LiteSpeed: document security considerations for executed paths

sapi/litespeed/README.md

@@ -76,13 +76,20 @@ have lsphp bind to address 192.168.0.2:3000,
 
 have lsphp accept request on Unix domain socket `/tmp/lsphp_manual.sock`.
 
-### INI Security
+### Listener Security
 
 The lsphp listener must only be reachable by trusted sources, generally just 
-the LiteSpeed web front end. Any source that can set its own environment variables
-can configure arbitrary PHP INI directives at the `ZEND_INI_SYSTEM` level for
-that request. This is the equivalent level of access as the Apache
-`php_admin_value` directive or the FPM's `PHP_ADMIN_VALUE` parameter.
+the LiteSpeed web front end. Allowing access from other sources may cause
+security issues:
+
+* Any source that can set its own environment variables can configure arbitrary
+PHP INI directives at the `ZEND_INI_SYSTEM` level for that request. This is the
+equivalent level of access as the Apache `php_admin_value` directive or the
+FPM `PHP_ADMIN_VALUE` parameter.
+* Any source that can invoke the lsphp listener can choose what file to execute
+based on the request contents. The file to execute is the file name reported by
+`LSAPI_GetScriptFileName()`, without additional validation.  Specifically, there
+is no enforcement of a docroot or `open_basedir` restriction.
 
 ## Using LiteSpeed PHP with LiteSpeed Web Server
 

sapi/litespeed/lsapi_main.c

@@ -621,6 +621,11 @@ static sapi_module_struct lsapi_sapi_module =
 };
 /* }}} */
 
+/* SG(request_info).path_translated comes from LSAPI_GetScriptFileName() without
+ * any additional validation; this is intentional, and is the mechanism by which
+ * LiteSpeed communicates the file to execute. The LiteSpeed listener should
+ * only be reachable from trusted callers. See README.md in this directory for
+ * more details. */
 static void init_request_info( void )
 {
     char * pContentType = LSAPI_GetHeader( H_CONTENT_TYPE );