Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:98885
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: softfail (pb1.pair.com: domain golemon.com does not designate 74.125.82.52 as permitted sender)
MIME-Version: 1.0
Sender: php@golemon.com
In-Reply-To: <HE1PR02MB1052240627526DA3B3488E8CBA110@HE1PR02MB1052.eurprd02.prod.outlook.com>
References: <CAESVnVpGoG45bBGfcYaDKb-A1k33VEwcK_GX5_TS6JHj0Dve1w@mail.gmail.com>
 <HE1PR02MB10520E2CB090D9991CAAF03CBA1D0@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <HE1PR02MB1052EF95B19C9FC41D4DFD72BA1E0@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <CAESVnVqpFUMc0nq1Zt+r=gHApDJ_Jv7RU3n1MiUpe-wwQ-27pg@mail.gmail.com> <HE1PR02MB1052240627526DA3B3488E8CBA110@HE1PR02MB1052.eurprd02.prod.outlook.com>
Date: Wed, 26 Apr 2017 10:34:44 -0500
Message-ID: <CAESVnVqG_uoacRxK41RBEU7K-n_si_pB0Yu3j3W3YQXMwxpMfA@mail.gmail.com>
To: Anatol Belski <ab@php.net>
Cc: PHP internals <internals@lists.php.net>, Joe Watkins <krakjoe@php.net>, 
	Davey Shafik <davey@php.net>, Remi Collet <remi@php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] On malformed transport strings
From: pollita@php.net (Sara Golemon)

On Wed, Apr 26, 2017 at 6:20 AM, Anatol Belski <ab@php.net> wrote:
> Thanks for this additional check. My action was actually based on the com=
ment with the patch link, looks like the situation has now changed a bit. W=
e're still quite limited in choice in this case. For one, there's a low sec=
urity impact, however the fix uncovered several inconsistent places breachi=
ng apps. For what it matters, there are already 2-3 dups regarding mysqli a=
nd stream client regressions. Given they come so short in time, that's not =
a good sign. Though, the reports still came late enough, that an appropriat=
e fix could not be done  before the next RC.
>
The fact that there are dups tells me that, despite the fact that
bab0b99f3 made into 7.0.18/7.1.4 releases, we should fully revert the
hard error (leaving a soft warning behind).  The security implications
of the original fix are fairly minor* compared to the much larger
regression of actually breaking sites which otherwise worked before.

> In the end, after evaluating the situation, I would still suggest to keep=
 your follow up fix as a temporary solution in the next release. This way a=
t least one issue is fixed, the stream client, while the initial patch is a=
 bit slackened. A better fix can be worked out till the follow up release, =
also targeting the mysqli regression which still persists. This way, one re=
gression is fixed, the initial patch is weakened a bit but as the impact wa=
s low - it's something one can temporarily live with, and a good solution w=
ere to expect in the next possible future. An alternative were to revert th=
e hotfix in the final and keep the regressions.
>
Given that there *is* a release with bab0b99f3 in it, I suppose we're
already regressed and a little clowny looking.  7.0 is your branch, so
if you're cool with some uses still being slightly borky, then so am
I.  I'll do up some diffs for 7.0.20/7.1.6 to downgrade the hard
errors to warnings (keep it hard error for 7.2.0) and address issues
like the mysqli_connect implicit port duplication.

-Sara