Default register_argc_argv to off

https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms

Author: timkelty

8.0/Dockerfile

@@ -18,6 +18,8 @@ ARG PHP_MAX_INPUT_VARS_ARG="1000"
 ENV PHP_MAX_INPUT_VARS=${PHP_MAX_INPUT_VARS_ARG}
 ARG PHP_POST_MAX_SIZE_ARG="8M"
 ENV PHP_POST_MAX_SIZE=${PHP_POST_MAX_SIZE_ARG}
+ARG PHP_REGISTER_ARGC_ARGV="0"
+ENV PHP_REGISTER_ARGC_ARGV=${PHP_REGISTER_ARGC_ARGV}
 
 # setup opcache for environment variables
 ARG PHP_OPCACHE_ENABLE_ARG="1"

8.0/craft-cms.ini

@@ -3,6 +3,7 @@ max_execution_time=${PHP_MAX_EXECUTION_TIME}
 upload_max_filesize=${PHP_UPLOAD_MAX_FILESIZE}
 max_input_vars=${PHP_MAX_INPUT_VARS}
 post_max_size=${PHP_POST_MAX_SIZE}
+register_argc_argv=${PHP_REGISTER_ARGC_ARGV}
 [opcache]
 opcache.enable=${PHP_OPCACHE_ENABLE}
 opcache.revalidate_freq=${PHP_OPCACHE_REVALIDATE_FREQ}

8.1/Dockerfile

@@ -18,6 +18,8 @@ ARG PHP_MAX_INPUT_VARS_ARG="1000"
 ENV PHP_MAX_INPUT_VARS=${PHP_MAX_INPUT_VARS_ARG}
 ARG PHP_POST_MAX_SIZE_ARG="8M"
 ENV PHP_POST_MAX_SIZE=${PHP_POST_MAX_SIZE_ARG}
+ARG PHP_REGISTER_ARGC_ARGV="0"
+ENV PHP_REGISTER_ARGC_ARGV=${PHP_REGISTER_ARGC_ARGV}
 
 # setup opcache for environment variables
 ARG PHP_OPCACHE_ENABLE_ARG="1"

8.1/craft-cms.ini

@@ -3,6 +3,7 @@ max_execution_time=${PHP_MAX_EXECUTION_TIME}
 upload_max_filesize=${PHP_UPLOAD_MAX_FILESIZE}
 max_input_vars=${PHP_MAX_INPUT_VARS}
 post_max_size=${PHP_POST_MAX_SIZE}
+register_argc_argv=${PHP_REGISTER_ARGC_ARGV}
 [opcache]
 opcache.enable=${PHP_OPCACHE_ENABLE}
 opcache.revalidate_freq=${PHP_OPCACHE_REVALIDATE_FREQ}

8.2/Dockerfile

@@ -18,6 +18,8 @@ ARG PHP_MAX_INPUT_VARS_ARG="1000"
 ENV PHP_MAX_INPUT_VARS=${PHP_MAX_INPUT_VARS_ARG}
 ARG PHP_POST_MAX_SIZE_ARG="8M"
 ENV PHP_POST_MAX_SIZE=${PHP_POST_MAX_SIZE_ARG}
+ARG PHP_REGISTER_ARGC_ARGV="0"
+ENV PHP_REGISTER_ARGC_ARGV=${PHP_REGISTER_ARGC_ARGV}
 
 # setup opcache for environment variables
 ARG PHP_OPCACHE_ENABLE_ARG="1"

8.2/craft-cms.ini

@@ -3,6 +3,7 @@ max_execution_time=${PHP_MAX_EXECUTION_TIME}
 upload_max_filesize=${PHP_UPLOAD_MAX_FILESIZE}
 max_input_vars=${PHP_MAX_INPUT_VARS}
 post_max_size=${PHP_POST_MAX_SIZE}
+register_argc_argv=${PHP_REGISTER_ARGC_ARGV}
 [opcache]
 opcache.enable=${PHP_OPCACHE_ENABLE}
 opcache.revalidate_freq=${PHP_OPCACHE_REVALIDATE_FREQ}