Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:37213
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 66.249.92.175 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references;
        b=Bztt9LOUfMCEIrasOOUaVAziCu3C2ecU7Lm062m0ntuWBG1b1ASzlItNe7q/dWluqyhy+306DQwpcq2PDJb0eq7z/fo2WTSFYy/ygN9vnQupQBINifhZOCAOLTnUPB918kGrpEtzWu7zNr9B4VDCRp7Al8h2MBtwg6ruT0Xbevo=
Message-ID: <9b3df6a50804242347s51f5bffew674cd77a4a17e24d@mail.gmail.com>
Date: Fri, 25 Apr 2008 09:47:53 +0300
To: "Wietse Venema" <wietse@porcupine.org>
Cc: internals@lists.php.net
In-Reply-To: <20080424135730.239761F3E98@spike.porcupine.org>
MIME-Version: 1.0
Content-Type: multipart/alternative; 
	boundary="----=_Part_2525_9307167.1209106073440"
References: <20080424135730.239761F3E98@spike.porcupine.org>
Subject: Re: [PHP-DEV] PHP taint support update
From: arvids.godjuks@gmail.com ("Arvids Godjuks")

------=_Part_2525_9307167.1209106073440
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

2008/4/24 Wietse Venema <wietse@porcupine.org>:

> FYI,
>
> Taint support for PHP 5.2.5 has been updated. The 20080423 version
> improves support for PCRE, and fixes a harmless read-after-free bug.
>
> The primary goal of this code is to help PHP application programmers
> find and eliminate opportunities for HTML script injection, SQL or
> shell code injection, or PHP control hijacking. It's off by default,
> but can be configured to produce warnings or to terminate execution.
>
> User-mode "make test" run-time overhead is 0.5-1.5%, as measured
> on two different CPUs with the same OS and the same PHP executables.
> The bench.php overhead is 2%, and presents a worst-case number for
> compute-bound PHP applications that spend their entire life iterating
> over tiny loops.
>
> For more info, you can find links off http://wiki.php.net/rfc/taint/
>
> I presented a talk this week to the NYPHP users group. You can find
> a copy of my slides at http://www.nyphp.org/content/presentations/
>
>        Wietse
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
I just can't express my feelings about this extension. It's just fantastic.
Can't wait untill it's going stable and added to PECL, I have code witch is
needed to be tested exactly with this extension :)

------=_Part_2525_9307167.1209106073440--