Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121154
Message-ID: <3c2536fd-5c65-4364-8693-f0047fef8ebc@gmail.com>
Date: Wed, 27 Sep 2023 17:58:15 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: internals@lists.php.net
References: <98cb519e-4b45-5069-9f48-6e78dddf3284@php.net>
 <c09b8f7b-8081-ff3a-2ee6-223ea4bb5a45@bastelstu.be>
Content-Language: en-US
In-Reply-To: <c09b8f7b-8081-ff3a-2ee6-223ea4bb5a45@bastelstu.be>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] Security Audit Priorities
From: dossche.niels@gmail.com (Niels Dossche)

Hi

On 25/09/2023 17:33, Tim Düsterhus wrote:
> Hi
> 
> On 9/25/23 10:49, Derick Rethans wrote:
>> So, if you can suggest an area where doing an external review would have
>> high impact, please reply to this email.
> 
> Some things from top of my head in arbitrary order. Not all of them are necessarily important themselves per se, but rather intended to spark additional thoughts.
> 
> - Footguns in the default configuration / tunables / php.ini [1]

This reminds me of something.
There's an interesting paper about ReDoS resilience in different regex engines.
Some programming languages, including PHP, are evaluated there and compared: https://www.usenix.org/system/files/sec22-turonova.pdf
PHP has some configuration knobs for pcre (https://www.php.net/manual/en/pcre.configuration.php), not a lot to tune but maybe they can be?
To be honest, I haven't looked much into this.

> - MySQL Native Driver
> - password_* [1]
> - hash_equals()
> - ext/json, specifically json_decode()
> - The CSPRNG (ext/random/csprng.c)
> - bin2hex, base64_encode [2]
> - Open-ended: Misuse resistance of existing functions - Is it possible for a user to not properly check a return value and would this result in harm (i.e. should the function throw, but does not yet)?
> 
> Best regards
> Tim Düsterhus
> 
> [1] These tie a little into my https://wiki.php.net/rfc/bcrypt_cost_2023 RFC, which is not code but configuration.
> [2] Should these be made constant-time / should constant-time implementations always be available? See: https://github.com/paragonie/constant_time_encoding
> 

Cheers
Niels