« first day (3868 days earlier)      last day (1094 days later) » 
01:00 - 17:0017:00 - 00:00

5:00 PM
If I explode a literal, don't I still get literals back out?
 
Or in another context, I want more new programmers, and I want them to not worry about some of these fairly common issues, to give them safety rails.
 
Maybe only if the explode pattern is a literal too.
 
For me it still comes down to the false-positive risk. Naive DBALs that require literals without escape hatches become considerably less capable, pushing people back to PDO. And the people who would benefit from getting their hand slapped and told to use prepared statements like an adult are likely not using a DBAL anyway, so wouldn't have a chance to have their hand slapped.
I can see the argument for it... but I still don't know if the risk/reward tradeoff is worth it.
 
+1 ^
 
@Trowski Kinda... the problem is that it's about addressing security issues, and while joining programmer defined strings together is fine, when you start breaking them apart in arbitrary positions, it get's complicated.
 
5:03 PM
@Crell This is my concern too, that it will provide a false sense of security vs. just using proper practices in the first place.
 
@Crell So the dummy DBAL gives you lots of simple bypassing options... but I would hope you don't need them anyway.
 
How do other languages handle this space? I know PHP has a bad reputation for SQL injection, but I don't think we are lacking anything that Go, Rust, Python, etc. have, and they don't have this problem, at least it doesn't sound like it. They just have less shitty 20 year old tutorials.
 
It's the enforcing of the proper practices... for example Doctrine, and someone writing ->where('u.id = ' . $_GET['id'])
 
@CraigFrancis Isn't the same the case when concatenating strings?
 
@CraigFrancis Right, one can build bypasses for it. That doesn't mean everyone will get them right.
 
5:05 PM
BTW I still don't like the perceived security one gets from is_literal (especially from 90% of the developers that will use it)
 
@Crell Google, in Java and Go, have "compile time constants", I mention them in the RFC, they work fairly well, but are even stricter in a way, and without a query builder, they don't work with the WHERE IN case.
 
My money is on people just using it as a check in constructor arguments then rolling their own wrappers
 
But then it's baked into their DBALs, no?
 
@PeeHaa Not really... splitting strings at any location is not the same as joining known fixed strings.
@Crell Nope, and the bypasses are there for you to say "I'm happy to take this risk"... in theory you should be able to write any SQL you want with literals, as I've tried to show in the example.
@PeeHaa Can you expand on the "perceived security"? the idea is what libraries will be using it, and we can start by getting developers to use those libraries... later, as mentioned as "phase 2" we can look at how PHP itself can use it, where functions like mysqli_query() can start by issuing warnings for a non-literal $query, but have an option to accept a trusted object (all of that to tbc, as I'm just focusing on the basis building blocks).
@MarkR Yep, in the constructor would work, and things like the Drupal ->where() method... so we can start pushing towards having trusted (developer written strings) being accepted there... because you can't be sure from a libraries API which arguments will be passed into the SQL string.
@Crell Not yet, the DBALs have no idea if the strings they receive have been written by the developer (vs including user content)... most of the time they do validate things like "is this string the name of a known table", and that's good, but some methods, especially when it comes to custom WHERE clauses, or HTML snippets, get messy.
 
@CraigFrancis it feels a little bit like safe_mode, it promotes a false sense of security (for me)
nowhere near as much as anything with the word "safe" of course, not making a direct comparison
 
5:17 PM
@DaveRandom Ok, and sorry to do this, but looking at the example db class, can you find any way that a developer using it could introduce an injection vulnerability.
 
it's not so much about any specific example, it's more about the way that people who don't fully understand a specific example tend to misconstrue parts of it and then problems bleed through into their own code
 
@DaveRandom Oh, don't get me wrong, when trying to come up with a name, I outright rejected the is_safe_string() suggestion, because I thought it was asking for trouble.
 
to be clear, this is not a deal breaker for me, I just haven't fully reconciled it
I foresee an awful lot of people making false assumptions based on checks against is_literal(), rather than people putting to its intended use
 
@DaveRandom Thanks, and if you can think of any way that can happen, I would be really interested... I really don't want to introduce something that will cause more issues (I've seen Perl's taint-mode, and it's use of RegEx to mark things as safe... I don't want that).
 
sorry for disruption, so is the #php IRC channel on freenode staying with the drama going on?
 
