Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63202
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <505B124A.8070309@lsces.co.uk>
References: <505AEB97.8010303@lsces.co.uk>
	<CALwr1GkYQ9D1ucU_dL2hBoDNKaei+wA8Q=sD=VaGC=LakBjuHg@mail.gmail.com>
	<505B124A.8070309@lsces.co.uk>
Date: Thu, 20 Sep 2012 14:09:43 +0100
Message-ID: <CAPwsocFUeCaPG-sx5fuGh__bkJPdV7k25NcXpnJkyvNK+ZBWfg@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Decode, transcode, sanitize, filter, escape
From: leight@gmail.com (Leigh)

> My whole point here is identifying WHAT needs 'escaping'. You can't simply
> 'escape' the output stream, you still want html tags to get out?

This problem is specific to YOU, because (as far as I understood your
previous post) you decided to store big chunks of HTML in your data
store. It is not a problem with this proposal, or a problem in
general.

> Perhaps HTMLPurifier
> should be a requirement everywhere, but then you need to 'pre-process' the
> content so as to allow through the 'text' that you want to display which may
> well be an example of a XSS attack? You can only apply 'escape' to elements
> that you have identified as needing it and need to let through those that do
> not.

No, it should not be a requirement. Most people inject directly into
attributes or into tags in a template fashion, they don't have to
parse their own output, because they generate it in a sensible
fashion.

> It is the 'filtering' out of the material that needs processing that is
> the problem? And I have no doubt that someone will find a hole that allows
> them to sneak past the filtering?

Again, your problem, not one with the escape function proposal.

Also again, may I direct you to the general user list, and maybe
someone there will feel like helping you with how to parse your HTML
blobs, since this really isn't the concern of internals.