Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63083
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAMUwpuSfd1U6aA_7o6d2jGm-i0PsLAf1MqKF8zvtcfzGFMGEXQ@mail.gmail.com>
References: <CALwr1Gn4OmHP=Qa7NKzpbkq+w8FEjUMZ3v678bbZVOGM23G35g@mail.gmail.com>
	<alpine.DEB.2.02.1209180809010.28929@whisky.home.derickrethans.nl>
	<CALwr1GnjwyE=yipK6UNkOm9m31LDDbpbcdgmr_nf0cUo+zOedw@mail.gmail.com>
	<CALwr1G=DOKmjudFFEAFY+6hmUh3q+qNe1ntWY1FLXP5GChLZdA@mail.gmail.com>
	<CAMUwpuSfd1U6aA_7o6d2jGm-i0PsLAf1MqKF8zvtcfzGFMGEXQ@mail.gmail.com>
Date: Tue, 18 Sep 2012 13:33:34 -0400
Message-ID: <CAAyV7nEiYyf1S9pstyzQh-KKPK14p8EmF-ZCaR7cNMP3+tizqA@mail.gmail.com>
To: jpauli <jpauli@php.net>
Cc: =?ISO-8859-1?Q?P=E1draic_Brady?= <padraic.brady@gmail.com>, 
	internals@lists.php.net
Content-Type: multipart/alternative; boundary=bcaec55242a023b76b04c9fd4a8c
Subject: Re: [PHP-DEV] RFC: Implementing a core anti-XSS escaping class
From: ircmaxell@gmail.com (Anthony Ferrara)

--bcaec55242a023b76b04c9fd4a8c
Content-Type: text/plain; charset=ISO-8859-1

Julien,

Implementing this to Core may be very nice, but as well very hard to do.
> String escaping is a pain to implement in C. One would tell : once
> it's done, it's OK, but unfortunately, that's not the case, as XSS
> rules evolve throught time as the attacks evolve.
>
> See the escape modules web servers tried to push (mod_security and its
> counterpart in Nginx), its PITA to maintain if you want something that
> covers a large area.
> By the way : why not let the web server do this as nowadays, they seem
> to manage that problem ?
>

As Padraic indicated, this is solving a different problem than the web
server even can. This has to be solved at the application layer (it
physically can't be sovled above it)...

As far as implementation pains, if I was to support this, I would want to
see something like the ESAPI (Enterprise Security API - by OWASP) used for
the actual implementation: http://code.google.com/p/owasp-esapi-c/

Perhaps providing a thin wrapper around it, but I wouldn't go much further
than that. And I don't think I'd support our own implementation (not using
an established C library)...

Anthony

--bcaec55242a023b76b04c9fd4a8c--