Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69912
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.49 as permitted sender)
MIME-Version: 1.0
Sender: julienpauli@gmail.com
In-Reply-To: <526E464B.5030208@php.net>
References: <3E.D7.40084.12BBA625@pb1.pair.com> <CAGa2bXYANkW6yDN2_UqncHWpM4Zv+DxMTX0W8kT5-83JAveZjw@mail.gmail.com>
 <526B554F.1020606@pthreads.org> <CAGa2bXaQ1pdObaN=1vva0QOaJPyZvr381T6riKcNYput51NawA@mail.gmail.com>
 <CAGa2bXba-kr8deWYVTNywTySz8Abg-YR1YO1WM_BxjZj30+jOQ@mail.gmail.com>
 <526CAF56.70908@pthreads.org> <CAMUwpuSHEucaQMEy6AiCsAXgcNHX3Y39Fi_SEw77eSWFfuqVyg@mail.gmail.com>
 <526E464B.5030208@php.net>
Date: Mon, 28 Oct 2013 12:42:37 +0100
Message-ID: <CAMUwpuSnDMvo5okhgmhRPDEgH_NEsu696TaSBxuDs7dCmw4uSA@mail.gmail.com>
To: Joe Watkins <krakjoe@php.net>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1135fb02243b3c04e9cb9b8e
Subject: Re: [PHP-DEV] error_log binary unsafe
From: jpauli@php.net (Julien Pauli)

--001a1135fb02243b3c04e9cb9b8e
Content-Type: text/plain; charset=ISO-8859-1

On Mon, Oct 28, 2013 at 12:11 PM, Joe Watkins <krakjoe@php.net> wrote:

> On 10/28/2013 10:50 AM, Julien Pauli wrote:
>
>> On Sun, Oct 27, 2013 at 7:14 AM, Joe Watkins <pthreads@pthreads.org>
>> wrote:
>>
>>  On 10/26/2013 11:54 PM, Yasuo Ohgaki wrote:
>>>
>>>  Hi Joe,
>>>>
>>>> On Sun, Oct 27, 2013 at 7:48 AM, Yasuo Ohgaki <yohgaki@ohgaki.net
>>>> <mailto:
>>>> yohgaki@ohgaki.net>> wrote:
>>>>
>>>>      On Sat, Oct 26, 2013 at 2:38 PM, Joe Watkins
>>>>
>>>>      <pthreads@pthreads.org <mailto:pthreads@pthreads.org>****> wrote:
>>>>
>>>>          Mail is not yet handled, TCP/IP is not supported any more,
>>>>          streams are binary safe.
>>>>          The SAPI and default error logging mechanism are all that
>>>>          require attention.
>>>>
>>>>          The patch is not final and doesn't include a fix for every
>>>>          implementation of SAPI.
>>>>
>>>>          I don't see the need for confusion ??
>>>>
>>>>
>>>>      Generally speaking, I'm not against making functions/features
>>>>      binary safe.
>>>>
>>>>      There are many implementations of syslog/SAPI and not sure if it
>>>>      is good for all.
>>>>      It could cause BC issue also. For example, application like OSSEC
>>>>      HIDS detects
>>>>      possible intrusion by analyzing logs. Patching SAPI may break
>>>>      these applications.
>>>>
>>>>      I'm not against applying your patch to master, but it's not for
>>>>      released versions.
>>>>      We needs UPGRADE note if the patch is applied.
>>>>
>>>>
>>>> I think it's good for master.
>>>> Do you have commit karma?
>>>> If not, I'm willing to merge your patch unless there are not objections.
>>>>
>>>> Regards,
>>>>
>>>> --
>>>> Yasuo Ohgaki
>>>> yohgaki@ohgaki.net <mailto:yohgaki@ohgaki.net>
>>>>
>>>>
>>> I don't have karma ...
>>>
>>> There are lots of SAPI's, but this patch wasn't meant to implement them
>>> all, only to provide a route whereby they can implement binary safe
>>> log_message in the shape of log_message_ex.
>>>
>>> The patch implements binsafe log for cli and cgi, do we need to implement
>>> any more ??
>>>
>>>
>> Joe: Why do you use strlen() ? This leads to the same not binary safe
>> string, am I wrong ??
>> https://github.com/krakjoe/**php-src/commit/**
>> be5f38ddd449c20230c042aef9757e**fb2ee08188#diff-**
>> 1a9cfc6173e3a434387996e46086da**56R610<https://github.com/krakjoe/php-src/commit/be5f38ddd449c20230c042aef9757efb2ee08188#diff-1a9cfc6173e3a434387996e46086da56R610>
>>
>> Julien Pauli
>>
>>
> (sorry if you got this twice, my interweb is playing up)
>
> Hi Julien,
>
>         The binary safe logging interface for SAPI is log_message_ex and
> the binary safe logging function for php is php_log_err_ex
>         The old function must remain, and use string length just as it did
> before.
>

I see, that means that the actual patch does not turn logging to binary
safe logs, but gives functions for that.
Turning logs to binary safe would then mean tracking every unsafe log
function (php_log_err()) and turn it to php_log_err_ex() with an explicit
string length.


Julien Pauli

--001a1135fb02243b3c04e9cb9b8e--