Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:95780
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.66 as permitted sender)
References: <CAGa2bXarw2jTj0yhXpywWNQOJLR2pdhfaqSdwj_btT2giEL15Q@mail.gmail.com>
 <CAGa2bXaA+uvh_wpRAHeiv+Xb-JOrTAkyoe3jzq3FVCEbfja_5w@mail.gmail.com>
 <232F1604-2211-4351-B830-EDC958A25D6D@strojny.net>
 <CAGa2bXb2y4afY28rwdcjgxUEkr41ZPMMdj4dUtMDVtJLBONAbA@mail.gmail.com>
 <2de35db0-9974-cc96-83dd-3d2dbd48f7f8@lsces.co.uk>
 <CAGa2bXYG1Or9+SGf3Rm4Yi5KUQ1mwnffTSSzuwARpy4bFfXB=w@mail.gmail.com>
 <5b72e9da-068a-bc79-82c2-f36f723f42bb@gmail.com>
 <CAGa2bXa+9raNXmg90rsfi+yt_9HMBtWXWORy3f_014Teg+CcBg@mail.gmail.com>
 <eaa51c8d-74b2-9ee8-da4a-045480b45993@gmail.com>
 <CAGa2bXYvJVkUAGVv7NypxYvkGQSTM00gDOVK+kb-OVYNkNVrVA@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <a13c876f-90b4-3020-2553-fd5a55f55997@gmail.com>
Date: Thu, 8 Sep 2016 10:02:33 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYvJVkUAGVv7NypxYvkGQSTM00gDOVK+kb-OVYNkNVrVA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][VOTE] Add validation functions to filter module
From: rowan.collins@gmail.com (Rowan Collins)

On 08/09/2016 09:28, Yasuo Ohgaki wrote:
> This might be the largest difference.
>
> To make something secure than it is now, adding additional security
> layer is effective, not single location/code.

My instinct is that this extra location would be a maintenance 
nightmare, as it would need to keep up with changes elsewhere in the 
application. In day to day use, what would make this extra security 
layer any more likely to be comprehensively maintained than the existing 
validation layer?


> Suppose we have validation module. You are suggesting something like
>
> $int = validate_int($var, $min, $max);
> $bool = validate_bool($var, $allowed_bool_types);
> // i.e. which type of bool 1/0, yes/no, on/off, true/false is allowed
> // This isn't implemented. All of them are valid bools currently.
> $str = validate_string($var, $min_len, $max_len);
> $str = validate_string_encoding($var, $encoding);
> $str = validate_string_chars($var, $allowed_chars);
> $str = validate_string_regex($var, $regex);
> $str = validate_string_degit($var, $min_len, $max_len);
> $str = validate_string_callback($var, $callback);

No, I'm suggesting something like:

if (
	! validate_int($var, $min, $max)
	|| ! validate_bool($var, $allowed_bool_types)
	|| ! validate_string($var, $min_len, $max_len)
	|| ! validate_string_encoding($var, $encoding)
	|| ! validate_string_chars($var, $allowed_chars)
	|| ! validate_string_regex($var, $regex)
	|| ! validate_string_degit($var, $min_len, $max_len)
	|| ! $callback($var) // Note: no need to wrap this callback, it's just 
a boolean-returning function
)
{
// ERROR
}

It was a deliberately narrow purpose as an example, but IMHO that's 
perfectly readable, and the focus of the module would be on creating a 
good set of validation rules, rather than worrying about how they're 
applied.


> [...] Rule reuse and centralizing validation rule is easy.

The language provides us plenty of ways to reuse code. For instance:

function validate_my_field($var) {
	return
		validate_int($var, $min, $max)
		&& validate_bool($var, $allowed_bool_types)
		// etc
}


Regards,
-- 
Rowan Collins
[IMSoP]