Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118496
Message-ID: <3d436bc3-2a4b-8267-8dae-a45c51dcb5b2@gmx.net>
Date: Fri, 26 Aug 2022 11:43:23 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.12.0
Content-Language: en-US
To: internals@lists.php.net
References: <CANMwmbN8_Km+urXbNO7oWvNteYA2mTPNYyRgfaoypEK1Cw4F0A@mail.gmail.com>
 <CA+p1FaZDm3-h_LoOwv619wFyPg+2pAM8qC2La438sU_SPHZnCg@mail.gmail.com>
 <CABdc3WqsDc+80ATdX9+qstOkf+eUYCAQNPeV_FXcHiFumVQb8A@mail.gmail.com>
 <8D53AD5B-7CFC-4820-9EE4-FEB365D327A8@woofle.net>
 <CABdc3Wo7_qJOtebvA2GNGFUGFAut3tJOShXDBLHnRKqhrwVJ-g@mail.gmail.com>
In-Reply-To: <CABdc3Wo7_qJOtebvA2GNGFUGFAut3tJOShXDBLHnRKqhrwVJ-g@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] RFC json_validate() - status: Under Discussion
From: a.leathley@gmx.net (Andreas Leathley)

On 26.08.22 11:00, Micha=C5=82 Marcin Brzuchalski wrote:
> A `json_decode()` is a substitute that IMO solves 99% of use cases.
> If I'd follow your logic and accept every small addition that handles 1%=
 of
> use cases, somebody will raise another RFC
> for simplexml_validate_string or yaml_validate and the next
> PhpToken::validate.
> All above can be valid if we trust that people normally validate 300MB
> payloads to do nothing if they DON'T fail and there is nothing strange
> about that.

There is already a way to validate XML in PHP, and Yaml or PHP is
something within the control of a PHP programmer, while JSON is mostly
used as a format for communication in APIs, so you never know what you
get. If with a new function it becomes much easier to defend against a
Denial-of-Service attack for some parts of a JSON API, then this can be
a good addition just for security reasons.

But this reason, which most resonates with me, is currently missing in
the RFC, so I would suggest to add that fast / efficient validation of a
common communication format reduces the attack surface for
Denial-of-Service attacks.