Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121138
Message-ID: <c09b8f7b-8081-ff3a-2ee6-223ea4bb5a45@bastelstu.be>
Date: Mon, 25 Sep 2023 17:33:00 +0200
MIME-Version: 1.0
To: internals@lists.php.net
References: <98cb519e-4b45-5069-9f48-6e78dddf3284@php.net>
Content-Language: en-US
In-Reply-To: <98cb519e-4b45-5069-9f48-6e78dddf3284@php.net>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] Security Audit Priorities
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=c3=bcsterhus?=)

Hi

On 9/25/23 10:49, Derick Rethans wrote:
> So, if you can suggest an area where doing an external review would have
> high impact, please reply to this email.

Some things from top of my head in arbitrary order. Not all of them are 
necessarily important themselves per se, but rather intended to spark 
additional thoughts.

- Footguns in the default configuration / tunables / php.ini [1]
- MySQL Native Driver
- password_* [1]
- hash_equals()
- ext/json, specifically json_decode()
- The CSPRNG (ext/random/csprng.c)
- bin2hex, base64_encode [2]
- Open-ended: Misuse resistance of existing functions - Is it possible 
for a user to not properly check a return value and would this result in 
harm (i.e. should the function throw, but does not yet)?

Best regards
Tim Düsterhus

[1] These tie a little into my https://wiki.php.net/rfc/bcrypt_cost_2023 
RFC, which is not code but configuration.
[2] Should these be made constant-time / should constant-time 
implementations always be available? See: 
https://github.com/paragonie/constant_time_encoding