Closed
17 tasks
As described in the email to the PHP internals list [1] this feature is fundamentally broken and pointless. Only internal classes can be disable which brings the following observation. On a minimal build of PHP, with only the mandatory extensions enabled, there are 148 classes/interfaces/traits defined. [2] Other than the SPL ones (and even then), disabling any of these classes will cause issues within the engine. Moreover, the SPL ones are not a security concern. Therefore, any other class that can be disabled must come from an extension that can be disabled altogether. And "disabling" a class from an extension without disabling said extension will render it useless anyway. If a hosting provided is concerned about an extension, then it should not enable it in the first place. Not break it ad hoc. Considering the above, I cannot see how this functionality was ever useful. This is in stark contrast to the disable_functions INI setting, which can be used to selectively remove functionality of an extension without breaking it overall. What makes this setting particularly broken is that it does not unregister the class, it only overwrites the create CE handler to emit a warning and purge the properties and function hashtables. This leads to various use after free, segfaults, and broken expectations for the engine and extensions which define said classes. On top of that, it is possible to actually instantiate such a class (and even classes which actually disallow this like ext/imap) in userland, and pass it to function that are typed against said class without raising a TypeError. However, when trying to do anything with said object stuff is going to explode in countless ways. [1] https://news-web.php.net/php.internals/120896 [2] https://gist.github.com/Girgias/63d55ba1e50b580412b004046daed02b
Girgias deleted the remove-disable-classes branch
August 25, 2025 20:16
Girgias restored the remove-disable-classes branch
August 25, 2025 20:20
Girgias deleted the remove-disable-classes branch
August 25, 2025 20:20osokin added a commit to osokin/unit that referenced this pull request
Aug 30, 2025
References: - https://wiki.php.net/rfc/remove_disable_classes - php/php-src#12043 CC build/src/nxt_php_sapi-php85.o cc -c -pipe -fPIC -fvisibility=hidden -fno-strict-overflow -funsigned-char -std=gnu11 -O -Wall -Wextra -Wno-unused-parameter -Wwrite-strings -fno-strict-aliasing -Wstrict-overflow=5 -Wmissing-prototypes -Werror -g -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -I src -I build/include \ -I/usr/local/include/php -I/usr/local/include/php/main -I/usr/local/include/php/TSRM -I/usr/local/include/php/Zend -I/usr/local/include/php/ext -I/usr/local/include/php/ext/date/lib -DNXT_ZEND_SIGNAL_STARTUP=1 \ -MMD -MF build/src/nxt_php_sapi-php85.dep -MT build/src/nxt_php_sapi-php85.o \ -o build/src/nxt_php_sapi-php85.o src/nxt_php_sapi.c src/nxt_php_sapi.c:714:37: error: no member named 'disable_classes' in 'struct _php_core_globals' 714 | &PG(disable_classes), | ~~~^~~~~~~~~~~~~~~~ /usr/local/include/php/main/php_globals.h:31:30: note: expanded from macro 'PG' 31 | # define PG(v) (core_globals.v) | ~~~~~~~~~~~~ ^ src/nxt_php_sapi.c:715:33: error: use of undeclared identifier 'zend_disable_class' 715 | zend_disable_class); | ^ 2 errors generated. gmake[1]: *** [build/Makefile:2107: build/src/nxt_php_sapi-php85.o] Error 1
Closed
5 tasks
Merged