I am about as big (read: little) of a fan of PHP as the next guy but how in the hell are these problems inherent to PHP? If I were to run COBOL code from untrusted sources on my server you can forget about security.
You write:
"If I were to run COBOL code from untrusted sources on my server you can forget about security."
That is why there should be a warning about untrusted code. Are you trying to let WordPress off the hook? Their attitude toward security has been horrible and they should be called out on it. I quote myself:
What can they do? They can automate the test that Siobhan Ambrose does in the above article linked to by this thread. At the very least, WordPress can search a theme for Base64, so that when you try to activate the theme, you get a warning:
"These templates contain Base64, which may be masking malicious code. Do you wish to proceed?"
It doesn't matter if WordPress is written in PHP or COBOL, the team developing the software should make some attempt to address its many security flaws.
Please consider the odd use of the word "disrespectful" in this paragraph:
"It seems fundamentally disrespectful to users who are simply caught in the crossfire of a political power move their neither know or care about. PHP core has never shown any particular regard for its biggest apps, as evidenced by the above bug and others, so I’m not sure why we should go out of our way to promote their upgrade. PHP 6 sounds much more compelling."
http://ma.tt/2007/07/on-php/#comment-422760
That is Matt Mullenweg. Please note that his statement can be turned on its head. I could write:
"It seems fundamentally disrespectful to users to create software for them that has lots of fun features but no security."
For instance:
"That is why there should be a warning about untrusted code."
What is the counter-argument, that WordPress should do nothing about the fact that the templates allow the execution of arbitrary code?
"It doesn't matter if WordPress is written in PHP or COBOL, the team developing the software should make some attempt to address its many security flaws."
What is the counter-argument, that WordPress has no responsibility for the security flaws in WordPress?
Very curious.
Basically my point is this: every bit of software you run on your web server is a security risk. You shouldn't run themes, or any code, really that come from sources you don't trust unless you audit it completely. I don't think the blame really lies with PHP or Wordpress in this case.
"Yes, you can argue that they brought this upon themselves; but it is worth noting that at this point you are along for the ride. When I’m in similar circumstances, I tend to consider the karma implications of cursing the driver."
That is good, and necessary, advice for any software project.
Andrew van der Stock writes:
--------------
For some time, I’ve been worried about the direction of PHP. As many of you know, I helped write XMB Forum and now help write UltimaBB. XMB in particular is an old code base, and UltimaBB, a descendant from XMB. I’ve done a lot to protect that code base from attack, and luckily, we’ve been missed despite some doozy and silly security issues. After writing PHP forum software for three years now, I’ve come to the conclusion that it is basically impossible for normal programmers to write secure PHP code. It takes far too much effort.
PHP needs a proper security architecture, and support for newbie programmers. PHP’s raison d’etre is that it is simple to pick up and make it do something useful. There needs to be a major push by the PHP Development team to take this advantage, and make it safe for the likely level of programmers – newbies. Newbies have zero chance of writing secure software unless their language is safe.
Think about Logo for a minute. Logo can do some interesting things, but it is not a commercially useful language because it cannot do much. But it is an excellent teaching language. PHP is like Logo – it’s a simple and easy way to get into serious web development. It is possible to write large applications in PHP, so it is useful at that level. But it is inherently unsafe as it can do far, far more than Logo.
There are so many ways to break PHP that it is impossible for even experienced security professionals like me to code in it securely all the time. There are nearly 4000 function calls, and many of them have unintended consequences or have been inappropriately extended by something else.
http://www.greebo.net/2006/01/04/php-insecurity-failure-of-l...
---------------
Tim Bray put together a collection of links regarding criticism of PHP:
http://www.tbray.org/ongoing/When/200x/2006/02/17/PHP
On that page, there is this from Dominic Mitchell:
"I’m in 100% agreement with you about the whole PHP thing. Every time I’ve looked at PHP, I’ve been unable to find out how they use placeholders in code that talks to the database. Yes, every database adaptor provides a quote function, but nobody uses it (consistently). And people wonder why PHP code is always full of security holes. It’s a real shame, as I can see that there’s a lot to like in PHP. But it really needs to clean its act up to appeal to people coming from other programming languages, instead of just people coming from dreamweaver. I actually heard David Heinemeier Hansson (sp?) talking about rails the other day. One of the key points he made is that it should be easy to do the right thing. That’s why Rails hits a sweet spot for me. But when you look at PHP, yes, it’s easy to code, but it’s not easy to do the right thing. That’s where it falls down."
The point that Hansson makes about Ruby is worth thinking about in the context of PHP security. Does PHP make it easy to write secure code? Does it help programmers do the right thing? The defaults in PHP, and the underlying assumptions of PHP, all tend in what direction?
Of those links, Jonas Maurus's post is also well worth reading:
http://maurus.net/resources/programming-languages/php/
Aristotle Pagaltzis sums up the underlying problem:
"All of these flaws are interconnected; the morass is simply the result of the language being a templating system that grew too big for its breeches. I don’t believe the problems can be corrected in any sensible fashion; PHP will always be a templating system, however much it may be straining against its clothes. And let me tell you, it’s still a great templating system! If all you need is to write a web app that consists of two pages, running four queries over a five-table database, there is nothing that will get you up and running faster."
The question at hand isn't whether it's easy or hard for someone to write secure code in PHP (my opinion: it's not easy, but it's certainly possible). The issue brought up in the article is that a lot of the top search results for "Free Wordpress Templates" lead you to templates containing obfuscated code, some of it malicious. That isn't a language issue: as many people have pointed out to you, it's a consequence of running untrusted code.
Now, you can certainly debate whether or not this is a Wordpress issue. On the one hand, the Wordpress team could choose to write their own custom templating language that doesn't include the ability to do things like eval base64 strings. But if they did go down that path, they would also be severely restricting what theme developers are capable of doing (and that wouldn't solve any issues with JavaScript or any number of other subtle issues that malicious authors could introduce).
My personal take is that this is a case befitting the quote "with great power comes great responsibility." That is, the people running Wordpress blogs need to be aware of the risks when they install plugins or themes. The Wordpress team has built tools into Wordpress that encourage people to download and update plugins and themes from Wordpress.org, which is seemingly more legitimate than these random sites (I'm not sure if there's a formal evaluation process for plugins/themes submitted there). Beyond that though, I don't think it's the fault of the Wordpress developers if people choose, whether out of ignorance or carelessness, to download and install random themes from the Internet. I mean, I don't blame Microsoft if I go searching for "free [software name]" and end up downloading a virus. ;-)
On the other hand, if you're running your own web application, you're responsible for it, just the same way you're responsible for your computer. As I said, I don't blame Microsoft if I download random software and that software does malicious things. Similarly, I don't blame Wordpress or Automattic if I download a random theme and it contains malicious code.
http://sec-soapbox.blogspot.com/2007/03/why-is-windows-insec...
My criticism of the WordPress team follows the same logic as the criticism of Microsoft. Since Microsoft came up with an OS that had a lot of security flaws, it was reasonable for people to criticize Microsoft for those flaws. And since the WordPress team is producing software that also has flaws, it is reasonable to criticize the WordPress team for the flaws in the software they produce.
The only concrete charge you bring forth here is to the practise of using string concatenation for sql parameters. Since v. 5.1 (Which is something like 5 years old .. in Internetyears, that's one century), PDO has been the default db-access layer, and it supports bound parameters.
Oh, and I've seen plenty of unescaped string concatenation in Rails apps too. It's a developer issue - not a language issue.