Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:31503
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain porcupine.org from 168.100.189.2 cause and error)
DomainKey-Status: good
DomainKey-Signature: a=rsa-sha1; s=dktest; d=porcupine.org; c=simple; q=dns;
	h=subject:to:date:x-time-zone:x-mailer:mime-version:
	content-transfer-encoding:content-type:message-id:from;
	b=GUakg0wpF7PHcTyAPL/XXU3iSRr9qWUs+zGrTmDs/79Tj8OOm5VQzVFcfoaW3MUKh
	Gibe7qOAMAq7bNZ7YvUauPkvrgmfY9o6WQQgQpMWfHpHeubzKAwBtPwaYkU500sY3QY
	vpU0vWLdSe1prteOecCLL4ZJbFFtwaBRLyrtYCc=
To: internals@lists.php.net
Date: Thu, 9 Aug 2007 18:43:57 -0400 (EDT)
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
Message-ID: <20070809224357.3CCFE1F3EA6@spike.porcupine.org>
Subject: PHP-taint update
From: wietse@porcupine.org ((Wietse Venema))

Late last year I started a discussion on this list with a proposal
to add Perl/Ruby-like taint support to PHP - a feature that a
developer may turn on to find out where to insert explicit cleaning
operations to avoid code injection etc. vulnerabilities.  With
applications that are explicitly written to be taint ware, taint
support may also help at run-time as an additional safety net.

In the unavoidable trade-off between performance and developer
impact, this approach minimizes the performance hit; the developer
provides the explicit cleaning operations. Other taint-for-PHP
approaches make a different trade-off; they typically avoid developer
impact altogether, but come at the cost of a larger performance hit.

After a bunch of other work that needed to be done I've resumed
work on PHP and I'm currently working on a rough prototype that
supports taint in the core and in a bunch of standard built-ins.
Overhead is minimal because it's just setting and testing a few
normally unused bits in the zval structure.  I expect to get some
actual performance data once the implementation is complete enough,
and to have a first implementation out the door sometime in September.

        Wietse