔυͳͷ͔Λ
    w SFHJTUFS@HMPCBMTॳڃฤ
    w SFHJTUFS@HMPCBMTதڃฤ
    w SFHJTUFS@HMPCBMT্ڃฤ
    Ͱݟ͍͖ͯ·͠ΐ͏
    

    View Slide

33. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷
    w ରԠ
    தڃฤ
    w ࢓༷
    w ରԠ
    ্ڃฤ
    w ࢓༷
    w ରԠ
    

    View Slide

34. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠ
    தڃฤ
    w ࢓༷
    w ରԠ
    ্ڃฤ
    w ࢓༷
    w ରԠ
    

    View Slide

35. άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    ͲͬͪʹͳΔ
    

    View Slide

36. άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    ඇਪ঑ͷσΟϨΫςΟϒSFHJTUFS@HMPCBMT͕
    POʹͳ͍ͬͯΔͱɺWBSJBCMFT@PSEFSͷઃ
    ఆ͸ɺ&/7ɺ(&5ɺ1045ɺ$00,*&͓Α
    ͼ4&37&3ͷ֤ม਺͕άϩʔόϧείʔϓ
    ʹऔΓࠐ·ΕΔॱ൪΋ࠨӈ͠·͢ɻ
    https://www.php.net/manual/ja/ini.core.php#ini.variables-order
    WBSJBCMFT@PSEFSΛߟྀ͢Δඞཁ͕͋Δ
    

    View Slide

37. άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    ඇਪ঑ͷσΟϨΫςΟϒSFHJTUFS@HMPCBMT͕
    POʹͳ͍ͬͯΔͱɺWBSJBCMFT@PSEFSͷઃ
    ఆ͸ɺ&/7ɺ(&5ɺ1045ɺ$00,*&͓Α
    ͼ4&37&3ͷ֤ม਺͕άϩʔόϧείʔϓ
    ʹऔΓࠐ·ΕΔॱ൪΋ࠨӈ͠·͢ɻ
    https://www.php.net/manual/ja/ini.core.php#ini.variables-order
    WBSJBCMFT@PSEFSΛߟྀ͢Δඞཁ͕͋Δ
    WBSJBCMFT@PSEFSͷྫ
    

    View Slide

38. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷
    w ରԠ
    ্ڃฤ
    w ࢓༷
    w ରԠ
    

    View Slide

39. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷@4&44*0/ʹ͸஫ҙ
    w ରԠ
    ্ڃฤ
    w ࢓༷
    w ରԠ
    

    View Slide

40. @4&44*0/ͱregister_globalsͷؔ܎
    

    View Slide

41. @4&44*0/ͱSFHJTUFS@HMPCBMTͷؔ܎
    

    View Slide

42. ηογϣϯม਺ͷΈࢀর౉͠
    https://gongo.hatenablog.com/entry/2014/12/24/132841
    w @(&5΍@1045ͳͲͱಉ͘͡ѻͬͯ͸ବ໨
    w ͜͏͍͏ΠϝʔδͰ
    

    View Slide

43. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷@4&44*0/ʹ͸஫ҙ
    w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏
    ্ڃฤ
    w ࢓༷
    w ରԠ
    

    View Slide

44. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷@4&44*0/ʹ͸஫ҙ
    w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏
    ্ڃฤ
    w ࢓༷@'*-&4ʹ͸ཁ஫ҙ
    w ରԠ
    

    View Slide

45. @'*-&4ͷ͓͞Β͍
    

    View Slide

46. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    https://gongo.hatenablog.com/entry/2014/10/02/211520
    

    View Slide

47. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    https://gongo.hatenablog.com/entry/2014/10/02/211520
    

    View Slide

48. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    https://gongo.hatenablog.com/entry/2014/10/02/211520
    

    View Slide

49. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    https://gongo.hatenablog.com/entry/2014/10/02/211520
    

    View Slide

50. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    https://gongo.hatenablog.com/entry/2014/10/02/211520
    

    View Slide

51. @'*-&4͕άϩʔόϧม਺ʹͳΔͱʜ
    ͔ͦͬͪʙ
    https://gongo.hatenablog.com/entry/2014/10/02/211520
    

