Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96693
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <1079b404-e133-685f-9a22-ff7444da04f5@gmail.com>
References: <1ae4bea0-d62b-fd61-f6b6-55762e97df6e@gmail.com>
 <017b01d22dfc$cbead8e0$63c08aa0$@belski.net> <1079b404-e133-685f-9a22-ff7444da04f5@gmail.com>
Date: Tue, 1 Nov 2016 10:32:10 +0100
Message-ID: <CAF+90c9ZVd40pX1R6t3EVzFE9tFPDMhHbGzBSoiYG9S_RcqaWg@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Anatol Belski <anatol.php@belski.net>, PHP Internals <internals@lists.php.net>, 
	Remi Collet <remi@fedoraproject.org>
Content-Type: multipart/alternative; boundary=001a1141cf7ab547ec054039ff52
Subject: Re: [PHP-DEV] bug classification discussion
From: nikita.ppv@gmail.com (Nikita Popov)

--001a1141cf7ab547ec054039ff52
Content-Type: text/plain; charset=UTF-8

On Sun, Oct 30, 2016 at 6:21 AM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> Hi!
>
> So I wrote a first version of the document Anatol mentioned:
>
> https://wiki.php.net/security
>
> Please comment. Fixes to the grammar and typos are especially welcome
> (you can just do them in the wiki without asking :)
>

It would be nice to add specific examples (e.g. the string overflow case to
low).

I'm also wondering under which category unserialize() issues would
(usually) fall. I'd assume "low" (because requires documented insecure code
+ well known class of vulnerabilities).

Nikita

--001a1141cf7ab547ec054039ff52--