Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:79020
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.174 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXZE9u+nWz2ebdxhMWSnLxheyMcbFGYRy63a9M6Sz6hfXA@mail.gmail.com>
References: <66B7B28C-2651-4A71-AC2A-55D4C7BB3DDC@ajf.me> <CAGa2bXY4P9dP6rB0-hZ9E5=ALQv+04s157BtwyF7_N3VZV8igA@mail.gmail.com>
 <546D43B3.60708@gmail.com> <CAGa2bXZE9u+nWz2ebdxhMWSnLxheyMcbFGYRy63a9M6Sz6hfXA@mail.gmail.com>
Date: Thu, 20 Nov 2014 16:29:45 +0900
Message-ID: <CAGa2bXYeNv9E=wN+DkmBu-QWK6r6cSsTbJb+e_M1Qtwq2Ktv=Q@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Andrea Faulds <ajf@ajf.me>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c35e343e4f420508454d77
Subject: Re: [PHP-DEV] [RFC] Safe Casting Functions
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c35e343e4f420508454d77
Content-Type: text/plain; charset=UTF-8

Hi Stas,

On Thu, Nov 20, 2014 at 4:10 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Please refer to CWE/SANS TOP 25, Monster Mitigation especially.
>
> http://cwe.mitre.org/top25/#Mitigations
>
> and ISO 27000. (I cannot provide link to it, since one should buy the
> document to read)
>
> Programmer should control over all inputs as the most important security
> measure.
> There are two strategies in general.
>
>  - Convert inputs to secure values and ignore possible attacks.
> (Sanitization)
>  - Validate inputs to reject malformed values and record possible attacks.
> (Validation and logging)
>
> (int) is sanitization. It works, but it cannot log/detect possible attack
> (or bug).
>
> to_int can be used as validation. It has advantage to record possible
> attack (or bug). Logging is
> one of important security feature. Therefore, validation could be said
> more secure than sanitization.
>
> Which strategy to adopt is that depends on organization/application
> policy. Public web sites may ignore
> invalid inputs due to large amount of attacks while private web sites may
> require to record all
> possible attacks (or bugs), for example.
>

We know people do things like

$id = $_GET['id'];
pg_qeury("SELECT * FROM some_table WHERE id = $id;");

(int) works mostly. to_int is better as it may detect possible attack or
bug.

I implement user error/exception handlers always to detect possible
attack/bug.
to_int may be used as validation to detect internal logic inconsistency as
well as
user input validation.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c35e343e4f420508454d77--