Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:109192
To: Craig Francis <craig@craigfrancis.co.uk>, PHP internals
	<internals@lists.php.net>
Thread-Topic: [PHP-DEV] [RFC] is_literal()
Thread-Index: AQHV/7TnzVq8KgqAykaFX4QfSFX3w6hTjmVx
Date: Sat, 21 Mar 2020 21:59:29 +0000
Message-ID:
 <DM5PR07MB30673AEA3D86375BF41F7DD6F9F20@DM5PR07MB3067.namprd07.prod.outlook.com>
References:
 <CAFv4g+EXxWsD5jvfbYVKwML7fMCp62vFPfP0VfOmNBLR-tUpHQ@mail.gmail.com>
In-Reply-To:
 <CAFv4g+EXxWsD5jvfbYVKwML7fMCp62vFPfP0VfOmNBLR-tUpHQ@mail.gmail.com>
Accept-Language: en-CA, en-US
Content-Language: en-CA
x-ms-exchange-messagesentrepresentingtype: 1
x-tmn: [DoYliTRGvT05uxbKFlkUt4SG49XS4TDr6OVPMR5Y6rXIBtERo41PrffzKDFn9qzT]
x-ms-publictraffictype: Email
x-incomingheadercount: 45
x-eopattributedmessage: 0
x-ms-office365-filtering-correlation-id: 7e2e18ac-5049-4d70-a28c-08d7cde32189
x-ms-traffictypediagnostic: CO1NAM11HT069:
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
 lcg4qJ9KZzn/XaoqvHdOWnpfrhWCwlxF/2T9Zadgdc/ogd5Wy/WhnME/WxsMgr29jWpqqRJ6Yz70FVT8oyojIl/L0JVjyXMZORehriqJotsAlzsT/ME4QEY/VHzZViJHnzHBX7RG9nNDJExzJkSVXvUwalNgC8PdW5yxRHwkqMjbe489zyjnPxMNzzoSyTomU+Ssno+ZyF8KShzyALwuTknfTCU+Tjlc+KNwQ9yzGwU=
x-ms-exchange-antispam-messagedata:
 jsBWh0kDmq2frDtTZSAFsoE/80aGKtZM7rAG5yIx2IDnRnc5eJdb02b7i/LbrBfkSQ3rXpEgIhp39TCtJL2tFBDQC8iN9PtIEgpx48qjDXQj+X/TEkkuFilKgCK79B8vqPwC5PtGZZHY4iWrl+iHaLFiP+JQw44Z5V3SbCJRhWDFszmx8QymJlxyp20cgFrKe1oFrN7o991O5XCYy/KWkg==
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: hotmail.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 7e2e18ac-5049-4d70-a28c-08d7cde32189
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Mar 2020 21:59:29.9153
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1NAM11HT069
Subject: Re: [PHP-DEV] [RFC] is_literal()
From: tysonandre775@hotmail.com (tyson andre)

Hi Craig,=0A=
=0A=
https://github.com/laruence/taint#taint=A0notes that=0A=
"Please note that do not enable this extension in product(ion) env, since i=
t will slowdown your app."=0A=
=0A=
- That repo already provides is_tainted()  http://docs.php.net/is_tainted=
=0A=
=0A=
  A fork of that repo would theoretically allow implementing is_literal() a=
s described in the RFC - is that the implementation plan?=0A=
- The slowdown would be a large problem if this feature was always on.=0A=
=0A=
  And if it can be implemented as a PECL module, that would be more prefera=
ble to me than a core module of php.=0A=
  If it was in core, having to support that feature may limit optimizations=
 or implementation changes that could be done in the future.=0A=
=0A=
If it's implemented in the same way as taint (i.e. cannot be used in combin=
ation with XDebug, blackfire, newrelic, etc),=0A=
that would also be a problem for including it in core.=0A=
If it wasn't, then it'd slow down concatenation, calls, etc. even when the =
application didn't need is_literal.=0A=
=0A=
I also imagine that whether or not opcache was enabled is likely to affect =
whether or not=0A=
something ends up being a literal or not=0A=
(e.g. opcache can evaluate functions such as str_repeat() for literals at c=
ompile time)=0A=
https://github.com/laruence/taint/blob/master/taint.c seems to already supp=
ort a whitelist (php_taint_override_func),=0A=
so that isn't insurmountable for functions,=0A=
but it's possible `if ($local =3D=3D=3D 'literal') { process($local); }` wo=
uld only satisfy is_literal() with opcache enabled.=0A=
=0A=
Related projects (static analysis instead of runtime checks, though):=0A=
=0A=
It's also worth noting that `vimeo/psalm` had an in progress way to detect =
some ways in which tainted strings may be used by applications, based on a =
paper by Facebook.=0A=
(https://cacm.acm.org/magazines/2019/8/238344-scaling-static-analyses-at-fa=
cebook/fulltext (for HHVM, though))=0A=
https://github.com/vimeo/psalm/issues/611#issuecomment-515153305 - but it i=
sn't completed or usable yet, as far as I can tell.=0A=
=0A=
Wikimedia also created https://gerrit.wikimedia.org/g/mediawiki/tools/phan/=
SecurityCheckPlugin/ , but that's currently beta.=0A=
Both would have ways they fail to catch every way an argument could be pass=
ed to a function (e.g. unanalyzable dynamic/framework calls)=0A=
=0A=
- Tyson=0A=