Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93490
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.173 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAF+90c_EPx-zq37W+Oj++pALZHAKYFRBY7vdoLFZVAtQDm2DeA@mail.gmail.com>
References: <CAF+90c-xkT6G0yYHOBZ8vGpdxMNvNsu11CSQoiPwjDqB+EtsVw@mail.gmail.com>
	<CAF+90c_EPx-zq37W+Oj++pALZHAKYFRBY7vdoLFZVAtQDm2DeA@mail.gmail.com>
Date: Tue, 24 May 2016 20:54:50 +0200
Message-ID: <CAF+90c-n5+8APiPa+YkZuopuJcMKSkW2Pdp96EbuQ8MiQBRNLQ@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=94eb2c0a87567abee205339b1788
Subject: Re: [VOTE] Forbid dynamic calls to scope introspection functions
From: nikita.ppv@gmail.com (Nikita Popov)

--94eb2c0a87567abee205339b1788
Content-Type: text/plain; charset=UTF-8

On Tue, May 17, 2016 at 4:33 PM, Nikita Popov <nikita.ppv@gmail.com> wrote:

> On Sun, May 15, 2016 at 10:46 PM, Nikita Popov <nikita.ppv@gmail.com>
> wrote:
>
>> Hi internals,
>>
>> The RFC
>>
>>     https://wiki.php.net/rfc/forbid_dynamic_scope_introspection
>>
>> is now in voting. The vote closes on 2016-05-24 with a required majority
>> of 2/3.
>>
>> Nikita
>>
>
> Thanks to a comment on Reddit, I realized that the function list in the
> RFC is missing "assert() with a string argument" as a forbidden function.
> The reason is that assert() with a string is really just a different way of
> saying eval() -- so it will inherit the parent symbol table and may modify
> it. I missed this because the function was also missing from the opcache
> indirect var access list (remedied in [1]).
>
> I hope it's not a problem to add this case to the RFC even though it's
> already in voting.
>
> Nikita
>
> [1]:
> https://github.com/php/php-src/commit/b65b15c6f470cc3397ff7719d92cecc762c803e9
>

The RFC has been accepted with 39 votes in favor and one against. The
implementation has landed in [1]. As mentioned previously, assert() with a
string argument (aka eval) is also part of the final implementation.

Nikita

[1]:
https://github.com/php/php-src/commit/91f5940329fede8a26b64e99d4d6d858fe8654cc

--94eb2c0a87567abee205339b1788--