Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118148
MIME-Version: 1.0
References: <CAOfKkdTjPiZHnSHuag_+fmFK-1Advh2-vfDgbJBXEmK=72NB0g@mail.gmail.com>
 <7CB0EB0B-700D-49F6-8223-00A9B16F463B@php.net> <CAOfKkdQJUww10XkdcPx9AvAe=w=T8mS1MW6oJ=itzLp4x7L1jA@mail.gmail.com>
 <CAAKU0u=hatp+7LRKAjtdWkP3_zgu1ddNmDvLTrJ46CwS-YUXKQ@mail.gmail.com>
In-Reply-To: <CAAKU0u=hatp+7LRKAjtdWkP3_zgu1ddNmDvLTrJ46CwS-YUXKQ@mail.gmail.com>
Date: Fri, 1 Jul 2022 11:07:11 +0100
Message-ID: <CALKiJKroRK6K2DTj6c7jYQf32DH+=vigq0a8TargKVu6VY0ikQ@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000007a64b805e2bb8d20"
Subject: Re: [PHP-DEV] [RFC] [Under Discussion] New Curl URL API
From: rowan.collins@gmail.com (Rowan Tommins)

--0000000000007a64b805e2bb8d20
Content-Type: text/plain; charset="UTF-8"

On Thu, 30 Jun 2022 at 23:21, Levi Morrison via internals <
internals@lists.php.net> wrote:

> On Thu, Jun 30, 2022 at 10:48 AM Pierrick Charron <pierrick@php.net>
> wrote:
> > One of the goal of this API is to tighten a problematic vulnerable area
> > for applications where the URL parser library would believe one thing
> > and libcurl another. This could and has sometimes led to security
> > problems.
>
> Designing another API on top of what libcurl provides _could make the
> problem worse_.



My concern is rather the opposite: if it is not obvious *to someone writing
PHP code* how the API should be used, there is a higher chance of them
using it incorrectly, and introducing errors.

A good example of this mindset is the password_* functions: they do not
expose the options of underlying implementations, they present an
easy-to-use *opinionated* set of behaviours, that solves a common use case
for their audience. They allow users to "fall into the pit of success",
because the easy thing is also the correct thing.

However, to me at least, it's not entirely clear who the target audience
for this API is, what tasks it should be making easy, and what correct
usage looks like. Just providing a bunch of functions, in whatever form,
doesn't provide security unless users can understand how to use them
securely.

Regards,
-- 
Rowan Tommins
[IMSoP]

--0000000000007a64b805e2bb8d20--