Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:53087
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.42 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:from:date:message-id:subject:to
         :cc:content-type;
        b=Kt4ULAFB/gqMVefnTpdTh5mpPB0EmXMOYp54EdIhZ234c3ZE1v5+8pkK11n/6GJD6C
         OR9J3gd61sygpILEAOYsYq1TYL2J7wcbUQ3/EE7AjD8HFglwUXGivTjgBRuavG0Jmjd5
         jNHbMjdoUjZ9vRdFJexyv0C+fvtqpuArlpUEU=
MIME-Version: 1.0
In-Reply-To: <4DEBD6B9.9060103@sugarcrm.com>
References: <4DEB3D65.107@sugarcrm.com> <BANLkTinyD_EmnnOvZP_oS9K19fBq4Q8ROA@mail.gmail.com>
 <BANLkTi=2Qg=NHeXyovvty-guUCzHHfo5sQ@mail.gmail.com> <4DEBD46E.3070708@sugarcrm.com>
 <BANLkTimr_Wmn5rdF4hhAbwBhc_k=m8Tmxw@mail.gmail.com> <4DEBD6B9.9060103@sugarcrm.com>
Date: Mon, 6 Jun 2011 18:53:11 -0300
Message-ID: <BANLkTi=38XmWxqOd7GfTbSrSHR20FAXbUA@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: Pierre Joye <pierre.php@gmail.com>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001636e0ae0d5aa29804a5122280
Subject: Re: [PHP-DEV] bug #39863 in trunk/5.4
From: felipensp@gmail.com (Felipe Pena)

--001636e0ae0d5aa29804a5122280
Content-Type: text/plain; charset=UTF-8

Hi,

2011/6/5 Stas Malyshev <smalyshev@sugarcrm.com>

> Hi!
>
>
>  Of course, I was just checking if it's what you guys are thinking first.
>>
>
> Well, there was basically two ideas:
> 1. Add filename length to streams and check inside streams
> 2. Check inside argument parser
>
> Both have downsides: (1) does not capture cases when we don't use streams
> (such as direct stat/touch/etc functions), (2) doesn't cover the case when
> stream is manipulated through a string not coming directly from a function
> argument (e.g. include, but may be other cases with extensions). So,
> ideally, it'd be nice to have both - or something third that I didn't think
> of - but any of them is better than nothing.
> (1) seems to be easier and less disruptive, provided that we cover include
> case separately and locate all functions that deal with filenames.
>
>
Ok, I've committed in 5.4 and trunk the argument parser part.

Now I need to fix some tests and try to found other places needing for
related checks.


Thanks.

-- 
Regards,
Felipe Pena

--001636e0ae0d5aa29804a5122280--