    View Slide

52. ༨ஊ
    https://www.php.net/manual/ja/function.extract.php
    SFHJTUFS@HMPCBMT͕POͷঢ়ଶͰ@'*-&4ʹ
    ରͯ͠FYUSBDU
    Λ࣮ߦͯ͠&953@4,*1Λ
    ࢦఆ͢Δͱɺͦͷ݁Ռʹڻ͘͜ͱͰ͠ΐ͏ɻ
    FYUSBDU
    ͷϔϧϓʹॻ͔Ε͍ͯͨϝϞ
    

    View Slide

53. ༨ஊ
    https://www.php.net/manual/ja/function.extract.php
    SFHJTUFS@HMPCBMT͕POͷঢ়ଶͰ@'*-&4ʹ
    ରͯ͠FYUSBDU
    Λ࣮ߦͯ͠&953@4,*1Λ
    ࢦఆ͢Δͱɺͦͷ݁Ռʹڻ͘͜ͱͰ͠ΐ͏ɻ
    FYUSBDU
    ͷϔϧϓʹॻ͔Ε͍ͯͨϝϞ
    ڻ͍ͨʙ
    

    View Slide

54. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷@4&44*0/ʹ͸஫ҙ
    w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏
    ্ڃฤ
    w ࢓༷@'*-&4ʹ͸ཁ஫ҙ
    w ରԠ͕Μ͹Ζ
    

    View Slide

55. register_globals ͷػೳ
    ॳڃฤ
    w ࢓༷άϩʔόϧม਺ʹϚʔδ͢Δॱ൪
    w ରԠWBSJBCMFT@PSEFSʹै͏
    தڃฤ
    w ࢓༷@4&44*0/ʹ͸஫ҙ
    w ରԠϦϑΝϨϯεͰ஥ྑ͘͠Α͏
    ্ڃฤ
    w ࢓༷@'*-&4ʹ͸ཁ஫ҙ
    w ରԠ͕Μ͹Ζ
    w ͜Εશͯߟྀ͢Δͷେม
    w ΋͔ͨ͠͠Βଞʹ΋͋Δͷ͔ͳ
    w ࣗྗͰରԠ͢Δͷ͸΋͏ແཧͳΜ͡Ό
    ͦΜͳ͋ͳͨʹ
    ͪΐͬͱͨ͠࿕ใ͕
    

    View Slide

56. HPOHPNFSDJGVMQPMMVUFS
    w 1)1Ҏ্ͰSFHJTUFS@HMPCBMTΛ࠶ݱ͢Δ
    ϥΠϒϥϦ
    w ೥݄ݱࡏɺ1)1·Ͱಈ࡞֬ೝ
    w ͓·͚ͰNBHJD@RVPUFT@HQDʹ΋ରԠ
    w ௚༁͢Δͱ࣊൵ਂ͍Ԛછ
    w ͋͘·Ͱ΋ܨ͗ͱͯ͠ߟ͑Δ΂͖
    w 1)1όʔδϣϯΞοϓΛ࠷༏ઌʹʂ
    https://github.com/gongo/merciful-polluter
    

    View Slide

57. ·ͱΊ
    

    View Slide

58. w SFHJTUFS@HMPCBMTͬͯ΍ͬͺ͍͢͝ʂ
    w ͍ΖΜͳҙຯͰ
    w SFHJTUFS@HMPCBMT͕ᐫͱͳ͍ͬͯͯ1)1
    ΞοϓσʔτͰ͖ͳ͍ਓɺఘΊͳ͍Ͱʂ
    w Ͳ͏ʹ͔ͳΓ·͢
    ·ͱΊ
    

    View Slide

59. w 1)1ϚχϡΞϧ
    w IUUQTXXXQIQOFUNBOVBMKBJOEFYQIQ
    w 1)1ιʔείʔυ
    
    w IUUQTHJUIVCDPNQIQQIQTSDUSFFQIQ
    w 1)1։ൃऀϝʔϦϯάϦετ "SDIJWF
    
    w IUUQTNBSDJOGP MQIQJOUFSOBMT
    ࢀߟจݙ
    

    View Slide