Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:33248
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain hardened-php.net from 81.169.159.221 cause and error)
Message-ID: <4740375B.5020706@hardened-php.net>
Date: Sun, 18 Nov 2007 14:00:11 +0100
User-Agent: Thunderbird 2.0.0.9 (Windows/20071031)
MIME-Version: 1.0
To: Nuno Lopes <nlopess@php.net>
Cc: Stefan Esser <stefan.esser@sektioneins.de>,
	PHP internals <internals@lists.php.net>
References: <47401946.2050406@sektioneins.de> <006101c829d9$5e2f0140$4101a8c0@pc07653>
In-Reply-To: <006101c829d9$5e2f0140$4101a8c0@pc07653>
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Tainted Mode Decision
From: sesser@hardened-php.net (Stefan Esser)


> Also I don't know how GRASP works, but it's very difficult (if not
> impossible) to provide good analysis..
The difference between GRASP and PHP Taint Mode is that GRASP tracks
taintedness on a byte level
(it really tracks that e.g. byte 4, 7 and 8-20 of a variable are tainted
and the others not) and Venema's
implementation only tracks on a per variable level.

It is therefore obvious that the GRASP way cannot be made fast and that
Venema's implementation will always be faster.

The other difference is that Venema's implementation assumes that
functions exist that make a variable safe for usage in SQL, HTML, ...
When such a function is used the variable is marked as not tainted... In
the previous mail I showed examples why this is not secure.

GRASP on the other hand hooks the SQL/output functions and parses the
SQL query/output and catches tainted bytes in places where they could be
dangerous.
The only problems here are how slow this is and that the parsers need to
be compatible.

Stefan Esser