« first day (3837 days earlier)      last day (1094 days later) » 
00:00 - 16:0016:00 - 23:00

12:07 AM
@CharlesSprayberry that is yet a third conversation, in which we should probably include your wife
 
Hello guys
 
@IluTov Could the binding order be jiggled a bit, or would that break everything?
 
@DaveRandom Oh boy, you should hear the things that me and some of my gaming buddies talk about. This is definitely on the tame side. She wouldn't even bat an eye
@talhaouycoding o/
 
@CharlesSprayberry "talk" is not what I am concerned about.
 
@DaveRandom nice
 
12:09 AM
unlikely.
subjective, ofc
 
 
4 hours later…
4:05 AM
@NikiC I think creating a backtrace within a fiber is what is causing the tests failing with a segfault on i386 on Azure (though I'm not 100% sure, any way I can confirm this?). Any idea why that would fail only on i386, and only on Azure?
 
Sounds like you're hunting down a particularly tricky bug
 
@CharlesSprayberry These tests are failing on i386, but seemingly only on Azure because Joe was able to compile and run successfully on 32-bit.
 
That is brutal
Makes the debugging problems I'm looking into atm seem pretty minor
I wish I knew enough C to contribute to what you're working on. I am legitimately stoked about fiber support
For now I have my hands full trying to get a working unit testing framework that operates on 1 Loop and is async aware
 
FYI, the fiber-based version of phpunit-util works a bit differently. The loop isn't swapped, but it is cleared between tests.
 
Yea, I had a feeling that fibers would change some things up
That's ok. There's some other stuff that I want out of what I'm working on that I think it'll still be worth it
 
4:19 AM
I glanced at what you were doing, it appears that would still be relevant with fibers if a test suite wanted to maintain loop state between tests.
I'll give it a more in-depth look when I have more time.
 
No problem! Thanks for taking a look at it when you get the time. I know you've got a lot on your plate with fibers and stuff.
@Trowski Yea, exactly. I imagine for most use cases the wrapper should be sufficient. That's fine. This isn't meant to be a general use testing framework
Between the static code parsing, Attributes, asynchronous programming, unit testing...
I haven't had this much fun programming in years! ;)
 
4:37 AM
And, yea, I have thought about how to make sure each test is in its own fresh, isolated state while also having the need here to share some of that state. Perhaps there's some stuff I can do to make it more explicit when you plan on sharing loop state or have watchers referenced for longer than the test
 
4:59 AM
@CharlesSprayberry There's definitely reasons for both styles to exist, sometimes within the same test suite, i.e., unit tests vs. integration tests.
 
@Trowski Yep. I didn't hit this problem until I got into heavy integration tests
I was kinda hoping I could just shoehorn something into PHPUnit but as I was working my way through it I came into the red/blue problem where I needed something to be a Promise and it was void
 
That problem may not exist so much with fibers then. I guess we'll see.
 
Yea, I think I'm still going to run into similar issues where too many connections would get made...but can't wait to see how fibers changes things for sure
 
5:45 AM
A use after free bug in ext/phar/phar.c ・ *Extensibility Functions ・ #80964
 
6:09 AM
I wonder if honking a car horn incessantly at 1AM is considered a noise ordinance...
 
7:04 AM
A use after free bug in ext/spl/spl_dllist.c ・ *Extensibility Functions ・ #80965
 
7:33 AM
A potential use after free bug in ext/standard/browscap.c ・ *Extensibility Functions ・ #80966
 
8:20 AM
@JoeWatkins Thanks again for this, I really wasn't expecting those oddities/issues to be fixed, especially so quickly. All of my tests pass now; but I did find a new one, I don't think it really matters if it stays, but if you set TEST=2 in your shell, is_literal($_ENV['TEST']) returns true. It only seems to happen with numbers.
Also, do you know what happens next? I'm tempted to make up a temporary literal_implode() and literal_array_fill() just so I can use this on my own projects (to see if anything else comes up), where Dan can hopefully provide proper ones later, and I assume I should start asking on internals about perf tests (dmitry?), and if anyone else has any thoughts on this feature (as in, what concerns they would have when it comes to the vote).
 
