Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:79909
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.41 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <09B14273-C621-4AB9-9129-A149A9480A03@ajf.me>
References: <CAPKwhwsNbjeiMjb=yxNOVAXTBGWpT+Cm6X5Q1peT=_TOLGThxg@mail.gmail.com>
	<CAEZPtU7UfK7CApn=86q-G3WS1uKpiuVqLy7fdwv1vg5v0kDt7Q@mail.gmail.com>
	<CAGa2bXZchck1uNvW=4HVRF7Y4km4deqZ9C0bCU4JzVQJnmOjGQ@mail.gmail.com>
	<09B14273-C621-4AB9-9129-A149A9480A03@ajf.me>
Date: Wed, 24 Dec 2014 18:23:27 +1100
Message-ID: <CAEZPtU7MOcgmSt1B-4fKK-PNVfk2567PV8CJ==0ab_M105EAdw@mail.gmail.com>
To: Andrea Faulds <ajf@ajf.me>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, PHP internals <internals@lists.php.net>, 
	Scott Arciszewski <kobrasrealm@gmail.com>
Content-Type: multipart/alternative; boundary=001a1132e2c0f79d90050af12a57
Subject: Re: [PHP-DEV] JSON HASHDOS
From: pierre.php@gmail.com (Pierre Joye)

--001a1132e2c0f79d90050af12a57
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Dec 24, 2014 3:17 AM, "Andrea Faulds" <ajf@ajf.me> wrote:
>
>
> > On 23 Dec 2014, at 20:12, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> >
> > Hi,
> >
> > On Wed, Dec 24, 2014 at 4:51 AM, Pierre Joye <pierre.php@gmail.com>
wrote:
> >
> >> This issue has been reported earlier on security@php.net and is being
> >> discussed and analyzed. It is not a simple task.
> >>
> >
> > If we are not going to use other hash (i.e. half MD4 like other langs),
how
> > about
> > add max allowed collisions? It would be simple and fast enough. I'm not
> > looking
> > at the code, so I could be wrong.
>
> Hey,
>
> We could implement a special JSONObject class with custom __get/__set
handlers and that=E2=80=99s Traversable, which implements a randomised hash=
ing
algorithm rather than using zend_hash. That could be overkill though.

Please keep in mind that this problem is:

. not json specific
. not specific at runtime but could also happen before a script get the han=
d

A randomized hash only postpone the issue but won't solve it.

I fear that a fix is way more work that what we may think. A discussion is
going on security, let hope to get something in a reasonable time. I also
wonder what we could provide right now to at least prevent script kiddies
attacks during this holiday season...

--001a1132e2c0f79d90050af12a57--