Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:108977
MIME-Version: 1.0
References: <CAFv4g+EG6f9e6yJqp1sesbJstYJwpdkVso3CKjAD_EAkcrtHqA@mail.gmail.com>
 <CAFv4g+Fa_cnyWqEP-qo9dgBiz7qszK-s52GuxOHfF6k1GmFcDQ@mail.gmail.com>
 <CAFv4g+G31=MrEUysNeeR0MCKm7SN0WTwnTX-S5m+7o8C73jibg@mail.gmail.com> <CALKiJKrHpcu5q0dREZqtNXCzcH4apyc=8VkLS_H+7-KYnazoZQ@mail.gmail.com>
In-Reply-To: <CALKiJKrHpcu5q0dREZqtNXCzcH4apyc=8VkLS_H+7-KYnazoZQ@mail.gmail.com>
Date: Wed, 11 Mar 2020 13:09:36 +0000
Message-ID: <CAFv4g+Ev=kbxOL37yn_B1faRZ05RZf-ctwewdp7QaNXmo1JA1A@mail.gmail.com>
To: Rowan Tommins <rowan.collins@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000005d2fee05a093f33d"
Subject: Re: [PHP-DEV] Re: Literal / Taint checking
From: craig@craigfrancis.co.uk (Craig Francis)

--0000000000005d2fee05a093f33d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, 9 Mar 2020 at 16:54, Rowan Tommins <rowan.collins@gmail.com> wrote:

> [...] the way to get a more in-depth discussion going is to draft an RFC



Thanks Rowan,

I've created a Wiki account (craigfrancis), and I believe the next step is
to ask for RFC karma?

And is there is anyone who can help with the technical details? I'd really
appreciate it. If it helps, I've got a development budget of =C2=A31,000 I =
could
put towards this (I will need an invoice, a simple PDF would do).



As to the discussion around the older RFC[1]...

The last message I can find was on the 1st September 2015[2].

The RFC focused on SQL injection, where it was noted that "unfiltered input
can affect way more than only SQL"[3], and it isn't ideal for "just for one
use case"[4] - my proposed `is_literal()` can be used for other issues,
such as Cross-Site Scripting[5], Command Line Injection, etc.

There was a belief that education was the answer[6] - but having this check
would allow developers to identify (and block) mistakes at runtime.

Xinchen mentioned how it was complex in PHP5 to implement the Taint
extension - but "with PHP7's new zend_string, and string flags, the
implementation will become easier"[7]. And while the Taint checking is
useful, it does not address the mistakes that can happen with escaping.

As to why I'm deviating away from the original RFC...

By providing a `is_literal()` function, it allows the developer to
determine how they want to use it - where they can skip it for certain
tasks[8], and database drivers (or other extensions) could use it in the
future to raise a notice/warning/error[9].

It gives a mechanism to ensure inputs are split between the command (a
literal), and user supplied values - which is what Yasuo was asking for[10]=
.

Also, by focusing on just literals (as in, only values defined within PHP
scripts), we avoid any concerns about escaping (which can go wrong), and we
won't need to identify which sources are trusted[11].

For the last 5 years I've been writing my SQL with literals only, and it's
worked very well... with just one oddity (which I still consider a literal)=
:

<?php
    $in_sql =3D implode(',', array_fill(0, $count, '?'));
    // or
    $in_sql =3D substr(str_repeat('?,', $count), 0, -1);
?>


[1] https://news-web.php.net/php.internals/87346
[2] https://news-web.php.net/php.internals/87970
[3] https://news-web.php.net/php.internals/87355
[4] https://news-web.php.net/php.internals/87647
[5] https://news-web.php.net/php.internals/87400
    https://bugs.php.net/bug.php?id=3D79359#1583761206
[6] https://news-web.php.net/php.internals/87383
[7] https://news-web.php.net/php.internals/87396
[8] https://news-web.php.net/php.internals/87406
    https://news-web.php.net/php.internals/87446
[9] https://news-web.php.net/php.internals/87436
    https://news-web.php.net/php.internals/87650
[10] https://news-web.php.net/php.internals/87725
[11] https://news-web.php.net/php.internals/87667




On Mon, 9 Mar 2020 at 16:54, Rowan Tommins <rowan.collins@gmail.com> wrote:

> On Mon, 9 Mar 2020 at 13:47, Craig Francis <craig@craigfrancis.co.uk>
> wrote:
>
> > Hi,
> >
> > As I'm not sure how to make any more process on this, I've added added =
a
> > Feature Request:
> >
> > https://bugs.php.net/bug.php?id=3D79359
> >
> > It shows how this change in PHP could stop SQL injection, and proposes =
a
> > way it could be used against HTML injection as well.
> >
>
>
> Hi Craig,
>
> In my experience, the bug tracker is likely to get you less attention tha=
n
> this list, rather than more. For this kind of significant change, the way
> to get a more in-depth discussion going is to draft an RFC; there are som=
e
> instructions and tips on how to go about that at
> https://wiki.php.net/rfc/howto and
>
> https://blogs.oracle.com/opal/the-mysterious-php-rfc-process-and-how-you-=
can-change-the-web
>
> The idea of an RFC is to sit down and design exactly how the proposed
> feature would work; that helps move the discussion forward, because peopl=
e
> can see exactly how it might look, and means you're offering something to
> the community rather than asking it of them. The RFC doesn't have to
> include a full implementation, but if you don't know much about the
> technical details, you might need help from someone who does to make sure
> the proposal is realistic.
>
> I see you've linked an older RFC in the feature request; it would be wort=
h
> digging out the archived discussion from when that was proposed, to see w=
hy
> it stalled. It may just be that people were distracted by other things, o=
r
> there may be issues raised which you can consider in a new proposal. If y=
ou
> haven't already, you could try contacting the author as well.
>
> In general, I think it's an interesting idea, but as the saying goes "the
> devil is in the detail", so I don't have much to say without a concrete
> proposal for what it would look like.
>
> Regards,
> --
> Rowan Tommins
> [IMSoP]
>

--0000000000005d2fee05a093f33d--