Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:88638
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain craigfrancis.co.uk designates 209.85.212.174 as permitted sender)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
In-Reply-To: <55F978FE.90908@cubiclesoft.com>
Date: Fri, 2 Oct 2015 10:42:03 +0100
Cc: Internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <827FEAD0-30B5-45AB-B7D7-93E4C6611BE5@craigfrancis.co.uk>
References: <BLU437-SMTP762BF68D5F013E39BF6AC6E95D0@phx.gbl> <CAJW__o3mCdAdm=jaLpLCSpWC4ekmc98CszcUKNr98qu5JgZBeQ@mail.gmail.com> <BLU437-SMTP66DB73C07E0C570EC13C4CE95D0@phx.gbl> <EBCBA455-F469-4D2A-B21A-B6EA3CE4FAEB@craigfrancis.co.uk> <55F842FE.6080502@dennis.birkholz.biz> <55F978FE.90908@cubiclesoft.com>
To: Thomas Hruska <thruska@cubiclesoft.com>
Subject: Re: [PHP-DEV] taint
From: craig@craigfrancis.co.uk (Craig Francis)

Just to add to the white/black listing argument...

I would say that tainting is a whitelist approach, as everything is =
blocked by default (seen as untainted), and you need to escape your =
variables depending on the context they will be used in (or go out of =
your way to say it has already been escaped, for the rare edge cases =
mentioned in previous discussions).



On 16 Sep 2015, at 15:13, Thomas Hruska <thruska@cubiclesoft.com> wrote:
> As a side note, preg_match() is my current favorite blacklist =
indicator of "code with probable security vulnerabilities."


I completely disagree, preg_match can work in both ways, it can do white =
or black listing, as Anthony demonstrated:

if (preg_match('/^[a-z0-9]+$/', $input)) {
}

That white lists only certain characters, anything else won't match.

Craig






On 16 Sep 2015, at 15:13, Thomas Hruska <thruska@cubiclesoft.com> wrote:

> On 9/15/2015 9:10 AM, Dennis Birkholz wrote:
>> Hi all,
>>=20
>> Am 15.09.2015 um 17:09 schrieb Craig Francis:
>>> 2015-09-14 4:44 GMT+02:00 Christopher Owen =
<christopher.owen@live.com>:
>>>> Please consider making =91taint=92 a first-class feature/extension =
in PHP 7.0.
>>>=20
>>> I would echo Kalle's suggestion of 7.1.
>>>=20
>>> But I think you will find it hard to get support... I was pushing =
this a few weeks ago (either the one from Wietse Venema, the one from =
Matt Tait, or even my own suggestion), but it seems the developers are =
more interested in features that make them seem cleaver, rather than =
pointing out their mistakes...
>>=20
>> the problem with taint support is to get it 100% right. If you leave =
one
>> edge case open, who is to blame? PHP or the developer that was =
totally
>> confident the taint support might warn him?
>=20
> You can grab the following four paragraphs and add it to whatever =
documentation on taint you might use.
>=20
> =3D=3D8<--------------------------
> Taint is blacklisting.
>=20
> Blacklisting, in and of itself and regardless of the form it takes, is =
an immediate indicator of an application that is prone to security =
vulnerabilities and/or breakage that can lead to a vulnerability.
>=20
> With extraordinarily rare exceptions, blacklists are never 100% =
correct.  Even if it can manage to reach 100% accuracy today, a =
blacklist will be out of date tomorrow due to advances in the field.
>=20
> While writing software being paired with a blacklist such as taint, =
performing an appropriate security audit of the software is the only =
truly effective approach to securing that software.
> =3D=3D=3D=3D8<------------------------
>=20
> Problem solved.  Also, those are ASCII scissors (in case anyone is =
wondering).
>=20
> As a side note, preg_match() is my current favorite blacklist =
indicator of "code with probable security vulnerabilities."  If taint is =
added to PHP without a suitable caveat lector, it merely adds another =
tool to my psychological profiling arsenal.
>=20
> --=20
> Thomas Hruska
> CubicleSoft President
>=20
> I've got great, time saving software that you will find useful.
>=20
> http://cubiclesoft.com/
>=20
> --=20
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>=20