Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:33260
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain hardened-php.net from 81.169.159.221 cause and error)
Message-ID: <4740B136.2080207@hardened-php.net>
Date: Sun, 18 Nov 2007 22:40:06 +0100
User-Agent: Thunderbird 2.0.0.9 (Windows/20071031)
MIME-Version: 1.0
To: Dan Scott <denials@gmail.com>
Cc: Stefan Esser <stefan.esser@sektioneins.de>,
	PHP internals <internals@lists.php.net>
References: <47401946.2050406@sektioneins.de> <fbb0d11d0711181217q4832c62ev7966ac9e98b900b9@mail.gmail.com>
In-Reply-To: <fbb0d11d0711181217q4832c62ev7966ac9e98b900b9@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Tainted Mode Decision
From: sesser@hardened-php.net (Stefan Esser)

Hi Dan,
> I believe the primary use case for taint mode would be to use it in
> development: taint mode is a mode which can be turned on to give you
> an idea of where your application may have exposed some
> vulnerabilities; let you fix those identified vulnerabilities; then
> turn off for production purposes. The speed of the implementation, if
> this is indeed the intention for taint mode, would therefore be
> irrelevant.
The problem here is that both approaches fail to be completely secure
even when your test environment
has 100% code coverage. And I am speaking of real 100% ... Currently
there is no tool that can
ensure that. All PHP CC tools I know of so far will for example not
handle the ternary operator correctly.

The reason why both taint mode implementations fail are simple. Take the
following statement.

$sql['id'] = mysql_real_escape_string($_GET['id']);
$query = "SELECT * FROM table WHERE id=".$sql['id'];

Wietse's taint mode will consider this statement safe and never cry.
GRASP on the other hand will see that there is user supplied data in the
SQL query, but will ignore it
because it is a number. It will only react if $sql['id'] contains a
string. Atleast the very first version did
this.

This means currently both approaches would tell the developer that they
are safe, while they are in fact not.

Stefan Esser