Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125091
Date: Wed, 21 Aug 2024 14:02:11 -0400
To: Rob Landers <rob@bottled.codes>
Cc: Bilge <bilge@scriptfusion.com>, 
 "=?utf-8?Q?internals=40lists.php.net?=" <internals@lists.php.net>
Message-ID: <66592B01-1A40-4FCD-8FEE-8EB8338069D0@getmailspring.com>
In-Reply-To: <c0058f34-063c-4610-a3aa-6bc3f328e229@app.fastmail.com>
References: <c0058f34-063c-4610-a3aa-6bc3f328e229@app.fastmail.com>
Subject: Re: [PHP-DEV] [Concept] Flip relative function lookup order
 (global, then local)
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="66c62ba3_625558ec_f01f"
From: john@coggeshall.org (John Coggeshall)

--66c62ba3_625558ec_f01f
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline



On Aug 21 2024, at 8:03 am, Rob Landers <rob@bottled.codes> wrote:
>
> If this is an attack vector for your application, then fully qualified names is the way to go (WordPress does this nearly everywhere, for example).
This is an attack vector for every application and I would argue should be a real concern for the vast majority of applications out there -- any which rely on namespace-based frameworks and composer packages from untrustworthy sources. It's not just Wordpress -- literally every single PHP application that uses a publicly available framework and consumes external composer packages should be FQing their internal function calls. The natural behavior of the language shouldn't be the insecure way of doing things for the sake of maintaining BC compatibility with existing, insecure, code.
Cheers,
John
--66c62ba3_625558ec_f01f
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<br><br><div class=3D=22gmail=5Fquote=5Fattribution=22>On Aug 21 2024, at=
 8:03 am, Rob Landers &lt;rob=40bottled.codes&gt; wrote:</div><blockquote=
><br><div>If this is an attack vector for your application, then fully qu=
alified names is the way to go (WordPress does this nearly everywhere, fo=
r example).</div></blockquote><br><div>This is an attack vector for <stro=
ng>every</strong>&nbsp;application and I would argue should be a real con=
cern for the vast majority of applications&nbsp; out there -- any which r=
ely on namespace-based frameworks and composer packages from untrustworth=
y sources. It's not just Wordpress -- literally every single PHP applicat=
ion that uses a publicly available framework and consumes external compos=
er packages should be =46Qing their internal function calls. The natural =
behavior of the language shouldn't be the insecure way of doing things fo=
r the sake of maintaining BC compatibility with existing, insecure, code.=
</div><br><div>Cheers,</div><br><div>John</div>
--66c62ba3_625558ec_f01f--