9:21 AM
@CraigFrancis that is the result of an optimization in zend that stores one char strings as interned, if you set TEST to anything other than a one char string it will not report literal
Don't bring it up on internals until the idea is finished being formed, so let's get these functions done, if you tell me exactly how you want them to work, I'll do it ...
the next step is drafting the rfc, it's important that the rfc is semi polished the first time it's read ... so first get the rfc in order and get these functions done and documented in the rfc, then you email internals and start the conversation ...
when it comes to performance, that's really dmitry's problem, if it gets merged ... what you want from internals conversation is the consensus that we want this feature and the vote should happen ... if internals decides they want it and dmitry decides the performance isn't up to his standard, he'll have to improve it ...
I would say it's more important that the state of the RFC is more important than the state of the implementation, because most people involved in the conversation don't or can't read the implementation ... even those that can might not until it's actually being merged ...
the implementation is in pretty good shape, I'm just saying, focus on the rfc, look at the RFC's niki writes ... deal with every possible argument before anyone actually makes it ...
 
9:54 AM
@Trowski You can try adding --enable-address-sanitizer to the ci job
 
FILTER_VALIDATE_EMAIL fails on Russian email address поддержка@‍почта.рус ・ *Mail Related ・ #80967
 
 
2 hours later…
12:01 PM
What do I need to execute again if I update stubs?
 
12:11 PM
build/gen_stubs.php
 
@MarkR build/gen_stub.php, thanks!
 
 
1 hour later…
1:26 PM
@Crell I don't know if Bison offers a solution for cases like this. It's not technically ambiguous if we could specify precedence but I don't know if that can work for different non-terminals (expressions vs patterns).
 
Holy shit.
php_filter_validate_email is just a regex.... always has been.
WHY???
 
1:45 PM
This is everything we've ever told users not to do when validating email addresses. ::sigh::
 
@Sara I thought that was RegExp for HTML?
 
Don't use regex for either of those things. :p
 
But RegExp is beautiful, it would never harm me :-P
I think there is a bit more of a case for an email address though, so long as you're happy to get some invalid ones though.
 
Fuck me. There's a whole chonk of this patterns that's exclusively about matching IPv4/IPv6.
> so long as you're happy to get some invalid ones though.

Stop programming. Go into another profession.
 
yep, email addresses are wonderful, and very flexible :-)
:-P
Do you join me in making websites that are valid XML, or are you happy with <br>?
 
1:51 PM
I use XHTML, but I don't hold HTML against anyone.
 
With the application/xhtml+xml mime type?
 
No. It's not an application.
It's text/, clearly
 
But you loose all the XML goodness :-P
oh, or do you use the weird cousin text/xml ?
 
Why on Earth would you lose any "XML goodness".
Does it suddenly stop being XML?
Have you ever written software before?
Are you from the past?
 
as in, getting the browser to use it's XML parser, rather than letting the HTML parse get it's mucky hands on it.
 
1:59 PM
Okay. You worry about that. I'll be over here doing something useful.
 
@Sara maybe, but I'm about to solve all injection vulnerabilities, you know, the little things :-)
 
XHTML is a failed experiment, which was abandoned 10 years ago
 
But the XML mode is useful (even if it's just on a dev server)... it stops mistakes like forgetting to quote your attributes.
 
that sounds circular
 
how so?
 
2:09 PM
if you're not trying to be XML compliant, unquoted attributes aren't a problem
 
echo "<img src=" . htmlentities($url) . " alt='' />";
Can't remember what the XML spec itself says, but browsers require quoted attributes.
that's why you get the checked="checked" stuff
 
yes ... if you're trying to be XML
that's why I say "circular"
in modern browsers, <input type=checkbox name=foo checked> is valid syntax with a well-defined meaning
 
Yep, and if you use the XML mode, then you can't accidentally output an un-quoted attribute... or in other words, it makes sure you quote everything.
 
but why does that matter?
 
see the echo example above
 
2:12 PM
you'll need to be more explicit
 
Now evil person does... $url = '/ onerror=alert(1)'
htmlentities() by itself is not enough
This also happens with basic templating systems like Twig, which are not context aware... e.g. <img src={{ url }} alt='' />
 
quoting the attribute won't save you either
 
In other contexts, like <a href="?"> I'd agree (javascript: URLs), but with the <img> example, how so?
 
htmlentities won't escape single-quotes by default
 
Just use a library that has solved this problem and provides context specific escapers. I used the Zend version of this before and it seemed ok docs.laminas.dev/laminas-escaper
 
2:18 PM
It will soon... 2 min
 
you can pass it ENT_QUOTES or similar
but that's easy to forget, and your XML validator won't tell you whether you've remembered to or not
indeed, it won't tell you if you forget to use htmlentities completely
 
