Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:85021
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.48 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAEZPtU68oFYN5YoQk7+kJPDancrfj9eEbau9BCB6OgkQEV7p8Q@mail.gmail.com>
References: <CABBJUpfiy1BpdyZ5MJmQb3vQz9U8TkSECHCRctupV+BUG1H=fw@mail.gmail.com>
 <55066F07.80308@birkholz.biz> <CABBJUpd+yd_7g8VkU0SHRMt0a35idyyLS_7m6=-cGgBB1RzkQg@mail.gmail.com>
 <CAN=kQJe6civW3x=uT2wMB7Mb-33LvkSyHfU=FfB8cfbWsVE+_A@mail.gmail.com>
 <CAGa2bXaMPs2WNOvJzJz6S3Qm1z28H=msi8SdVsmPYJGz-kM8hQ@mail.gmail.com>
 <5506794B.8090008@birkholz.biz> <CAGa2bXbGxr4E8hi1_faNWOWSeLi6kn5kQJknCaZ4vUTNxHR+tg@mail.gmail.com>
 <CAEZPtU68oFYN5YoQk7+kJPDancrfj9eEbau9BCB6OgkQEV7p8Q@mail.gmail.com>
Date: Mon, 16 Mar 2015 19:59:38 +0900
Message-ID: <CAGa2bXYU4LVDdVdCjRUbqvFbkBzy_U3O21Hu7uarZBK_F=ir8A@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: PHP internals <internals@lists.php.net>, Dennis Birkholz <dennis@birkholz.biz>
Content-Type: multipart/alternative; boundary=001a1134fbc2788d1b051165c1d6
Subject: Re: [PHP-DEV] About declare(strict_types = 1)
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1134fbc2788d1b051165c1d6
Content-Type: text/plain; charset=UTF-8

Hi Pierre,

On Mon, Mar 16, 2015 at 5:17 PM, Pierre Joye <pierre.php@gmail.com> wrote:

> On Mar 16, 2015 6:46 PM, "Yasuo Ohgaki" <yohgaki@ohgaki.net> wrote:
> >
> > Hi Dennis,
> >
> > On Mon, Mar 16, 2015 at 3:33 PM, Dennis Birkholz <dennis@birkholz.biz>
> > wrote:
> >
> > > Am 16.03.2015 um 07:22 schrieb Yasuo Ohgaki:
> > > > Caller _must_ satisfy callee requirements. This is simple principle
> to
> > > > write a secure code.
> > > >
> > > > With this RFC, caller overrides security related setting. This means
> > > > scripts
> > > > that are prepared for type safety is "ignored" and it leads security
> > > breach.
> > >
> > > that is simply not true! The callee always gets the type it expects.
> > > There is no security problem involved here. The only difference is if
> > > type conversion rules apply or if an error is raised for a type
> mismatch.
> > >
> > > You clearly dislike the RFC (you voted no), that is OK, but don't
> scream
> > > of "security" bugs that don't exist. If they would exist, all type hint
> > > RFCs would have them in general.
> > >
> >
> > Not only Java/etc programmers but also PHP programmers will assume type
> > safety by types.
> >
> > Programmers assume integer type data is safe once it passes as integer
> type
> > parameter.
> > I'm sure PHP programmer do assume the same thing.
> >
> > I posted "bad code"
> >
> > <?php
> > function check_num_range(int $num) { if ($num < 0 || $num > 100)
> > trigger_error('Invalid range'); }
> > // Somewhere far from function definition.
> > $num = $GET['num'];
> > // Somewhere far from $num definition.
> > check_num_range($num); // Trying to check validity, int and range.
> > echo 'You have '.$num. ' now <br />'; // But $num could have any string.
> >                                                             //
> > "check_num_range((int)$num)" wouldn't help also.
> > ?>
> >
> > Caller controlled strict typing makes this worse... i.e.
> > <?php
> > declare(strict_types=1);
> > // We are safe since $num is strictly int. Callee has responsibility to
> > pass valid int . (But it's not)
> > function check_num_range(int $num) { if ($num < 0 || $num > 100)
> > trigger_error('Invalid range'); }
> > ?>
> >
> > Setting register_globals=On while callee script assumes
> > register_globals=Off is bad thing to do.
> > Similar argument applies to declare(strict_types=1) also.
> >
> > As I suggested in other thread, we are better to sit down and make
> > reasonable decision.
> > It's not religion, but technical issue. We can reach reasonable consensus
> > if we try to. If we
> > cannot, it is better to introduce weak type hint only for the time being.
>
> So basically you mixed topics and voted no for the one RFC that would
> allow what you want to do later while allowing strict hinting already.
> Accepting the other means changing casting rules again later at best. Not
> sure you did well here ;-)
>
I thought majority of us see the benefit of StrictSTH over this RFC. You're
right about it.

This RFC will have serious consequence.
We made mistake with "safe_mode". The main reason it failed is "it did not
force
caller to have responsibility to make it work as it should". This RFC does
the same
for how declare(strict_types=1) works.

Aren't we learned from "safe_mode" lessons?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1134fbc2788d1b051165c1d6--