Description
After I made a recent builds of PHP it told me to run make test to make sure the build also properly functions as designed. Happily I obliged and typed make test only to be greeted by numerous alerts by my outgoing firewall. Random tests in the test suite tried to make outwards connections to random services. For example, I saw connection attempts to:
- httpbin.org
- yahoo.com
- php.net
- w3.org
- example.org
- example.com
- *.googleapis.com
- github.com
- *.badssl.com
- *.google.com
- and more
In no way I was properly informed as the user that those requests would be made nor what the privacy policies for the contacted services are. I did NOT consent to that! Luckily I was running an outgoing firewall. Of course, me blocking those things made many tests fail (which ultimately made it hard to decide if the build of PHP properly passed the test suite or not.)
What should/ could be done:
- tests that make any outwards connection should be opt-in (e.g. with an extra parameter to
make test, e.g. make test ENABLE_NETWORK_REQUIRING_TESTS=1 or something)
- for all contacted services the users should be informed about the service's "Privacy Policy" beforehand, so they can make an educated decision
- ideally all remote tests (if really required) would be hosted on php.net, e.g. under a "testsuite.php.net" subdomain or similar (aka on a service endpoint directly associated with your project/ under your control, not some random 3rd party), then you
only would need to display a link to your very own privacy policy.
PHP can run (e.g. eval) remotely downloaded code. So some extra consideration to the users should be done here. I did not check/ verify the test that downloads something from httpbin: But what does it download? Some code? Who would control this code? What if it's compromised (e.g. we've seen recently with the xz upstream compromise what kind of risks exists).
While this is a bit rambling bug report here (sorry about that), I hope some improvements into a more privacy oriented direction may come out of it. For now I probably won't run make test again for my next PHP build: a burnt child dreads the fire.
PHP Version
PHP 8.3.6
Operating System
OS X 10.10.5 (Yosemite)
Description
After I made a recent builds of PHP it told me to run
make testto make sure the build also properly functions as designed. Happily I obliged and typedmake testonly to be greeted by numerous alerts by my outgoing firewall. Random tests in the test suite tried to make outwards connections to random services. For example, I saw connection attempts to:In no way I was properly informed as the user that those requests would be made nor what the privacy policies for the contacted services are. I did NOT consent to that! Luckily I was running an outgoing firewall. Of course, me blocking those things made many tests fail (which ultimately made it hard to decide if the build of PHP properly passed the test suite or not.)
What should/ could be done:
make test, e.g.make test ENABLE_NETWORK_REQUIRING_TESTS=1or something)only would need to display a link to your very own privacy policy.
PHP can run (e.g. eval) remotely downloaded code. So some extra consideration to the users should be done here. I did not check/ verify the test that downloads something from httpbin: But what does it download? Some code? Who would control this code? What if it's compromised (e.g. we've seen recently with the
xzupstream compromise what kind of risks exists).While this is a bit rambling bug report here (sorry about that), I hope some improvements into a more privacy oriented direction may come out of it. For now I probably won't run
make testagain for my next PHP build: a burnt child dreads the fire.PHP Version
PHP 8.3.6
Operating System
OS X 10.10.5 (Yosemite)