Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:89514
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.48 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CA+9eiLsK-eY-w7j21zjFQUsYbNCih3o6kOW5wmcq9G0QxajWeQ@mail.gmail.com>
References: <CAF+90c_pVFVbzqThuPg1V3VDTV-7Ci4O6T6hNtY5XPgVb2Mt-Q@mail.gmail.com>
	<CA+9eiLsK-eY-w7j21zjFQUsYbNCih3o6kOW5wmcq9G0QxajWeQ@mail.gmail.com>
Date: Tue, 1 Dec 2015 23:40:56 +0700
Message-ID: <CAEZPtU5cm8vqq3N1LzWATsx44ysTAwAwpRPRsy1UGGDA4nsPzg@mail.gmail.com>
To: Dmitry Stogov <dmitry@zend.com>
Cc: Remi Collet <remi@php.net>, Anatol Belski <anatol.php@belski.net>, 
	Nikita Popov <nikita.ppv@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c2665074431f0525d8d2c6
Subject: Re: [PHP-DEV] HashDos protection
From: pierre.php@gmail.com (Pierre Joye)

--001a11c2665074431f0525d8d2c6
Content-Type: text/plain; charset=UTF-8

On Dec 1, 2015 4:50 PM, "Dmitry Stogov" <dmitry@zend.com> wrote:
>

> I think only big arrays coming from external sources should be checked.

I tend to agree here.

We discussed it with Remote last week. I was trying to explain why having a
crafted hash function for inputs may be better and safer. That includes
get/post/env/serialize/json and the likes.

The performance impact for these is most likely minimal for only them while
ensuring a better protection from a long term point of view.

I may be wrong and did not think much more than brainstorming about it. So
take it with a bit of salt :)

--001a11c2665074431f0525d8d2c6--