Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:110749
To: Dan Ackroyd <Danack@basereality.com>
CC: Internals <internals@lists.php.net>
Thread-Topic: [PHP-DEV] [RFC] throwable_string_param_max_len: Configurable
 string length in getTraceAsString()
Thread-Index: AQHWTJP20y5MXeHBqkCn3pDlPjOL5qjsoo0AgAAp0hM=
Date: Sat, 27 Jun 2020 18:52:17 +0000
Message-ID:
 <DM6PR07MB6618EF7CA0C4BB13E0193F63F9900@DM6PR07MB6618.namprd07.prod.outlook.com>
References:
 <DM6PR07MB66184FC97EA43BFA561A4313F9900@DM6PR07MB6618.namprd07.prod.outlook.com>,<CA+kxMuTo0ixQ20DCwhadznPFVMWncEV1oDEfmTqyAR7v9z1urg@mail.gmail.com>
In-Reply-To:
 <CA+kxMuTo0ixQ20DCwhadznPFVMWncEV1oDEfmTqyAR7v9z1urg@mail.gmail.com>
Accept-Language: en-CA, en-US
Content-Language: en-CA
x-ms-exchange-messagesentrepresentingtype: 1
x-tmn: [j0I1ATCIQmqKZXPaKPcu4Ve+Gp0IOebSvH0mwsHov/xsVChoXqdGtZL4RlOVIXJ3]
x-ms-publictraffictype: Email
x-incomingheadercount: 45
x-eopattributedmessage: 0
x-ms-office365-filtering-correlation-id: 8d2c9446-1ee9-4a7c-ce48-08d81acb36bb
x-ms-traffictypediagnostic: BL2NAM02HT060:
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
 PZKk45WAp4kLOOHZ2+v74wyR47mNBoM6vp2s0UBr9mF341k1v+RuhPmB0JRH2Dn9pGsPxTyNPwKDQ5tmNiUbl5HoWDPD0xPvgA9+vkaSOAB9tDqT87AZSo4gkLEmW3rZ89sI0ArcWYCjuDOtLJ5HDtrI7/Da9sPgYTGoXo+gNupzrMGOvB4VZbPypsKOzW0i2+UAb3Uxr1xAAiG4KDWGhxIzykOZ8CSS3g8dqoF4QIRUJgVaRNK3ZEGYoQQHDu9k
x-forefront-antispam-report:
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:0;SRV:;IPV:NLI;SFV:NSPM;H:DM6PR07MB6618.namprd07.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:;DIR:OUT;SFP:1901;
x-ms-exchange-antispam-messagedata:
 8pk9//eeMPGWSutvfEBr7InfMo8l76bLz5qWOAVSb+4JAIrXnotv/WdEbGvPpQ+OfSB2WhbC9EwLQVnGH01kl682Lyr7qYLXLISJ8gVtQxby1J/RtNA24HIcYv+CrBt0FhNRc499Wbb3Ae2UNhQKY2pvBEA+pfLdfj0kj6SnduUQoDOmKnhCnsYwCZdp5RDmrKx4MLcflH3nGfiR36wGnw==
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: hotmail.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-AuthSource: BL2NAM02FT032.eop-nam02.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 8d2c9446-1ee9-4a7c-ce48-08d81acb36bb
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Jun 2020 18:52:17.1486
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2NAM02HT060
Subject: Re: [PHP-DEV] [RFC] throwable_string_param_max_len: Configurable
 string length in getTraceAsString()
From: tysonandre775@hotmail.com (tyson andre)

Hi Dan Ack,=0A=
=0A=
> Also, I didn't understand why there was a problem with formatting=0A=
> traces in userland. I saw a link to some code, but no clear=0A=
> description of what the problem was.=0A=
=0A=
I expanded the description of how `getTraceAsString()` might be improperly =
used in existing code and moved it to=0A=
https://wiki.php.net/rfc/throwable_string_param_max_len#impact_of_raising_s=
tring_param_length_limit=0A=
(and how the code would already be unsafe, but raising the limit may make t=
he impact of unsafe code like that worse)=0A=
=0A=
(e.g. if the code or dependency may `echo $exception` if it was written by =
an author unaware of potential https://en.wikipedia.org/wiki/Cross-site_scr=
ipting or sensitive data exposure)=0A=
=0A=
This is mostly included to explain why I don't propose raising the defaults=
 in the RFC=0A=
=0A=
- Tyson=