Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:79043
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.173 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZE9u+nWz2ebdxhMWSnLxheyMcbFGYRy63a9M6Sz6hfXA@mail.gmail.com>
References: <66B7B28C-2651-4A71-AC2A-55D4C7BB3DDC@ajf.me>
	<CAGa2bXY4P9dP6rB0-hZ9E5=ALQv+04s157BtwyF7_N3VZV8igA@mail.gmail.com>
	<546D43B3.60708@gmail.com>
	<CAGa2bXZE9u+nWz2ebdxhMWSnLxheyMcbFGYRy63a9M6Sz6hfXA@mail.gmail.com>
Date: Thu, 20 Nov 2014 08:54:57 -0800
Message-ID: <CADR=R-grjMrJupAQ3GL+2L3_1gOto9ORJQR2X47jCoPTYJypNw@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Andrea Faulds <ajf@ajf.me>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=90e6ba61493c32d85305084d305d
Subject: Re: [PHP-DEV] [RFC] Safe Casting Functions
From: smalyshev@gmail.com (Stas Malyshev)

--90e6ba61493c32d85305084d305d
Content-Type: text/plain; charset=UTF-8

Hi!

> Please refer to CWE/SANS TOP 25, Monster Mitigation especially.
>
> http://cwe.mitre.org/top25/#Mitigations
>
> and ISO 27000. (I cannot provide link to it, since one should buy the
> document to read)

Could you please be more specific about how this relevant to this
specific case? "But an ISO standard and read it whole" is not exactly a
good argument discussing specific issue.

> Programmer should control over all inputs as the most important security
> measure.
> There are two strategies in general.
>
> - Convert inputs to secure values and ignore possible attacks.
> (Sanitization)
> - Validate inputs to reject malformed values and record possible
> attacks. (Validation and logging)

Thank you, I am aware of what sanitizing and validating input is.

> to_int can be used as validation. It has advantage to record possible
> attack (or bug). Logging is
> one of important security feature. Therefore, validation could be said
> more secure than sanitization.

This is just your personal opinion. Logging is not a security feature,
and if it were, it could be established independently, and should be
anyway since to_* log nothing. So claiming to_* is a security feature is
just wrong - it's like saying fopen() is a security feature because you
could use it to open a log file to which you'd write security-relevant
data.

> Which strategy to adopt is that depends on organization/application
> policy. Public web sites may ignore

This is right. So your claim that one is more secure than the other is
not correct.
-- 
Stas Malyshev
smalyshev@gmail.com

--90e6ba61493c32d85305084d305d--