Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:67426
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.48 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <E4921C42-6B99-4BFD-A8BA-359BC893B402@wiedler.ch>
References: <E1585E09-FB82-4486-9192-271A3947C8F3@wiedler.ch>
 <94D5D345-4D14-4BFF-9650-15E80205A6DE@wiedler.ch> <CALtuQzDuSK21fQrhk35g79JAW-RGXihHU7nwnNiB0Mvwn13YzA@mail.gmail.com>
 <4A468FA3-3260-463C-9D4E-FA78736447C1@wiedler.ch> <CALtuQzB=_AJCRkRNTgy+C3J=DfEE0NwAgP4nvp4YP+vp-HKqEw@mail.gmail.com>
 <E4921C42-6B99-4BFD-A8BA-359BC893B402@wiedler.ch>
Date: Wed, 15 May 2013 13:26:21 +0900
Message-ID: <CAGa2bXY5nmkfgxC921iyPxP7PmW7ET+-2p+ZcSEOzuFpyTipLg@mail.gmail.com>
To: Igor Wiedler <igor@wiedler.ch>
Cc: Sebastian Krebs <krebs.seb@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e01161bf4477d6f04dcba292d
Subject: Re: [PHP-DEV] Re: Importing namespaced functions
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e01161bf4477d6f04dcba292d
Content-Type: text/plain; charset=ISO-8859-1

Hi,

Although this change may cause confusion, but it would be beneficial to
many users as a security counter measure.

For instance, there is CVE-2013-2065 for Ruby

http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/

I suppose this change allow us "monkey patch" PHP without upgrade if it is
needed.

Regards,


--
Yasuo Ohgaki
yohgaki@ohgaki.net


2013/5/3 Igor Wiedler <igor@wiedler.ch>

> Your solution is flawed, it would not allow autoloading a function that
> has the same
> (namespaced) name as a builtin.
>
> Example:
>
>     // autoloadable function
>     namespace foo {
>         // make arg order consistent
>         function array_filter($callback, $input) {
>             return \array_filter($input, $callback);
>         }
>         function is_positive($x) {
>             return $x > 0;
>         }
>     }
>
>     namespace foo {
>         var_dump(array_filter('foo\is_positive', [-2, -1, 0, 1, 2]));
>     }
>
> Always triggering the autoloader is not feasible either, as it will lead
> to tons of stat calls,
> one per namespace that any global function is called in.
>
> Potential solutions: Only autoload fully qualified or imported functions.
>
> But there is lots of potential for bikeshedding there, plus it requires
> more implementation
> effort, and quite possibly more performance and cache related
> considerations that I am
> not aware of.
>
> As much as I would like to see function autoloading, I don't think
> bundling the proposals
> is going to be beneficial. Which is why I'd rather just focus on one issue
> at a time.
>
> Regards,
>
> Igor
>
> On May 3, 2013, at 12:18 AM, Sebastian Krebs <krebs.seb@gmail.com> wrote:
>
> > Well, it is not as complex as it sounds
> >
> > This is the behaviour right now
> >
> > - Does X exists as namespaced function (current namespace or imported)?
> > - Does X exists as global (builtin) function?
> > - Trigger error
> >
> > The behaviour including autoloading would be more like
> >
> > - Does X exists as namespaced function (current namespace or imported)?
> > - Does X exists as global (builtin) function?
> > - Trigger autoload
> > - Does X exists as namespaced function (current namespace or imported)
> now?
> > - Maybe: Does X exists as global function now?
> > - Trigger error
> >
> > The autoloading itself could use parts already used for
> class-autoloading.
> >
> >     // Signature
> >     // spl_autoload_register($callback[, $type = AUTOLOAD_CLASS]);
> >
> >     $autoload = function ($name, $type = AUTOLOAD_CLASS) {
> >       // Do something
> >     };
> >     spl_autoload_register($autoload, AUTOLOAD_CLASS | AUTOLOAD_FUNCTION
> | AUTOLOAD_CONSTANT); // "constant" here just to make it complete
> >
> > Namespaced functions without autoloading seems kindof incomplete,
> especially because it isn't such a big deal to simply use the prefixed one,
> so the benefit seems quite small to me :X
> >
> >     use MyFoo\Bar\MathFunctions as math;
> >     $x = math\sin($y);
> >
> >
> > Just saying :)
> >
> >
> > Regards,
> > Sebastian
> >
> >
> >
> >
> >
> > On May 2, 2013, at 11:40 PM, Sebastian Krebs <krebs.seb@gmail.com>
> wrote:
> >
> > > Hi,
> > >
> > > Are you going to cover autoloading of functions too?
> > >
> > > Regards,
> > > Sebastian
> >
> >
> >
> > --
> > github.com/KingCrunch
>
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--089e01161bf4477d6f04dcba292d--