Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125086
Date: Wed, 21 Aug 2024 04:23:13 -0400
To: Bilge <bilge@scriptfusion.com>
Cc: "=?utf-8?Q?internals=40lists.php.net?=" <internals@lists.php.net>
Message-ID: <7E80614A-63CF-4515-9DF1-C6869218F864@getmailspring.com>
In-Reply-To: <48c22449-6cdf-449f-917f-365506e3f2d0@scriptfusion.com>
References: <48c22449-6cdf-449f-917f-365506e3f2d0@scriptfusion.com>
Subject: Re: [PHP-DEV] [Concept] Flip relative function lookup order
 (global, then local)
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="66c5a3f1_66334873_f01f"
From: john@coggeshall.org (John Coggeshall)

--66c5a3f1_66334873_f01f
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline



On Aug 2 2024, at 4:37 pm, Bilge <bilge@scriptfusion.com> wrote:
> My only concern is there needs to be an alternative way to do this: intercepting internal calls. Sometimes, whether due to poor architecture or otherwise, we just need to be able to replace an internal function call. One example I can think of recently is where I had to replace `header()` with a void function in tests, just to stop some legacy code emitting headers before the main framework kicked in, then unable to emit its own response because HTTP headers had already been sent. In a perfect world it shouldn't be necessary, but sometimes it is, so I think for this proposal to be palpable there must still be a way to achieve this.
>

Just a tangent thought to the above, but I've always been a little concerned with the idea that a malicious composer package could potentially do nasty things because PHP looks at the local namespace first for functions. For example, if a composer package focused on Laravel that defines malicious versions of internal functions for common namespaces like App\Models , App\Http\Controllers , etc. it could do some nasty stuff -- and supply-chain attacks aren't exactly uncommon. Even worse is Wordpress or any other PHP-based software package that allows arbitrary plugins to be installed by non-technical users who really would have no idea if the package was safe even if they were looking at the code.
<?php
// something.php
namespace App\Models;

function password_hash(string $password, string|int|null $algo, array $options = []): string
{
print("Hello");
return $password;
}

<?php
// my code
namespace App\Models;

include "something.php";
password_hash('foobar', PASSWORD_DEFAULT);
I don't recall why local namespace first won, but IMO it wasn't a great call out the gate for that reason alone. Yes, you can always use \password_hash instead of password_hash , but making the default insecure and slower is silly IMO -- and not fixing it because of BC seems like the weaker argument here.
John

--66c5a3f1_66334873_f01f
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<br><br><div class=3D=22gmail=5Fquote=5Fattribution=22>On Aug 2 2024, at =
4:37 pm, Bilge &lt;bilge=40scriptfusion.com&gt; wrote:</div><blockquote><=
div class=3D=22moz-cite-prefix=22><div>My only concern is there needs to =
be an alternative way to do this: intercepting internal calls. Sometimes,=
 whether due to poor architecture or otherwise, we just need to be able t=
o replace an internal function call. One example I can think of recently =
is where I had to replace =60header()=60 with a void function in tests, j=
ust to stop some legacy code emitting headers before the main framework k=
icked in, then unable to emit its own response because HTTP headers had a=
lready been sent. In a perfect world it shouldn't be necessary, but somet=
imes it is, so I think for this proposal to be palpable there must still =
be a way to achieve this.</div></div></blockquote><br><div>Just a tangent=
 thought to the above, but I've always been a little concerned with the i=
dea that a malicious composer package could potentially do nasty things b=
ecause PHP looks at the local namespace first for functions. =46or exampl=
e, if a composer package focused on Laravel that defines malicious versio=
ns of internal functions for common namespaces like <code>App=5CModels</c=
ode>&nbsp;, <code>App=5CHttp=5CControllers</code>&nbsp;, etc. it could do=
 some nasty stuff -- and supply-chain attacks aren't exactly uncommon.&nb=
sp; Even worse is Wordpress or any other PHP-based software package that =
allows arbitrary plugins to be installed by non-technical users who reall=
y would have no idea if the package was safe even if they were looking at=
 the code.</div><br><div>&lt;=3Fphp</div><div>// something.php</div><div>=
namespace App=5CModels;</div><br><div>function password=5Fhash(string =24=
password, string=7Cint=7Cnull =24algo, array =24options =3D =5B=5D): stri=
ng</div><div>=7B</div><div>&nbsp;&nbsp; print(=22Hello=22);</div><div>&nb=
sp;&nbsp; return =24password;</div><div>=7D</div><br><div>&lt;=3Fphp</div=
><div>// my code</div><div>namespace App=5CModels;</div><br><div>include =
=22something.php=22;</div><br><div>password=5Fhash('foobar', PASSWORD=5FD=
E=46AULT);</div><br><div>I don't recall why local namespace first won, bu=
t IMO it wasn't a great call out the gate for that reason alone.&nbsp; Ye=
s, you can always use <code>=5Cpassword=5Fhash</code>&nbsp; instead of <c=
ode>password=5Fhash</code>&nbsp;, but making the default insecure and slo=
wer is silly IMO -- and not fixing it because of BC seems like the weaker=
 argument here.</div><br><div>John</div><br>
--66c5a3f1_66334873_f01f--