Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63114
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <5058D070.1030605@lerdorf.com>
References: <CALwr1Gn4OmHP=Qa7NKzpbkq+w8FEjUMZ3v678bbZVOGM23G35g@mail.gmail.com>
	<5058A697.30903@sugarcrm.com>
	<CAAyV7nF82MW1gRpVpiVooCNyj7YE-eVDqjzqFX0m3X1J7Kp_UA@mail.gmail.com>
	<5058A8B8.3070404@sugarcrm.com>
	<5058A97A.4080900@ajf.me>
	<5058AABA.1040406@sugarcrm.com>
	<CAAyV7nHgJku5MqKY-D_Gk+DaSt-Wda3BJHsSzyS=yW6xENRi6w@mail.gmail.com>
	<5058B5A5.6090302@sugarcrm.com>
	<5058BA43.8010806@mrclay.org>
	<5058BBA6.4090702@sugarcrm.com>
	<5058BECC.8080409@lerdorf.com>
	<CALwr1GkwLPG1OuEJjCZGLWpNQeB-pcqhHB7UaSh2S78zjNWVOg@mail.gmail.com>
	<5058CE31.5060401@lerdorf.com>
	<CALwr1GkUtKLs72QHrVGZAs_kD2gTxyx1zHV1wOikUsOPeZ876Q@mail.gmail.com>
	<5058D070.1030605@lerdorf.com>
Date: Tue, 18 Sep 2012 21:11:02 +0100
Message-ID: <CAKxcST8Kq-8S2frne0C30Ye0RzqiZrWbfgmzB8fVaaig_c91Zw@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] RFC: Implementing a core anti-XSS escaping class
From: dragoonis@gmail.com (Paul Dragoonis)

On Tue, Sep 18, 2012 at 8:50 PM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:
> On 09/18/2012 03:46 PM, P=E1draic Brady wrote:
>> Bear in mind the RFC, in userland (and likely any PECL ext) implements
>> the ESAPI rules. They've been hacked on a lot over the years which is
>> why I made sure they were followed exactly. It's very unlikely that a
>> browser bug could scupper these unless they allowed in more unencoded
>> characters to be taken advantage of. There are benefits to reusing
>> pre-peer review rules.
>
> Sure, but you have potential for buffer overflows, regex
> backtrack/recursion issues and general programming errors when this
> moves to C. I guarantee there will be dozens of bugs in the first
> version no matter who writes it.

Hi Rasmus,

The existing implementations at symfony\zend are working pretty well.
They're using string manipulation and regex functions.
If we port it to C, can't we still use the exact same functions that
the PHP_FUNCTION() macros are calling to pretty much clone it.

Would this minimise the amount of change (if any) ?

- Paul

>
> -Rasmus
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>