I hate PHP bitwise op precedence … $a & $b == 0 … yay :-(
 
you need either a context-aware escaping function, or a context-aware code analyser to fail your CI build
 
because obviously the equality gets evaluated first
 
@IMSoP Found it... the patch I created for ENT_QUOTES in PHP 8.1 github.com/php/php-src/pull/6583
 
2:23 PM
fair enough; my point stands, though, XML validation is giving you a false sense of security
 
Depends, XML won't stop issues, but it helps identify some mistakes/typos... ideally we would use a proper HTML Templating library, as @CharlesSprayberry kinda suggests, one that is itself context aware... but, that would also need is_literal(), so the library knows that the HTML it's working on in is from the programmer (a string or a static file), and the user data is provided separately :-)
 
yeah; it does also create a whole new bunch of mistakes you can make, though, that aren't an issue otherwise
like forgetting to put the "/" at the end of a void tag like "img"
 
yep, but that's why I use XML mode when building the website (to identify the mistakes), but drop back to plain HTML on the demo and production servers.
 
"I'm about to solve all injection vulnerabilities..."

HAHAHAHAHAHAHAHAHAHAHAHAHAHAAH 🤣🤣🤣🤣🤣🤣🤣

Just imagine thinking you're going to solve a decades old problem. Oh bless.
 
@IMSoP I don't want to write yet another template engine :D
 
2:31 PM
hah! me neither!
 
@Sara Ohh, this sounds like a challenge... please, find a flaw... wiki.php.net/rfc/is_literal :-)
 
the worst excess of XML-for-the-sake-of-XML was the dance to try and make <script> tags valid JS and CDATA blocks at the same time
 
Oh, and btw, I didn't fix it... I was watching a talk by Christoph Kern, from Google, this is how they do it in Go, and their systems, and it works.
 
@IMSoP I'll just use reddit.com/r/PHP/comments/2p2lzc/java_to_php_compiler to compile it from Java :P
 
The XML bit isn't part of the solution, that's just one way I try to solve the issue today (along with a strict CSP that blocks inline JS).
 
2:36 PM
@CraigFrancis Oh right, you're the one reviving taint mode but refusing to call it taint mode.
 
But it's not
 
Mmm hrmmm
okay sweetie
 
taint mode allows escaping, which is flawed
 
mm hrmmm
*pat* *pat*
 
LMAO:
> An XML parser, for the purposes of this specification, is a construct that follows the rules given in XML to map a string of bytes or characters into a Document object.
> At the time of writing, no such rules actually exist.
 
2:37 PM
the problem is, I need to get you to vote for this, and tbh, I have no idea how that's ever going to work
 
Never said I wouldn't vote for it (in theory), but the claim is outlandish and false.
 
how is it outlandish and false?
 
*pat*
 
I've been working on this for a few years now, I've yet to find a problem with it.
Thanks :-(
 
@IluTov It's an LL1 parser, so I suspect not. @NikiC?
 
2:41 PM
You: "taint mode allows escaping, which is flawed"

Also you: https://github.com/php/php-src/compare/master...Danack:is_literal_attempt_two#diff-2b0486443df74cd919c949f33f895eacf97c34b8490e7554e032e770ab11e4d8R2714
 
no, that's where Dan is trying to debug
 
Ah, nevermind, missed the TODO
Yeah, fair.
 
Dan's also been unable to complete at the moment, so Joe has been able to help out:
 
Proving that this works without fail is a burden on the person making the claim.
Stating "I don't see an issue yet" isn't a proof, it's an anecdote.
The fact that I've seen this tried repeatedly without success makes me skeptical of any such unsubstantiated claim.
You don't have a proof, you have an idea.
 
without success?
I've seen that it's been implemented at Google, and it works there
 
2:45 PM
Ugh. Not going to explain engineering to you on a Sunday. Sorry.
I'm also, as you can tell, in a no-fucks mood. I may be more amendable tomorrow. :p
 
I'm also trying to be a little provocative, to get people to engage, to actually look at it, rather than ignoring it until the vote, then simply saying no.
I have no idea how to sell ideas, I just ask people to find a flaw, and they don't and go away without saying anything else.
 
Getting people to engage on RFCs pre-vote is a hard problem.
 
