Avoiding EVAL()


Outdated Content

This post is over 7 years old and is probably out of date.

There are a shed-load of ways to “eval()” code without actually calling the eval() function — usually done simply to avoid the use of the dreaded “evil()” function.

Here is another simple way to avoid eval() without writing out files to the filesystem etc:

This uses the new data: stream wrapper (see RFC2397) that was introduced with PHP 5.2.0; and while this seems like a risk, first: The “attacker” already has access to the code on your system, or you’re open to injection anyway, second: PHP 5.2 has also fixed the problem with the introduction of the  “allow_url_includephp.ini option.

I just thought it was a neat little streams “hack” I would share; I originally thought to do it using the var stream from PHP’s stream_wrapper_register() documentation, but then Evert Pot posted about creating streams from strings using the data: stream, which led to this final “solution”.

12 thoughts on “Avoiding EVAL()

  1. Nice piece of information, thanks. However, I think either you’re wrong or I understood you wrong, but allow_url_include directive has been available since 5.1.

  2. allow_url_include is no 5.3 but 5.2 introduced feature, data: was no “URL Stream” for one or two versions of that series, but that was fixed soon to avoid troubles like the one above :-)

    • Davey Shafik

      I never claimed it was useful. And there certainly is no *serious* use case; I just enjoy bending the language :)

      • EllisGL

        There’s a lot of pay scripts that are eval base64 encoded.. Could use this to no use eval.. Still insecure.

    • Davey Shafik

      This is quite obvious; there is a base64_encode() and a base64_decode() involved in my solution. However, benchmarks in userland are inherently flawed.

  3. On the other hand this shows a nice exploit when eval is disabled. You could easily inject your code to execute by exploiting a bug with dynamic variable includes.

Comments are closed.