Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121145
MIME-Version: 1.0
References: <98cb519e-4b45-5069-9f48-6e78dddf3284@php.net>
In-Reply-To: <98cb519e-4b45-5069-9f48-6e78dddf3284@php.net>
Date: Tue, 26 Sep 2023 11:42:50 +0200
Message-ID: <CAPzBOBPE_0Q=vrW1Hmjj1+eaW39UZR4Yp9g0hQpY8oLAQmr=Sg@mail.gmail.com>
To: Derick Rethans <derick@php.net>
Cc: PHP Developers Mailing List <internals@lists.php.net>, PHP Security List <security@php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Security Audit Priorities
From: landers.robert@gmail.com (Robert Landers)

On Mon, Sep 25, 2023 at 10:49=E2=80=AFAM Derick Rethans <derick@php.net> wr=
ote:
>
> Hi,
>
> The Foundation is organising an external audit/security check of the PHP
> source code. As part of that, we would like to identify the places in
> the PHP source code where checking this will have the most impact.
>
> Typical areas would be where user input can be (automatically read) remot=
ely, such as
> our RFC 1867 HTTP header parser. But we are sure there are other
> important areas as well, and we would like your input.
>
> So, if you can suggest an area where doing an external review would have
> high impact, please reply to this email.
>
> cheers,
> Derick
>
> --
> https://derickrethans.nl | https://xdebug.org | https://dram.io
>
> Author of Xdebug. Like it? Consider supporting me: https://xdebug.org/sup=
port
> Host of PHP Internals News: https://phpinternals.news
>
> mastodon: @derickr@phpc.social @xdebug@phpc.social
> twitter: @derickr and @xdebug
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: https://www.php.net/unsub.php
>

Possible the spl extension. Most of that memory lives outside of PHP
during runtime and is invisible to the engine, IIRC. Lots of people
put random user-input in the objects there.



Robert Landers
Software Engineer
Utrecht NL