It's easier to explain with SQL, as it's basically a way to enforce the use of parameterised queries, something programmers hopefully understand (but many do not)... HTML is a little more complicated, in that it requires a library that is context aware, so it does the encoding, and your every-day programming provides the HTML and User values separately (this RFC, in both cases allows you to enforce that separation).
 
For the record; I'm generally in favor of taint mode, but it annoys the shit out of me that you won't acknowledge that that's what this is.
 
It kinda is, but so many people associate taint mode as incomplete, and kinda flawed
I say that it's not to get people to respond
so they don't go off without even considering the differences
 
2:51 PM
Yes, I understand that it's not textbook taint since it's whitelist rather than blacklist, but fundamentally, it's what it is.
I'd respect, "It's like taint mode, but here's how we address the shortcomings" far more as it'd be honest.
 
Look, I've got to update the RFC, as Joe has pointed out, it's not ready... I don't know how to do that, and if you've got the time (and I'm happy to pay, like how I am going to be paying Joe for his implementation).
 
"fat-free taint mode; all the safety-net goodness, with none of the unhealthy escape-function-tracking calories"
 
If that's what people are after, I'd happily include it.
 
I think acknowledging ways in which it is like this other thing that people are familiar with and addressing how it improves upon that could certainly win some people over. Or at least get them to not outright ignore it.
 
Previously I've said it was like taint, and people just ignore from that point onwards.
 
2:58 PM
Also, your claim is that it will catch all injections.
It won't.
Because it requires that anything consuming strings check for is_literal() and hard-reject strings that aren't literal flagged.
And that's not gonna happen, because your false-reject rate will be too high for programmers to accept.
 
The only time I've got people to stay for a few minutes is when I say it's not, and they try to prove that is it... and in doing so, they start to learn about it.
It will at first
 
echo $someString;
Should that fail on $someString not having the literal bit set?
If not, then you have XSS.
If so, then you have a world of hurt.
 
That's phase 2
see the bottom of the RFC
 
And, yes, making claims that it will catch all injections sounds hard to stomach imo. In my experience that's an incredibly bold claim to make. It also puts developers into a false sense of security because they think something is taken care of magically
 
I think it would be best to avoid the word "safe", for the same reason
 
3:00 PM
It can do
 
To propose an alternative - a language construct that produces a read-only object that cannot be instantiated any other way.

$foo = __untainted("Foo"); // instanceof UntaintedString

Then the DB would only accept UntaintedStrings
 
emphasise that it's a tool which can help with the problem, not a magic solution to it
 
That's going to get a rapid "No" from the performance camp.
 
And the usability camp.
 
because it's the magic that people don't like about taint mode
 
3:01 PM
There is no magic
 
@IMSoP Exactly
 
@MarkR That's an escape hatch, and one of the things this claims to explicitly avoid allowing.
 
There doesen't need to be one
 
@Sara If I'm going to use it, I'd take a mechanism with no false positives and built-in type hinting any day of the week
 
@CraigFrancis I know, that's why I said "emphasise that it's not"
 
3:02 PM
@MarkR, that's kinda what I'm going for... but in a way that allows string concat, so existing projects that have been using parameterised queries can start using today.
ahh, sorry
 
In terms of performance, a singleton per query string probably wouldn't even be measurable compared to the IO that's going to happen literally immediately after.
 
perf wise, I've been told to talk to dmitry, the current implementation from Joe seems to be fairly good (but I'm not a perf testing person).
 
and the engine is already capable of handling constant optimizations at compile time (I think)
 
The worst case I could come up with, with a range of different concat options, was about 1.7% slower... not perfect, and I don't know what is considered acceptable, but I was worried is was going to be above 10% (it's also why Dan was suggesting a literal_combine function).
 
Ultimately, if you're going to use this functionality, chances are you're willing to accept a few percent hit vs the security. As throwing a few extra servers onto the pile is a lot cheaper than suffering a data leak through an SQL inject
 
3:10 PM
I think so, and I think it's worth it... but as you can tell, I need to convince everyone that it's fine... I'm hopeful that dmitry can give some feedback on it (one of my next steps).
But, and the real hard sell, it needs to be enabled by default, for everyone, because the main target for this is developers who don't even know what SQL injection is... as it allows libraries (e.g. ORM's like Doctrine, Eloquent, etc) to pick up the mistakes as they happen.
And yes, phase 2, for functions like mysqli_query() and shell_exec() to use this flag as well.
 
That won't happen =\
 
I don't see a way in which it will be accepted to be enabled by default.
 
