Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114880
MIME-Version: 1.0
References: <CAFv4g+F-7F7o6va5wCrojKe+Uysx2Ec3H4yV_mUZYEyNm3MkdQ@mail.gmail.com>
 <C2605471-8EC9-4C36-88D4-E98F5C291BCF@gmail.com> <CAOwTYAu2hQaJYM4mJN0DDYmPhP9BHcnrxM1f459wKa-jj1TnDg@mail.gmail.com>
 <46BF9BC3-8F34-4495-AD29-08E6FE12D7A8@gmail.com>
In-Reply-To: <46BF9BC3-8F34-4495-AD29-08E6FE12D7A8@gmail.com>
Date: Tue, 15 Jun 2021 11:54:53 +0200
Message-ID: <CAOwTYAs7JZLfi_aA_zWKKsGFtBg3TYESr1Ha0h87ajrUsCBNqg@mail.gmail.com>
To: Claude Pache <claude.pache@gmail.com>
Cc: Craig Francis <craig@craigfrancis.co.uk>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000e10c9905c4caf753"
Subject: Re: [PHP-DEV] [RFC] is_literal
From: krakjoe@gmail.com (Joe Watkins)

--000000000000e10c9905c4caf753
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

It's not unpredictable.

krakjoe@Fiji:/opt/src/php-src$ cat nothing.php
<?php
$var =3D 'not-literal';

var_dump(
    $_ENV['var'],
    is_literal($_ENV['var']));
?>
krakjoe@Fiji:/opt/src/php-src$ var=3Dnot-literal sapi/cli/php nothing.php
string(11) "not-literal"
bool(false)

The engine doesn't intern "randomly", and doesn't intern input.

Cheers
Joe

On Tue, 15 Jun 2021 at 10:56, Claude Pache <claude.pache@gmail.com> wrote:

>
>
> Le 15 juin 2021 =C3=A0 09:19, Joe Watkins <krakjoe@gmail.com> a =C3=A9cri=
t :
>
> Morning,
>
> https://3v4l.org/nJhc1/rfc#focus=3Drfc.literals
>
> It's not so much a bug as a side effect or quirk.
>
> Note that, the result is correct, in the sense that you do have a literal
> string - it is not marking an unsafe string as safe.
>
> It's just that existing implementation details - RETURN_CHAR using
> interned strings, and literal constant strings being interned by the
> compiler - lead to a literal string being "re-used".
>
> This is just a natural consequence of literal strings retaining their
> literalness in the way we want them too, nothing dangerous is going on.
>
>
> Hi,
>
> I disagree that it is not dangerous. At the very least, it makes
> `is_literal()` unpredictable, therefore unreliable, which is bad. The
> following git is more illustrative of the issue:
>
> https://3v4l.org/SNJDJ/rfc#focus=3Drfc.literals
>
> The fact that a given string happens to be written literally somewhere
> else in the program doesn=E2=80=99t mean that it is written literally in =
that
> context. Taking the example from the RFC:
>
> $qb->select('u')
>    ->from('User', 'u')
>    ->where('u.id =3D ' . $_GET['id']); // INSECURE
>
> I want that the `$qb->where()` method is able to reliably detect that the
> string provided is not literal, even when it happens by chance that the
> exact same string appears literally somewhere else in my code.
>
> =E2=80=94Claude
>
>
>

--000000000000e10c9905c4caf753--