Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115144
MIME-Version: 1.0
Date: Fri, 25 Jun 2021 23:20:38 +0100
Message-ID: <CAFv4g+GCbRataTtCKSrej5yU259=hbjNxQVzZX+oXm_vh0z-TQ@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000060475d05c59e8dcb"
Subject: is_literal() is back
From: craig@craigfrancis.co.uk (Craig Francis)

--00000000000060475d05c59e8dcb
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Internals,

We're going back to the original is_literal() proposal.

https://wiki.php.net/rfc/is_literal

This means that integers, which we cannot flag if they came from the
developer, will not be considered as part of the "literal" definition.

This helps us avoid the naming issue, and trying to define a concept that's
a bit vague (strings from the developer, or integers from anywhere)... and
while I=E2=80=99m still of the belief that integers would help adoption, I =
can also
see the appeal of something that's easier to understand, especially for a
supermajority.

(My ideal solution would be to have a primary =E2=80=98is_literal=E2=80=99 =
vote, with a
secondary question of adding integer support, but I=E2=80=99ve checked and =
the
multiple-question system here is for minor implementation details only e.g.
names.)

But either way it=E2=80=99s important that we address how Injection Vulnera=
bilities
occur. This simple flagging-and-checking literals system that has been
proven to work in other languages, will give libraries an easy way to check
that certain sensitive values have only come from the developer.
Considering we need a two-thirds majority vote, we do need to keep this
straightforward, avoiding any concerns over the variables contents.

Thanks for all your feedback so far, and I hope you can continue to show
your support for this on here, to show RFC voters this should be added to
PHP.

Craig

--00000000000060475d05c59e8dcb--