Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:86226
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.174 as permitted sender)
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\))
In-Reply-To: <CAGa2bXZFtjPN7+x2VcCrTPnnDZg3cG-45x4w4BpkU2sLgq4UkQ@mail.gmail.com>
Date: Fri, 15 May 2015 15:12:32 +1000
Cc: Arvids Godjuks <arvids.godjuks@gmail.com>,
 "internals@lists.php.net" <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <A7C82EF0-144D-46AF-AD65-E903188C528C@gmail.com>
References: <CAGa2bXYzp3XimLXxC+Py2t1DWhCfX8coTdYHzf6zEiKdxA7r8Q@mail.gmail.com> <CAGa2bXbs+MsDBYQdiWsG6uX9ZuBd+tstn65V3LK_+mkL+FMTqg@mail.gmail.com> <CAL0xaBEb4cxonGcrdZ64YH_vE3M9sdyd+7=vE45gKpH62bVWSQ@mail.gmail.com> <CAGa2bXZFtjPN7+x2VcCrTPnnDZg3cG-45x4w4BpkU2sLgq4UkQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Subject: Re: [PHP-DEV] Adding "numeric" type hint
From: davidkmuir@gmail.com (David Muir)


> On 14 May 2015, at 9:27 pm, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>=20
> Hi Arvids,
>=20
> On Mon, May 11, 2015 at 8:01 PM, Arvids Godjuks =
<arvids.godjuks@gmail.com>
> wrote:
>=20
>> Hello, I have read through your blog post, and I agreed on the issue
>> earlier, nut I have a question that bugs me for a while: what DoS =
issue are
>> you talking about? I tried to imagine any scenario that can lead to a =
DoS
>> wuith a type hint and can't think of any happening...
>=20
>=20
> Too large value raise typeException (Thanks Nikita)
> DoS is easy on 32 bit CPU machines, but it's possible on 64 bit =
machines
> also.
>=20
> Simplest scenario would be client side DoS. Many IoT devices will =
remain 32
> bits and if it
> gets result value larger than 2 billions, execution may stopped by
> unhandled exception
> sudduly. Library/framework uses basic type hint may harm system like =
this.
>=20
> Some databases support unsigned INT8. Most databases support =
NUMERIC/DECIMAL
> which can have value larger signed 64 bit int. If attacker find way to
> store too large ID
> somewhere (e.g. as JSON/XML text that queries database), then system =
may
> use the
> value against type hinted functions/methods.
>=20
> Without basic type hints, these concerns weren't existed.
>=20
> Regards,
>=20
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net


Yasuo,

I still don=E2=80=99t see how you can put the blame for the unhanded =
exception on type hints. The problem you=E2=80=99re describing is not =
new and exists today with libraries using code like this:

function foo($int) {
    if(!is_int($int)) {
        throw new InvalidArgumentException(=E2=80=98Parameter must be of =
type int=E2=80=99);
    }
    //=E2=80=A6 do something with $int
}

Cheers,
David