Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:95810
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <eac08ffa-2b09-526e-1c08-3441c0b670f4@lsces.co.uk>
References: <CAGa2bXarw2jTj0yhXpywWNQOJLR2pdhfaqSdwj_btT2giEL15Q@mail.gmail.com>
 <CAGa2bXaA+uvh_wpRAHeiv+Xb-JOrTAkyoe3jzq3FVCEbfja_5w@mail.gmail.com>
 <232F1604-2211-4351-B830-EDC958A25D6D@strojny.net> <CAGa2bXb2y4afY28rwdcjgxUEkr41ZPMMdj4dUtMDVtJLBONAbA@mail.gmail.com>
 <2de35db0-9974-cc96-83dd-3d2dbd48f7f8@lsces.co.uk> <CAGa2bXYG1Or9+SGf3Rm4Yi5KUQ1mwnffTSSzuwARpy4bFfXB=w@mail.gmail.com>
 <5b72e9da-068a-bc79-82c2-f36f723f42bb@gmail.com> <CAGa2bXa+9raNXmg90rsfi+yt_9HMBtWXWORy3f_014Teg+CcBg@mail.gmail.com>
 <eaa51c8d-74b2-9ee8-da4a-045480b45993@gmail.com> <CAGa2bXYvJVkUAGVv7NypxYvkGQSTM00gDOVK+kb-OVYNkNVrVA@mail.gmail.com>
 <a13c876f-90b4-3020-2553-fd5a55f55997@gmail.com> <eac08ffa-2b09-526e-1c08-3441c0b670f4@lsces.co.uk>
Date: Fri, 9 Sep 2016 06:47:22 +0900
Message-ID: <CAGa2bXaaT3pLMUBiYnZ_cfYUqZOFtNkuAR9wM2mbEW9g46MRyA@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][VOTE] Add validation functions to filter module
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Lester,

On Thu, Sep 8, 2016 at 8:08 PM, Lester Caine <lester@lsces.co.uk> wrote:
> On 08/09/16 10:02, Rowan Collins wrote:
>> No, I'm suggesting something like:
>>
>> if (
>>     ! validate_int($var, $min, $max)
>>     || ! validate_bool($var, $allowed_bool_types)
>>     || ! validate_string($var, $min_len, $max_len)
>>     || ! validate_string_encoding($var, $encoding)
>>     || ! validate_string_chars($var, $allowed_chars)
>>     || ! validate_string_regex($var, $regex)
>>     || ! validate_string_degit($var, $min_len, $max_len)
>>     || ! $callback($var) // Note: no need to wrap this callback, it's
>> just a boolean-returning function
>
> And I am looking for some way of packaging that into something I can
> read and write dynamically for each $var ...

This could be done by convention rather than configuration.
You need some rule for variable names. If var name is ID, it must be
numeric string always for example.

Convention is developer defined rule, so this is left to developer how to
do it.

> $var->set_validation_rules($rules); And $rules is going to be an array
> of items which can then be used for related parallel activities such as
> populating the browser validation.
>
> So the above script is replaced by $var->is_valid(); or if you prefer it
> throws an exception when you try and set the variable with an invalid
> input ( or one that does not match a 'strict' rule ).

I think convention rather than configuration works. However, not all checks
should/can be done by model because model treats data related to the
model leave other vars behind. Leftover could be cause of vulnerabilities.

IIRC, Magento had vulnerability that allows malicious access  due to
internal redirects. This kind of problem can be mitigated by strict
input validation at the time inputs are accepted.

Anyway, your way would work with autoboxing.
https://wiki.php.net/rfc/autoboxing
and this proposal.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net