Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114956
MIME-Version: 1.0
References: <CAFv4g+F-7F7o6va5wCrojKe+Uysx2Ec3H4yV_mUZYEyNm3MkdQ@mail.gmail.com>
 <CAFv4g+GYwH-nQ8bLGbm=ThARghGUG5hMpw7W5SjMnSPMTom7+g@mail.gmail.com>
 <CAFv4g+GA9y62phk1TB8Z9EakpAXwmOa5pGxT1pdBVZwkCNxsVA@mail.gmail.com>
 <f9c70ab3-3218-6fc0-06b3-4041f3f78cd4@processus.org> <CAC5V6gi_U-ZHHbYj_MvOw_ifp5hCwnQt6+A3pmS==UDAKO74Yw@mail.gmail.com>
 <d221707f-7382-479e-6752-d9661f79a303@processus.org> <CAFv4g+FULOqtzJk20p6a_tBWZMOpLJEhyrwn95hGUTrWwOMC2A@mail.gmail.com>
In-Reply-To: <CAFv4g+FULOqtzJk20p6a_tBWZMOpLJEhyrwn95hGUTrWwOMC2A@mail.gmail.com>
Date: Fri, 18 Jun 2021 17:47:16 +0300
Message-ID: <CA+hqhpe9xf6=F0X0oeUw1mP9sotax0365gJoDbEqRb9e1YOP_w@mail.gmail.com>
To: Craig Francis <craig@craigfrancis.co.uk>
Cc: Pierre <pierre-php@processus.org>, Guilliam Xavier <guilliam.xavier@gmail.com>, 
	PHP Development <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] Re: [RFC] is_literal
From: weirdan@gmail.com (Bruce Weirdan)

On Fri, Jun 18, 2021 at 4:53 PM Craig Francis <craig@craigfrancis.co.uk> wrote:

> While philosophically more pure, there is actually no extra security
> benefit for excluding integers.

One would be potential denial of service prevention (e.g. with enormous `LIMIT`
value where only a limited set of ints was intended, like
"Items per page: 10, 20, 50, 100"). Another would be preventing abuse if you
used some integers like role IDs for access control. Using slightly
modified Matt's example:

```php
    function f(array $allowed_ids) {
        //....
        $query .= 'WHERE `foo` IN (' . implode(', ', $allowed_ids) . ')';
        //....
    }
```

Here you really *don't* want $allowed_ids to include user input.

Overall I think allowing ints in literal concatenation without
tainting the result as non-literal
is a mistake. It would either prevent implementing proper literal int
type in future, or will make
it inconsistent (where non-literal int would be considered literal by
`is_literal()` for BC reasons).

Personally I would prefer limited applicability today that would not
prevent future consistent
implementation.

BTW, Psalm already distinguishes `literal-int` from `int` and
considers the result of
literal-string + int concatenation a non-literal string:
https://psalm.dev/r/59ad602688
This may mean that Matthew's point has been misinterpreted.

-- 
  Best regards,
      Bruce Weirdan                                     mailto:weirdan@gmail.com