# Run-time taint support proposal

- Thread: https://externals.io/message/27020
- Original archive: https://news-web.php.net/php.internals/27020
- Started by Jordan Moore on 2006-12-16T01:12:30+00:00
- Messages: 3
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #27020 — Jordan Moore — 2006-12-16T01:12:30+00:00

URL: https://externals.io/message/27020#27020

So, what if an ISP (webhost) enables taint functionality, and a
developer uses a PHP library that uses custom filter functions for
filtering data. Will this developer see messages displayed on his PHP
application even though filtering is being done?

Jordan

---

## #27026 — Richard Lynch — 2006-12-16T01:30:05+00:00

URL: https://externals.io/message/27020#27026 · In reply to: #27020

> So, what if an ISP (webhost) enables taint functionality, and a
> developer uses a PHP library that uses custom filter functions for
> filtering data. Will this developer see messages displayed on his PHP
> application even though filtering is being done?

Presumably the filtering functions "untaint" the data.

The whole point of "taint" is to catch data that is getting passed
*RAW* to places raw data shouldn't get passed.

-- 
Some people have a "gift" link here.
Know what I want?
I want you to buy a CD from some starving artist.
http://cdbaby.com/browse/from/lynch
Yeah, I get a buck. So?

---

## #27031 — Stanislav Malyshev — 2006-12-16T02:29:35+00:00

URL: https://externals.io/message/27020#27031 · In reply to: #27020

Jordan Moore wrote:
> So, what if an ISP (webhost) enables taint functionality, and a
> developer uses a PHP library that uses custom filter functions for
> filtering data. Will this developer see messages displayed on his PHP
> application even though filtering is being done?

Correctly implemented filtering library would untaint the data, of 
course. One of the TODOs might be providing API making easier to write 
such library.

-- 
Stanislav Malyshev, Zend Products Engineer
stas@zend.com  http://www.zend.com/