Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121197
MIME-Version: 1.0
References: <98cb519e-4b45-5069-9f48-6e78dddf3284@php.net>
In-Reply-To: <98cb519e-4b45-5069-9f48-6e78dddf3284@php.net>
Date: Sun, 1 Oct 2023 10:39:53 +0700
Message-ID: <CAEZPtU7F2X3TwiHMDFOaae2Y=+-NoJsC8r3o045yTXC7nkweog@mail.gmail.com>
To: Derick Rethans <derick@php.net>
Cc: PHP Developers Mailing List <internals@lists.php.net>, PHP Security List <security@php.net>
Content-Type: multipart/alternative; boundary="000000000000b2264806069f69c5"
Subject: Re: Security Audit Priorities
From: pierre.php@gmail.com (Pierre Joye)

--000000000000b2264806069f69c5
Content-Type: text/plain; charset="UTF-8"

Hello,

On Mon, Sep 25, 2023, 3:49 PM Derick Rethans <derick@php.net> wrote:

> .
>
> Typical areas would be where user input can be (automatically read)
> remotely, such as
> our RFC 1867 HTTP header parser. But we are sure there are other
> important areas as well, and we would like your input.
>
> So, if you can suggest an area where doing an external review would have
> high impact, please reply to this email.
>

thanks for the feedback request :)

the sapi in general (and the underlying used APIs, like http headers you
mentioned) would be on top on my mind.

The embedded sapi may take more importance soon I think. It won't be as
wide as fpm but frankenphp (or similar) will see a significant increase in
usage, for good reasons:)

best,
Pierre

>

--000000000000b2264806069f69c5--