Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93377
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAF+90c-xkT6G0yYHOBZ8vGpdxMNvNsu11CSQoiPwjDqB+EtsVw@mail.gmail.com>
References: <CAF+90c-xkT6G0yYHOBZ8vGpdxMNvNsu11CSQoiPwjDqB+EtsVw@mail.gmail.com>
Date: Tue, 17 May 2016 16:33:56 +0200
Message-ID: <CAF+90c_EPx-zq37W+Oj++pALZHAKYFRBY7vdoLFZVAtQDm2DeA@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1142d7be89480d05330aa1cb
Subject: Re: [VOTE] Forbid dynamic calls to scope introspection functions
From: nikita.ppv@gmail.com (Nikita Popov)

--001a1142d7be89480d05330aa1cb
Content-Type: text/plain; charset=UTF-8

On Sun, May 15, 2016 at 10:46 PM, Nikita Popov <nikita.ppv@gmail.com> wrote:

> Hi internals,
>
> The RFC
>
>     https://wiki.php.net/rfc/forbid_dynamic_scope_introspection
>
> is now in voting. The vote closes on 2016-05-24 with a required majority
> of 2/3.
>
> Nikita
>

Thanks to a comment on Reddit, I realized that the function list in the RFC
is missing "assert() with a string argument" as a forbidden function. The
reason is that assert() with a string is really just a different way of
saying eval() -- so it will inherit the parent symbol table and may modify
it. I missed this because the function was also missing from the opcache
indirect var access list (remedied in [1]).

I hope it's not a problem to add this case to the RFC even though it's
already in voting.

Nikita

[1]:
https://github.com/php/php-src/commit/b65b15c6f470cc3397ff7719d92cecc762c803e9

--001a1142d7be89480d05330aa1cb--