5:20 PM
@DaveRandom Oh, please go on... what could they assume?
(sorry, that might sound a bit rude, that's really genuine interest, I've been wondering about mis-use, but can't find anything yet).
 
you are asking me to predict the way the people with unknown false assumptions will think, I'm just thinking about the sort of throught processes that lead to consrtructs like htmlspecialchars(urlencode(mysql_real_escape_string($foo))) and shit like that
and yes @CraigFrancis I will put more thought into it and try and come up with something more concrete
I almost wish PHP had some sort of "advanced mode" where you can only use the tools that let you hurt yourself if you can prove you know how they work
 
oh yeah, I've seen nasty stuff like that (ASCII vs UTF-8 messy-ness comes to mind)... but as the flag is dropped so easily, it shouldn't really be possible to chain things up like that.
 
I completely see the point (and the value) in the feature and I think I am leaning in favour of it as it stands, just wondering if there is any more safety nets that make sense
 
@DaveRandom Maybe one day, and I think this might play into that idea (giving you some of the building blocks)... but I fear that many programmers think they are wonderful, and they should be considered advanced :-)
 
yeh clearly that is impossible to implement :-P
and also it's extremely disingenuous to most people
but... "most" :-P
 
5:26 PM
@DaveRandom I'm really open to other ideas, and I've tried a few (ref the taint extension, and before that using a static analysis thing to track my variables), but I think the literal check is the most basic part of that... as in, this string, which will be used as a command, it cannot contain anything that the programmer did not write.
*command being SQL, HTML, Command line stuff, and dare I say it eval().
 
I remember when you (or maybe someone else) came in here months (years?) ago with a much earlier stage idea for this and I have thought about it a lot on and off, I think what you have is about the best possible configuration of what it actually does, and having a name that doesn't imply any kind of "safety"... it doesn't sit quite right, but nothing is perfect
in my largely irrelevant opinion
 
@DaveRandom It probably was me, I've been at this for a few years (before that I was trying make escaping could work, but I just ended up with a long list of why it cannot)... tbh, I don't think the manual, or anything has to say anything about it being a safety feature, but I want it for that reason (and that's how we ended up with the is_literal() name, to note what it does, not is_safe_string()).
 
5:51 PM
yeh indeed, I toyed with flipping it to is_user_input() (or whatever) but I think that implies "safety" with a negative result more than is_literal() does with a positive result
 
that's an interesting thought, but I think people might also complain because it might not be a user input, e.g. is something from the $_ENV from the user (dunno, but we should assume it isn't).
 
well yeh or is_external_data()
 
OMG... I'm such a dumbass.
 
but I actually prefer is_literal() (I think)
 
How is release formed
 
5:54 PM
okay, I have a question, it is a really long question and I can't copy/paste it into SO easily, so I've put it into a gist, is there a clean way to add jobid as a property to a class called Job and have this new property directly relate to an already existing property id? I came up with two options, but I am open to other ideas as well.
@Sara oops
 
@DaveRandom Thanks, I think I'm the same, not 100% sure, but it's the best I can come up with... and Dan raised a good point, as anyone can search for "what is literal string in php", and get a fairly good description.
 
@DaveRandom ... I find the UK banking system actually pretty reasonable compared to France's...
 
@Girgias is it just all banks? and being stuck in the 90's when they got their big main frames, and liked what they did?
 
@Sara when an RM and some code love each other very, very much...?
 
@CraigFrancis I mean in the UK you can get your current account transfered with all the payements to another bank, in France you cannot do that
You need to setup all you're direct debits manually again
 
6:00 PM
@Girgias Ohh, maybe we do have something useful.
 
in the UK, money sent to paypal can be instantly transferred to a UK bank... I'm not sure if it's just an issue with my US bank, or if it's an issue with all US banks, but it takes like three business days for my bank to receive a transfer from paypal
 
Now one advantage of my specific French bank is that I can have an international credit card where I do not pay fees aborad
Was extremely useful during my gap year
 
@Tiffany Yeah, but they do need to go down to the vault, chip off a bit of gold, put in in a donkey pack, and in the US that can be a long walk to get to your bank :-)
 
@Tiffany They need to do way instain makefiles who compress thier tarballs, becuse these tarbells cant fright back? It was on the news this mroing a rm in ar who had kill her three bundles, they are taking the three versoin back to new york too lady to rest. my pary are with the user who lost his produckshun ; i am truley sorry for your lots
 
Anyway, I best be off... thanks everyone for your feedback, I really think is_literal() is the best way to protect against the range of Injection vulnerabilities (where the string can only be written by the programmer). So I'll tweak the RFC tomorrow to note those extra functions, and start the discussion on the mailing list (as an aside, I really hope more people start saying they will vote for it, or good reasons why not, because this has been really hard).
 
