Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:79019
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.173 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <546D43B3.60708@gmail.com>
References: <66B7B28C-2651-4A71-AC2A-55D4C7BB3DDC@ajf.me> <CAGa2bXY4P9dP6rB0-hZ9E5=ALQv+04s157BtwyF7_N3VZV8igA@mail.gmail.com>
 <546D43B3.60708@gmail.com>
Date: Thu, 20 Nov 2014 16:10:15 +0900
Message-ID: <CAGa2bXZE9u+nWz2ebdxhMWSnLxheyMcbFGYRy63a9M6Sz6hfXA@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Andrea Faulds <ajf@ajf.me>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c31e0c94872605084507f6
Subject: Re: [PHP-DEV] [RFC] Safe Casting Functions
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c31e0c94872605084507f6
Content-Type: text/plain; charset=UTF-8

Hi Stas,

On Thu, Nov 20, 2014 at 10:28 AM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> > I like this RFC overall. Precise parameter checks is good for security
> > always.
>
> I don't see how it matters for security at all. If you need an int,
> (int) works as well as any proposed check, security-wise. You may want
> different diagnostics, etc. but this doesn't have to do much with
> security. In other words, if the security depends on any differences
> between (int) and to_int, it's probably not done right.


Please refer to CWE/SANS TOP 25, Monster Mitigation especially.

http://cwe.mitre.org/top25/#Mitigations

and ISO 27000. (I cannot provide link to it, since one should buy the
document to read)

Programmer should control over all inputs as the most important security
measure.
There are two strategies in general.

 - Convert inputs to secure values and ignore possible attacks.
(Sanitization)
 - Validate inputs to reject malformed values and record possible attacks.
(Validation and logging)

(int) is sanitization. It works, but it cannot log/detect possible attack
(or bug).

to_int can be used as validation. It has advantage to record possible
attack (or bug). Logging is
one of important security feature. Therefore, validation could be said more
secure than sanitization.

Which strategy to adopt is that depends on organization/application policy.
Public web sites may ignore
invalid inputs due to large amount of attacks while private web sites may
require to record all
possible attacks (or bugs), for example.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c31e0c94872605084507f6--