Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91962
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.47 as permitted sender)
To: Daniel Beardsley <daniel@ifixit.com>,
 Jesse Schalken <me@jesseschalken.com>
References: <CACNm7o9-6z0rxAAxnWyUFhYU+YD-QnecWrJF-PQ=z+a9qNQ=EA@mail.gmail.com>
 <CAESVnVprfe-0n7kq5JdoW3jVsb1jLZ+MSenQbZZJKjAXJh6NDA@mail.gmail.com>
 <CACNm7o8ahmP0GdiZmd_BPVa1jvA_bZz4oVY-krMgcq_P6LpzGg@mail.gmail.com>
 <CAF1yvAS3Oh_vp37q0xbQ-E-ZPfLn0c2EAEDjihqOtuq-HgZ5AQ@mail.gmail.com>
 <CACNm7o-_XFF57AR7R2J-rGfRn_jn9ott=8YLq1TkwcM1OrK4HQ@mail.gmail.com>
Cc: Sara Golemon <pollita@php.net>, PHP internals <internals@lists.php.net>
Message-ID: <56F734FC.5000400@gmail.com>
Date: Sat, 26 Mar 2016 18:18:52 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.7.1
MIME-Version: 1.0
In-Reply-To: <CACNm7o-_XFF57AR7R2J-rGfRn_jn9ott=8YLq1TkwcM1OrK4HQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] RFC about automatic template escaping
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> True, but the difference is that safety is the default instead of
> the exception. Every system has an assumption. It's better that

This sounds as the major assumption is there's some procedure ("the
safety") that allows to render any output safe. This could not be more
wrong. Escaping is highly context-dependent, and without knowing
specific details of the context it is impossible to do proper escaping.
I do not see how by setting one flag you could provide proper context.
Moreover, one template may include multiple contexts.

> I'm sorry, I wasn't clear in the RFC. This feature is meant to only be
> turned on during template rendering (imagine you have a Template
> class):

I think there's assumption here templates only exist in one context or
at least allow user data only in one context. This is not true, of
course. But if it were true, this code would be trivial to make safe:

> function render() {
>    set_ini('__auto_escape', 1);
>    require $this->templatePath;
>    set_ini('__auto_escape', 0);
> }

function render() {
   ob_start();
   require $this->templatePath;
   echo magic_security_filter(ob_get_clean());
}

-- 
Stas Malyshev
smalyshev@gmail.com