6:03 PM
@Sara LMFAO
 
@Tiffany Also what happened? (didn't even know we had an IRC)
 
@Girgias hostile takeover of freenode I guess (biased article) I don't know anything about Andrew Lee and cba to dig further into him presently
 
#php on Freenode just redirects to the informal ##php channel (last I checked)
#php on Libera (the new network run be ex-Freenode admins) is open and unregistered currently
 
Huh okay
 
$mysqli->real_connect connecting to socket exception ・ MySQL related ・ #81055
 
6:13 PM
@cmb @MateKocsis what needs to be done in regards to github.com/php/doc-en/pull/289 ?
 
IRC drama ... tastes like late 90's ...
 
just like teen spirit?
or I guess that "smells"
 
That's early 90's
C'mon, you're as old as I am. Late 90's is Blink-182.
 
meh, 90s is a blob for me
 
And while we're at it, SO TIRED of seeing these messages: github.com/php/web-php/commit/…
 
6:25 PM
@Tiffany I approve. Very much.
 
someone asking for a bug bounty?
 
"We don't even have enough funding to afford bounty bars, nevermind bug bounties"
although tbh bounty = coconut = blurgh
 
6:43 PM
@Sara nudge nudge can you review my PRs to web-php? :)
@MarkR I'm outraged at this opinion
 
And also enable issues for github.com/php/web-php
@Crell "Naive DBALs" naive dbals wouldn't even both to check for is_literal.....but can you recommend a simple DBAL to make PR for to show how it would work. I would do doctrine, but it's 'not small'.
And 'access points' would probably be a better term than escape points, and you'd be putting stuff in, rather than letting stuff out...
 
7:06 PM
@Girgias Merged merged
@Tiffany Regularly. And it's the "I found an issue, tell me about your BB program before I tell you what it is" most of the time, and surprise they tend to not tell us the issue when we tell them there's no money.
 
Probably only the misunderstood results of static analysis or other automated tools anyway
 
I don't actually expect this additional text to stop such attempts, mind you.
These "security researchers" are almost universally just hacks running a derp checker script and they could give two fucks about what site they're checking or if the issue is legit.
 
@Danack I don't think a "small but not terrible" DBAL exists. :-) DBTNG (Drupal) is not as big as Doctrine, but still not small. I've never used Eloquent. I think PMJ has his own DBAL that I've never touched, nor do I want to.
 
yeah, no, to at least two of those.
 
I've heard rumor that Propel still exists, but only in legend.
 
7:14 PM
but is a full on ORM, rather than just DB abstraction...
 
@CraigFrancis It's not the same but can introduce things just like splitting them does
@CraigFrancis Yeah that's exactly why I personally still think it's a terrible idea
@DaveRandom yes so much that
@DaveRandom Exactly my point
 
@PeeHaa That the crux of the issue. I don't think I'm comfortable with introducing the notion that some strings are safer than others. All strings are unsafe.
Unless it's a const string, it could have been manipulated.
 
7:36 PM
@Trowski This.
Fun fact, sodium will mutate non-reference strings, meaning you can pass something by value and it'll get changed anyway. Now, it only mutates them to make them null strings, but that can still break assumptions about safety, like if you concat it into a string that goes into a posix api somewhere.
Also a fun fact: I really don't like that sodium does this.
 
wget no longer works to download a PHP version. ・ Website problem ・ #81056
 
Right, thanks
 
@Trowski FWIW I have been preaching it since the very beginning
 
@Jeeves wat
 
7:47 PM
It's just a bad idea (again IMO)
 
8:07 PM
@NikiC That reporter has a .za address. I wonder if the CDN node down there is just underprovisioned and kicks our tarballs out of cache and/or just gets busy.
I'm inclined to point him at the php-distributions repo
 
cmb
8:52 PM
they say it works via browser, so doesn't appear to be CDN related
 
PHP-FPM: how to tell apache where is configuration file ・ *General Issues ・ #81057
 
cmb
@Girgias the math funcs (abs() etc.) are special, because they don't coerce in weak mode; not sure how to document. assert() page is a total mess anway. Can't remember the issues I had with the other funcs.
 
