Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87209
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain craigfrancis.co.uk designates 74.125.82.52 as permitted sender)
Content-Type: multipart/alternative; boundary="Apple-Mail=_317C5436-702C-4319-AA12-9E18AD34F290"
Message-ID: <CB9366B2-BEA9-423F-8CD8-240CC0B9DB40@craigfrancis.co.uk>
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
Date: Fri, 17 Jul 2015 15:16:28 +0100
References: <872B5165-6A87-4024-BB9D-514E83A22E6F@craigfrancis.co.uk> <CAEYWF=7GL23ffgJtOozeLO8gEHbub4+GwiOFJP3v4UypuasFhw@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
In-Reply-To: <CAEYWF=7GL23ffgJtOozeLO8gEHbub4+GwiOFJP3v4UypuasFhw@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] String Types (security)
From: craig@craigfrancis.co.uk (Craig Francis)

--Apple-Mail=_317C5436-702C-4319-AA12-9E18AD34F290
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

On 17 Jul 2015, at 14:08, Mats Lindh <mats.lindh@gmail.com> wrote:

> On Fri, Jul 17, 2015 at 3:03 PM Craig Francis =
<craig@craigfrancis.co.uk> wrote:
> I'm looking at creating an RFC to address security issues that relate =
to poor string handling / escaping, such as SQL-Injection, XSS, etc.
> =20
> You probably want to related this to the existing RFC for "taint" =
support for variables and the changes needed to make it work (there is =
also an experimental PECL extension available)




On 17 Jul 2015, at 14:55, Bishop Bettini <bishop@php.net> wrote:
> Sounds like you are describing the taint extension



Thanks Mats and Bishop.

That is pretty much identical to what I'm after (although I would like =
to suggest some changes).

It's a shame it looks like the PECL extension hasn't been touched since =
2013 (PHP 5.4), and the RFC is from 2008... so I suspect this isn't =
going anywhere.

Do you know if there is anything I can do to help get it going again? =
(I'm not a C developer, so its probably not a good idea for me to be =
playing with variables like this... I know enough to realise that =
mistakes here would result in some pretty big security and performance =
issues).

Craig


--Apple-Mail=_317C5436-702C-4319-AA12-9E18AD34F290--