Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94141
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEDdnaXG1MFXhXDpYt97Jn0aNKZ0+Rjw8O4OFSMOXmNxiaigGg@mail.gmail.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <b9318b90-f850-12a2-459d-8995220922df@gmail.com> <20160617202344.2868F1A80C02@dd1730.kasserver.com>
 <CAObuZdvZoACWE1bxz2PUMW+yXHxyEtXuYpPXL=6dEqrsakSNBQ@mail.gmail.com>
 <CADqTB_ijxN_ZVcAdLrpnejtYNO2x6Z1Q4PcnARCRE+etDuhF3w@mail.gmail.com>
 <CANUQDCjgSohsYWmkWOLfdL+9Jzio_uY-vnYVc4fzd6kmGaL46g@mail.gmail.com>
 <CADyq6sJmj=bnN+65-59UrsJuuc8dYxP3HPqNOktjnRFexcFVWA@mail.gmail.com>
 <CAEDdnaUz3_6sVN07G+KF15B0avDoTV85UiR1mLie-F3orMrUog@mail.gmail.com>
 <57665E36.60302@lsces.co.uk> <CADyq6sKPDtC5Q=OV7D5qQF2W6XgJCyKXpatU0KB=StveXA8pdw@mail.gmail.com>
 <5766D311.6030503@lsces.co.uk> <CAKws9z3UyQxiXpC8Jbv5tf6guzn+pgdp76B49ZsUdS08s-Jtaw@mail.gmail.com>
 <CAMPTd_A86iCrytrHwp87GyjLU8FX+BbLsdREOpNfUc=_McRMow@mail.gmail.com>
 <CAEDdnaUi5hvOAkkPWWk3YVNxMjsCbntB-W70a8sPXFkKHJGY8w@mail.gmail.com>
 <CAMPTd_DADkueRwN9AR0VNtGWg+Q58ab7JR=7meaj7fTohGZsww@mail.gmail.com> <CAEDdnaXG1MFXhXDpYt97Jn0aNKZ0+Rjw8O4OFSMOXmNxiaigGg@mail.gmail.com>
Date: Sun, 19 Jun 2016 20:30:17 -0700
Message-ID: <CAMPTd_A6YzDDenDp+twULMPRbKRhw408m=XifiRWnC=RG4dxHw@mail.gmail.com>
To: =?UTF-8?B?0JzQuNGF0LDQuNC7INCS0L7RgdGC0YDQuNC60L7Qsg==?= <michael.vostrikov@gmail.com>
Cc: Scott Arciszewski <scott@paragonie.com>, Lester Caine <lester@lsces.co.uk>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=94eb2c094fb8d178180535ad526a
Subject: Re: [PHP-DEV] New escaped output operator
From: walterp@gmail.com (Walter Parker)

--94eb2c094fb8d178180535ad526a
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Good, then we do agree, as what I said was what I DID NOT want to see in
the documentation.

This should be documented as shortcut for <? echo htmlspecialchars(string)
?>. It should be further pointed out that while this will be useful in
catching many XSS and other HTML issues, it will not catch all of them, so
care and attention to proper data hygiene is still required.


Walter

On Sun, Jun 19, 2016 at 8:22 PM, =D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB =D0=
=92=D0=BE=D1=81=D1=82=D1=80=D0=B8=D0=BA=D0=BE=D0=B2 <
michael.vostrikov@gmail.com> wrote:

> > "Use '<?~' and it will solve your XSS and other escaping problems with
> outputting HTML that was stored in a DB."
> I don't think this is a good phrase for documentation. This form should b=
e
> considered exactly as htmlspecialchars, with taking into account any
> language and encoding-specific issues, and this should be pointed in
> documentation. This is a shorcut for often operation, like '??' for isset=
()
> check. And it can really improve security, not in 90% but about 99.9999%
> cases.
>
> 2016-06-20 4:41 GMT+05:00 Walter Parker <walterp@gmail.com>:
>
>>
>>>
>>> > where getting it 90% correct is worse that not doing anything at all.
>>> > Things like this will cause people to be blindsided when the uncaught
>>> escapes
>>> > cause the next major security problem.
>>>
>>> Why do you think so? What real problems can happen if there will be a
>>> short operator for htmlspecialchars()?
>>>
>>> What could happen is this getting sold/documented as a general purpose
>> security feature:
>> "Use '<?~' and it will solve your XSS and other escaping problems with
>> outputting HTML that was stored in a DB."  What it solves is a subset,
>> which is escaping characters stored in a data that have special meanings=
 to
>> HTML. My concern is that the remain security issues might get overlooked=
 or
>> ignored because '<?~' is considered good enough. There are issues with
>> htmlspecialchars, UTF-8 and certain language-specific characters (non
>> English). There were also issues with quotes in the past.
>>
>>
>> Walter
>>
>
>


--=20
The greatest dangers to liberty lurk in insidious encroachment by men of
zeal, well-meaning but without understanding.   -- Justice Louis D. Brandei=
s

--94eb2c094fb8d178180535ad526a--