For comparison, teaching every single PHP programmer about injections issues, and for them to not make a mistake, is also not going to happen :-(
 
> This RFC proposes an is_literal function, to help enforce a separation of hard-coded logic
from user-supplied data. This addresses some of the same use cases as "taint flags", but
is both simpler and stricter, and does *not* address the *escaping* of user-supplied data.
>
> An example use would be a database library that wishes to enforce parameterised queries,
and distinguish between ''$db->query("Select * From users Where id = ?", [$id]);'' and
''$db->query("Select * From users Where id = " . $id);'' Since the separation of query
 
3:22 PM
Knowledge share and education is the better alternative.
 
I am 100% in the "force people to do things for the better good" camp. But a degree of realism is necessary.
 
(gah, I hate markdown)
@CraigFrancis what do you think of the above as an intro for the RFC?
 
@IMSoP Thanks, that's a good intro
@CharlesSprayberry Knowledge share and education has been the process for, what ~40 years? not exactly working.
How is it unrealistic to force the use of parameterised queries? this being a way of doing that.
 
Meanwhile, unless something radically changes in the next week. Looking like Patrick and Ben are the new rookie RMs.
I am 100% okay with this outcome.
 
my other tip would be to keep the emphasis in the RFC on the specific problems it solves, and avoid phrases like "almost all"
 
3:25 PM
Dealing with securing your data from injection is highly context specific. You can inject SQL. You can inject XSS through CSS/HTML/JS. You can inject through the use of extract. You can inject shell commands.You can probably inject some other things. They all require different approaches and introducing something "magical" that claims to protect you from that seems dangerous to me.
 
the parameterised SQL use-case is the one big sure-fire hit for this approach; everything else is only useful alongside some really pretty complex escaping functionality
 
Pointing out more explicitly in documentation and improving how we communicate "Hey this is super dangerous" and "This is how you do it securely" seems better than something "magical" or baked into the system that gives me a sense that I'm secure when really I'm not.
 
@CharlesSprayberry The idea is that you use a library to do that work for you, one that is context aware... so the library does a simple is_literal() check, to make sure the HTML, SQL, CLI, is a programmer defined string.
 
The goal shouldn't be "security without thinking about it,"

It should be "thinking about security is easy, natural, and doesn't complicated my happy path flow that much."

That's the mindset to design from.
 
@CharlesSprayberry Well, it would be secure... SQL is easy to explain, as the SQL string itself must be a programmer defined string.
 
3:28 PM
@Crell I agree with this.
 
@CraigFrancis Except when you need to do dynamic query building, which is surprisingly often. That means your own string concatenation, or the mysqlx protocol.
 
I'm going with the basis that the programming language is the only one that can stop you from making mistakes... and this provides the way of actually stopping mistakes.
 
@CraigFrancis If you're already using a well-implemented library that is escaping data context-specific then I guess I no longer see the value in what you're saying. On the surface I don't mind the idea of an is_literal function but I certainly wouldn't want anything turned on by default that would claim to secure me from injections of any kind.
 
I won't by default, it's a simple flag to prove to yourself that you haven't made a mistake
 
@CharlesSprayberry the point is that the library can use it to detect misuse at the interface between user code and library
 
3:30 PM
@CraigFrancis Nothing will ever stop someone from making mistakes. Humans are very good at coming up with creative ways to perforate their feet.
 
Take this one with Doctrine:
$users = $queryBuilder
->select('u')
->from('User', 'u')
->where('u.id = ' . $_GET['id'])
->getQuery()
->getResult();

// example.php?id=u.id
 
@IMSoP I understand that but you can't introduce something that just libraries use :P
 
@Crell, so how would you make a mistake with the is_literal check?
 
@CharlesSprayberry whyever not?
 
@IMSoP How does PHP differentiate between a userland library and userland application?
 
3:31 PM
@CraigFrancis Off hand, I'm not sure. I haven't read the RFC in detail. I'm just stating as a general approach, if you think you have a fool-proof way to prevent errors, you haven't met enough fools.
 
@CharlesSprayberry See Phase 2
 
I'd rather have an object tbh... something is that I can clearly type enforce at the earliest opportunity. The class itself could expose methods for concat, joining etc doing its own checks on its arguments types, meaning the issue of handling extension functions changing strings and losing taint flags becomes completely irrelevant.
 
