Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:88214
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain craigfrancis.co.uk designates 209.85.212.178 as permitted sender)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
In-Reply-To: <BLU437-SMTP66DB73C07E0C570EC13C4CE95D0@phx.gbl>
Date: Tue, 15 Sep 2015 16:09:00 +0100
Cc: Kalle Sommer Nielsen <kalle@php.net>,
 Internals <internals@lists.php.net>,
 wietse@porcupine.org,
 laruence@php.net
Content-Transfer-Encoding: quoted-printable
Message-ID: <EBCBA455-F469-4D2A-B21A-B6EA3CE4FAEB@craigfrancis.co.uk>
References: <BLU437-SMTP762BF68D5F013E39BF6AC6E95D0@phx.gbl> <CAJW__o3mCdAdm=jaLpLCSpWC4ekmc98CszcUKNr98qu5JgZBeQ@mail.gmail.com> <BLU437-SMTP66DB73C07E0C570EC13C4CE95D0@phx.gbl>
To: Christopher Owen <christopher.owen@live.com>
Subject: Re: [PHP-DEV] taint
From: craig@craigfrancis.co.uk (Craig Francis)

2015-09-14 4:44 GMT+02:00 Christopher Owen <christopher.owen@live.com>:
> Please consider making =91taint=92 a first-class feature/extension in =
PHP 7.0.


I would echo Kalle's suggestion of 7.1.

But I think you will find it hard to get support... I was pushing this a =
few weeks ago (either the one from Wietse Venema, the one from Matt =
Tait, or even my own suggestion), but it seems the developers are more =
interested in features that make them seem cleaver, rather than pointing =
out their mistakes...

And yes, I am intentionally trying to be provocative.

I'm annoyed that so much time was spent on type hinting, just so we can =
enforce [bool/float/int/string], yet most of the time it is the encoding =
of strings that introduces security problems - not just SQLi, but also =
things like XSS.

Craig





On 14 Sep 2015, at 22:17, Christopher Owen <christopher.owen@live.com> =
wrote:

>=20
>> On Sep 14, 2015, at 1:35 PM, Kalle Sommer Nielsen <kalle@php.net> =
wrote:
>>=20
>> Hi Christopher
>>=20
>> 2015-09-14 4:44 GMT+02:00 Christopher Owen =
<christopher.owen@live.com>:
>>> Please consider making =91taint=92 a first-class feature/extension =
in PHP 7.0.
>>=20
>> It is way too late for any extension to be included in the 7.0 =
release
>> now, but you can write an RFC targetting 7.1, please see the wiki for
>> more details[1].
>=20
> Thank you for the advice; it makes much more sense to target 7.1.
>=20
> We can see that Wietse Venema; the same man who wrote the highly =
regarded, security hardened email software Postfix; has authored an RFC =
for taint's inclusion to PHP the past [1].  Also, a reference =
implementation has been most recently championed by Xinchen (Laruence) =
Hui, a core php developer [2].
>=20
> Given those that came before me, I=92m not certain that I can add much =
in the way of reputation or skill to the request to add taint as a =
first-class feature of PHP 7.1, but if there are any procedural efforts =
required then I will be happy to champion them.
>=20
> I can add that I have personally found taint (either in its original =
form in perl[3] or as an extension in php) a valuable tool in =
refactoring legacy php code to reduce SQL injection attack surface.
>=20
> As authorative internet =91top ten=92 lists will list SQL injection as =
the number one security vulnerability facing web applications [4] and =
given the scale of deployed php, efforts to improve tooling (or in this =
case, the availability of existing tooling) to discover this class of =
vulnerabilities will have a positive impact on a global scale.
>=20
> Kind regards,
> Christopher Owen.
>=20
> [1] https://wiki.php.net/rfc/taint <https://wiki.php.net/rfc/taint>
> [2] http://pecl.php.net/package/taint =
<http://pecl.php.net/package/taint>=20
> [3] http://perldoc.perl.org/perlsec.html#Taint-mode =
<http://perldoc.perl.org/perlsec.html#Taint-mode>
> [4] =
http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202013.pdf =
<http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202013.pdf>