Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87877
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.161 cause and error)
MIME-Version: 1.0
In-Reply-To: <20150823132604.1224B26052F@dd15934.kasserver.com>
References: <20150823132604.1224B26052F@dd15934.kasserver.com>
Date: Sun, 23 Aug 2015 16:30:01 +0200
Message-ID: <CANUQDCguxiBHtebns_ze-euJ77q65818T1oALvFwcCbh-LUHDQ@mail.gmail.com>
To: Thomas Bley <mails@thomasbley.de>
Cc: Scott Arciszewski <scott@paragonie.com>, PHP Internals <internals@lists.php.net>, 
	Anthony Ferrara <ircmaxell@gmail.com>
Content-Type: multipart/alternative; boundary=001a1134800e13a794051dfb56cf
Subject: Re: [PHP-DEV] [RFC] [Discuss] Random Functions Throwing Exceptions in
 PHP 7.0.0
From: me@kelunik.com (Niklas Keller)

--001a1134800e13a794051dfb56cf
Content-Type: text/plain; charset=UTF-8

>
> why not have false + e_warning for strict_types=0 and fatal error for
> strict_types=1 ?
> Doing function random_int(): int { ...


How's this connected to `strict_types`? It's not.

If people use this function without reading documentation, they will also
> use other things without documentation like database queries without
> binding/escaping, inject html without escaping, etc.
> Having core functions suddenly throw exceptions causes many problems in
> the code structure.


How are these things connected? How does this create any issues in any
existing code structure? This RFC affects only two new functions introduced
in PHP 7.

I think there are a lot of security problems if people ignore return
> values, e.g. password comparison, user lookup in database, lookups for
> permissions, etc.


You compare an edge case, where these two functions currently return false
instead of throwing an exception to fail closed, to functions with an
expected `true|false` return value.

This change is especially important, because these functions may be used in
a way like this, as already mentioned in the previous discussions:

for ($i = 0; $i < 10; $i++) {
    $result .= $values[random_int(0, 10)];
}

It's simply far too easy to make mistakes in security relevant code.

Regards, Niklas

--001a1134800e13a794051dfb56cf--