@CharlesSprayberry why does it need to? it's not that users are banned from using it, it's just that they'd never have any use for it
 
String and TrustedString or similar?
 
@IMSoP I would need to read more before I gave anymore opinions to be honest.
 
3:33 PM
Phase 2 isn't set in stone, I'm just saying how this flag could be used, where certain functions (and stdout) could be configured to only accept literals, or a certain object that is known to only hold safe values.
 
I also just, on the surface, prefer @Crell approach of putting this into a type that is more communicative
 
@MarkR there's a chicken-and-egg there though: how does the object tell the difference between "Where id = 42" and "Where id = {$_GET['id']}", unless the language tracks literals?
 
"""if you think you have a fool-proof way to prevent errors, you haven't met enough fools."""

^^ THIS. 1000% THIS.
 
(Not my approach originally. It's been discussed a thousand times before.)
 
Yea, sure. Was just trying to refer to what you're describing not trying to attribute the concept to you ;)
 
3:34 PM
That doesn't mean you don't move towards better safety, but you never call something safe. That's tempting the fates too hard.
 
@IMSoP Modify the grammar parser so _trusted(xxxx) only accepts string literals with no interpolation.
 
@Sara Yeh, I keep hearing, this but no-one can come up with a way for the fool to provide use the unsafe value in the wrong way.
 
Also, fun fact, THIS is what Hungarian notation was originally developed for. A variable that began with s was already "safe", and you knew because of the variable name. Using it to just track type data was a bastardization of it.
 
@CraigFrancis If you come up to me and say "This thing is 100% safe" and I go "Oh, yea, I don't think so." it isn't on me to prove that it is unsafe in some way. It is on you to verify your claim.
5
And your claim is a pretty big one.
 
@Crell (~15 years ago that's what I tried, with $sql_ and $html_ named variables, but it didn't work... I then tried the taint approach... and now I've got this, and I can't find a flaw in it).
 
3:36 PM
@Crell from what I've read it was more about tracking application-specific types which were the same type to the compiler - the example I read was screen co-ordinates vs document co-ordinates
 
@CharlesSprayberry <---- What Chuck said.
 
When you say "prove", I expect a formal mathematical proof published in a peer-reviewed journal.

"Helps in cases X and Y assuming the developer is paying attention" - Now I'll accept "seems like it, OK."
 
Ok, but I have no idea how I could do that.
 
@IMSoP One is a special case of the other, yes. It's for metadata beyond the language's type system's ability to track.
 
How about... SQL only takes parameterised queries, which we know stops SQLi, 100%... HTML injection would only be an issue if the library had a vulnerability in it?
 
3:39 PM
The only thing I'm not sure about with something like _trusted or so is how it would play with things like constants... Can we have class X { const FOO = _trusted("INSERT INTO..."); } work? I'm not familiar enough with it
 
@CraigFrancis Eh, parameterized queries stops the overwhelming majority of SQL injection. Not 100%.
 
examples?
@MarkR Have a look at Joe's implementation: github.com/php/php-src/compare/master...krakjoe:literals
 
Drupageddon?
There are queries that depend on user input in ways other than what can be parameterized.
That then requires either string concat or a query builder that is, under the hood, doing string concat. And you can get through those holes if you're clever enough.
 
@Crell Like the WHERE IN case...
'WHERE id IN (' . implode(',', array_fill(0, $c, '?')) . ')';
 
@CraigFrancis would you object to me hacking the RFC text around, in line with the above intro?
 
3:41 PM
As an example.
 
or how about field names, like...
$order_fields = [
'name',
'created',
'admin',
];

$order_id = array_search(($_GET['sort'] ?? NULL), $order_fields);

$sql = ' ORDER BY ' . $order_fields[$order_id];
@IMSoP Yes please
and keep an eye on your time, I want to pay people who work on this.
@Crell As an example... yeah, that proves the opposite, the is_literal() solution allows this.
 
even when we're what we call certain, we don't actually claim we're certain, the problem is that the people trying to find security holes in stuff are often smarter than the people who wrote the code they are trying to break ...
and in php, we won't do secure ... we try to provide tools so you can make yourself secure, sometimes we do it badly ...
 
@JoeWatkins You should assume always, not just often.
 
@JoeWatkins Hi Joe, sorry, I've been doing a terrible job of trying to sell the idea.
 
you don't want to say "this thing will fix all your problems" ... you want to say "this is a tool you can use to fix these specific problems, which if used properly will reduce the chance of programmer error leading to vulnerability" ...
 
