Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:88576
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain zend.com designates 209.85.213.47 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <55F9B6D6.9040806@gmail.com>
References: <BLU437-SMTP762BF68D5F013E39BF6AC6E95D0@phx.gbl>
 <CAJW__o3mCdAdm=jaLpLCSpWC4ekmc98CszcUKNr98qu5JgZBeQ@mail.gmail.com>
 <BLU437-SMTP66DB73C07E0C570EC13C4CE95D0@phx.gbl> <EBCBA455-F469-4D2A-B21A-B6EA3CE4FAEB@craigfrancis.co.uk>
 <55F842FE.6080502@dennis.birkholz.biz> <55F978FE.90908@cubiclesoft.com>
 <55F97ECF.3060006@sektioneins.de> <55F9B6D6.9040806@gmail.com>
Date: Wed, 30 Sep 2015 12:19:39 +0800
Message-ID: <CABBJUpdbW3An0p_Fs_QNGgaPr4A1ju4P-hjkevaoYrhYcXP9Xg@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Stefan Esser <stefan.esser@sektioneins.de>, PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] taint
From: laruence@php.net (Xinchen Hui)

Hey:

On Thu, Sep 17, 2015 at 2:37 AM, Stanislav Malyshev <smalyshev@gmail.com> wrote:
> Hi!
>
>>> Taint is blacklisting.
>>>
>> Last time I checked marking all user input as tainted and requiring
>> "untainting" before usage in sensitive functions is whitelisting and not
>> blacklisting.
>
> I would say it's neither - whitelisting is an explicit check (or fixing,
> to ensure) that the input matches certain conditions (blacklisting is
> the same but "does not match") - but taint actually doesn't do that. All
> it does is ensure you did *some* data fixing - it can't really ensure
> *what* you did, what were the results of the fixing and if the fixing
> you employed match the security context in which you are using the data.
> So taint does only the half of the work of either blacklist or whitelist
> - it ensures you didn't forget to do _something_, where something could
> be white-list. Or be something useless at all. That's the main thing one
> needs to remember when using taint - it doesn't do any work, it just
> reminds you to do work, and you still have to ensure the work is right.


Just for the record , Taint is ready for PHP7:
https://github.com/laruence/taint/tree/php7

thanks
> --
> Stas Malyshev
> smalyshev@gmail.com
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php



-- 
Xinchen Hui
@Laruence
http://www.laruence.com/