Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87303
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain garfieldtech.com from 66.111.4.25 cause and error)
Message-ID: <55B53731.8030203@garfieldtech.com>
Date: Sun, 26 Jul 2015 14:38:25 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: internals@lists.php.net
References: <CALYT1Yo-ae+cemXaaXs5Jv5t2DSzdxdYuxuhEGbXyoo_863+bw@mail.gmail.com> <55A7D993.5000301@moonspot.net> <55B2D142.6020802@gmail.com> <55B41BEC.20104@garfieldtech.com> <CAHvhOfi4N+enTEh32iNBfqyStYxtZ0obDMLBapXBOjvZ9CcJGw@mail.gmail.com>
In-Reply-To: <CAHvhOfi4N+enTEh32iNBfqyStYxtZ0obDMLBapXBOjvZ9CcJGw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] Core functions throwing exceptions in PHP7
From: larry@garfieldtech.com (Larry Garfield)

On 07/26/2015 01:36 PM, Jakub Kubíček wrote:
> Hi Larry!
>
> 2015-07-26 1:29 GMT+02:00 Larry Garfield <larry@garfieldtech.com>:
>> Another point here is that 0 is a perfectly legitimate random number in many
>> cases, so callers would need to do a === check, not just a boolean check.
> What "boolean check" are you talkin' about? I've never seen a code
> using e.g. strpos() like follows:
>
> <?php
>
> if(!is_bool($pos = strpos('foobar', 'baz'))) {
>      // we are correct, use $pos' value somewhere
> } else {
>      // strpos() produced a boolean, thus no 'baz' found in 'foobar'
> }
>
> ?>
>
> Rather it is most frequently being done like below:
>
> <?php
>
> if(FALSE !== $pos = strpos('foobar', 'baz')) {
>      // we are correct, use $pos' value somewhere
> } else {
>      // strpos() produced a boolean, thus no 'baz' found in 'foobar'
> }
>
> ?>
>
> I think in both cases you do a kind of "boolean check".

Yes, I am referring to the second, or variations therein.  When using 
strpos() you need to do a strict check against FALSE (===) to avoid a 
legit 0 getting misinterpreted.  It's also a very commonly forgotten 
check, especially among newer devs that haven't been burned by it a few 
times.

My point is that when talking about crypto-related functions, relying on 
people to get burned a few times and then remember to do a === check 
against FALSE is a horrible, horrible idea, hence random_int() should 
fail much harder, as is being suggested here (be that via E_FATAL, 
exception, error throw, or whatever, as long as the execution does NOT 
continue).  That is, I am agreeing with the proposal to have it die 
hard.  I moderately prefer the throw SecurityError approach as it's not 
a user-input error but a system config error, but anything that prevents 
execution from continuing is acceptable security-wise.

--Larry Garfield