3:44 PM
btw, thanks for your comments earlier, I'll get back to them in a bit.
 
I am not saying is_literal wouldn't help close some holes. It may well do so. I'm saying that the assertion that it's a perfect fix is wrong until mathematically proven otherwise.

If you want to sell it, sell it for the holes you know it closes, not as a silver bullet. Past silver bullets in PHP have a very bad record of backfiring horribly.
And then we have to get into the usability and upgrade path questions, which are intrinsically subjective but still just as important.
 
@CraigFrancis you got everyone to engage ... just be sure to take on board their feedback ... don't fight them, they're totally right ..
 
@CraigFrancis For what it is worth I'm not great at selling ideas either. I also used to make claims that I felt 100% about but couldn't really be proven. Experience has taught me to be more reserved about those type of claims... you'll see more success.
 
@Crell I don't how how to mathematically prove that $sql = 'SELECT * FROM' is safe, but $sql = 'SELECT 1 FROM user WHERE id=' . $mysqli->escape_string($id); is not safe.
Perviously when I've turned it down, people ignore, or just say it's an incomplete solution.
 
@CraigFrancis Neither do I. I doubt anyone in here would even understand the complex math involved in such a proof. That's the whole point. You are not skilled enough to back up "prove" or "all" or "perfect", and we are not skilled enough to evaluate such a claim. So steer clear of such a claim.
 
3:49 PM
We do know that programmer defined strings, are written by the programmer, and cannot be affected by user supplied values (i.e. it's not possible to inject a value in there)
 
The argument or you to make is "this improves security in ways X and Y, at a usability cost of A and B, and X+Y > A+B". And people will either agree or not.
Sure, but that's also low-hanging fruit.
 
slow low hanging that it's still a problem today :-(
 
Then part of your argument needs to be "this low hanging fruit is still pickable, and it's actually a problem in the wild that we can address."
Because just from the name, I look at it and go "Um, I already know that query('SELECT 1 FROM mytable") is safe, duh. Why do I need to flag it as such?"
Like, say, how would is_literal have prevented Drupageddon? Show code examples of that.
 
well, the programming languages does automatically, and the query() function can, if it wants to, do something about it (maybe a notice, maybe an exception, etc).
 
"So you're going to throw an error in my face for something I already know to be true? Yeah, turning this flag off..."
 
3:54 PM
@Crell the library would start off with a notice, and anyone who switches it off (e.g. for the phpMyAdmin use case), would know they are doing something dangerous... e.g. the library would provide the config in a way that shows that it's unsafe.
 
You haven't made the case to me, as a DBAL author, why I should care about your feature that yells at me for doing the right thing without doing extra bookkeeping. So far, I just see "make your code uglier, because then we know literal strings are safe." And I go "I already know literal strings are safe, piss off."
 
@IMSoP, with your proposed intro, I think you're right, but can I tweak the "does not address the escaping of user-supplied data"... something like "where user supplied values are either taken separately (e.g. parameterised queries), or escaped by a library that uses the correct escaping based on context (e.g. HTML)".
Which DBAL?
 
Take your pick.
In my case, I was the original author of the Drupal DBAL. (I'm not involved anymore, haven't been in a long time.)
 
Doctrine?
$users = $queryBuilder
->select('u')
->from('User', 'u')
->where('u.id = ' . $_GET['id'])
->getQuery()
->getResult();
 
I will likely be overhauling a template engine for another OSS project in the near future. (Fingers crossed.) So you need to make the case to me that I should bother adding in extra code to say what I already know to be trivially true.
 
3:57 PM
the where method could check that it receives a literal... at the moment it cannot, and the mistake is allowed
 
Ah, but what about cases where I really do need to dynamically build the where clause in ways that are not paremeterizable?
 
such as?
 
@CraigFrancis the user-supplied values must always be taken separately; what the library does with them after it's taken them separately can vary, but this feature doesn't actually address that
 
@IMSoP perfect, thank you
 
That's a real use case; IN clauses, or subqueries, or coalesce, etc.
 
3:59 PM
$c = count($ids);
$a = 'WHERE id IN (' . implode(',', array_fill(0, $c, '?')) . ')';
is_literal($a);
 
So it's not a literal, it's a "I've already vetted this string, trust me" flag?
 
00:00 - 16:0016:00 - 23:00

« first day (3837 days earlier)      last day (1094 days later) »