Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91806
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ifixit.com designates 173.203.6.139 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbjNQXwVsFmGgFVUPCFV-t2Tye+xA3MDNpA_ydjvCQ3jA@mail.gmail.com>
References: <CACNm7o9-6z0rxAAxnWyUFhYU+YD-QnecWrJF-PQ=z+a9qNQ=EA@mail.gmail.com>
 <CAGa2bXbjNQXwVsFmGgFVUPCFV-t2Tye+xA3MDNpA_ydjvCQ3jA@mail.gmail.com>
Date: Sun, 20 Mar 2016 23:35:46 -0700
Message-ID: <CACNm7o9NNVFrgqeufBoDgyhE-eGQix6bZwq=XGVwsROSXVb5Ag@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] RFC about automatic template escaping
From: daniel@ifixit.com (Daniel Beardsley)

> Issue is "Escaping is done on a specific context".
>
> I understand your proposal is focused on HTML escaping. However,
> setting names like
> __auto_escape_exempt_class
> is not good choice. It has to be
> __auto_html_escape_exempt_class
> at least because it is for HTML escaping.

Yes, the ini settings have poor names and can totally be changed.

> In addition, HTML consists of multiple contexts
>
>  - HTML context that requires HTML escape
>  - URI context that requires URI escape
>  - JavaScript context, embedded JavaScript strings for example , that
>    requires JavaScript string escape, etc.
>    e.g. http://blog.ohgaki.net/javascript-string-escape (Sorry. It's
>    my blog and written in Japanese.
>    You may try translation service or you should be able to understand
>    PHP code at least)
>  - CSS context that requires CSS escape.
>    e.g. https://developer.mozilla.org/ja/docs/Web/API/CSS/escape
>  - And so on

You are right. Though not all those problems are serious:
* HTML attributes:
  Use ENT_QUOTES so that content is escaped well enough
  for use in quoted attributes (still need quotes though)
* URI escaping:
  Does anyone really use <?= ?> or echo when generating a uri?
* Javascript:
  Good point, though I would say it's fairly rare to create javascript
  code using a php template with variables. The most we ever do
  in our app is  <?= json_encode($someArray) ?>
* Eveything else:
  I think the better solution here is to simply let the user control this.
  Provide an ini setting that allows a custom output function to be set
  so the user could control what happens to unsafe strings and what
  the exemptions are. I'm considering doing this. This was html-only
  at the beginning because we only created this for html templates
  and were able to call the internal php functions directly, ginving
  us nearly no performance penalty.

>
> Dealing HTML context only would be problematic even if it works for many cases.
>
> Escaping must be done depends on context. Multiple contexts may apply
> also. HTML context only escaping would not work well.. Applying proper
> escapes to variables in HTML is very complex task..
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net