@cmb That's something that should be fixed in ZPP I think, it's in relation with the 'n' param specifier?
 
@cmb Ah, right. Good call. Hrmmm
Maybe how that CDN node responds to specific User-Agent headers? shrug
 
cmb
9:09 PM
@Girgias not really the case; it's about Stringables, see 3v4l.org/CEA1W (worked for abs() etc. in PHP 7, but not when internal function expected int)
 
oh
 
cmb
@Sara maybe; maybe missing redir support; curl --verbose is a good idea
@Girgias pretty edge-casey, and IMHO new behavior is okay, but we should document it
 
Right
 
@Sara wtf?
 
Param is accepted by-ref and only modified if it has rc=1
Do you have some other function in mind?
 
9:26 PM
Hi I'm afflicted with PHP
 
<as a group> Hi @eyeseaevan
 
Hi :)
 
one of us, one of us, gooble gobble.mp4
 
cmb
@Girgias actually, it's not really about Stringable, but rather that these functions used convert_scalar_to_number(), and returned false if that failed. Most relevant change is with internal objects converting to number, e.g. 3v4l.org/BerDR
@Sara just refer them to HackerOne IBB :p
 
@Girgias I meant more generally than that tbh, though in retrospect I think "malicious" seems more fitting than "incompetent" there
@CraigFrancis yeh that's fair
@PeeHaa tbf I basically answered for you because I know what you think about it :-P
 
9:46 PM
bon soir
 
guten abend
 
@LeviMorrison @JoeWatkins @NikiC gist.github.com/Crell/ead27e7319e41ba98b166aba89fcd7e8 - PFA logic. Would that be acceptable? (Sufficiently robust, sufficiently clear to read, sufficiently implementable.)
 
10:05 PM
@DaveRandom <3
 
@Trowski ...but it is a const string. That's essentially what you are testing for (?) /cc @CraigFrancis
 
@cmb do we still generate the CHM version of the docs?
 
@DaveRandom Not if you can concatenate and still get a "const."
 
cmb
@Girgias seems so (don't know if these have issues, though)
 
Hum, wonder if it makes sense to drop them, might ask on the docs list
I'm purging doc-base from scripts and ancient tech
 
10:12 PM
@Crell Not that you asked for my opinion, but I think it can be valid for a partial to have a fewer args than target. stuff(?, ?, ?, ?) could be valid.
 
That's in there.
 
@Trowski ah yeh that's problematic
 
As long as it covers all the required params.
 
fundametally though, const + const = const in the sense that you still have total control over the inputs
 
@Crell Right, maybe that was there and I missed it.
There error may not come up during the partial call, but when the partial is invoked.
 
10:16 PM
@Trowski 5th example has 4 ?, which means it passes through the 4 required args and then uses the default value for the 5th param, and you can't actually specify the 5th param from the partial.
 
@Crell Oh wow, how did I miss that?
 
But only having 3 ? would not be enough, because the underlying function needs at least 4 args.
 
Joe would be the one to ask if $partial = stuff(?, ?, ?) would error, or if $partial(...) would fail. I think the latter.
 
@cmb Sure, I could do that! I've been concerned that my (apparently working) gd code will get stale as I wait to get time to finish the non-gd parts
 
@Trowski I think the former would be better, but I'd be OK with it being the second.
 
10:19 PM
@DaveRandom Sure, though being const isn't enough to guarantee content, which has the potential to be unknown even if all the parts were const.
 
yeh but that's also true for a single const... I don't necessarily disagree but it sounds to me like you don't like the feature in general (which would be a valid position)
also ftr I don't completely disagree, I'm still not sure where I have a mix of user input and const, other than default, where I would rather just treat everything as external data
at the same time I do see the value in being able to perform this kind of check sometimes - I do wonder whether the API belongs under reflection though
 
10:39 PM
@DaveRandom Yeah, mostly this. I think the cases were it's useful are narrow and can't replace proper escaping, so why give a potential false sense of security.
 
@Trowski would you feel differently if it were "presented as a debugging tool" (i.e. part of reflection) ?
in the last ~20mins I have realised that most/all of my actual use cases are meta tooling rather than actual code
also from what I remember about being a baby dev, putting it in reflection would make it scarier to (some of) those lacking confidence/competence
 
I wonder if static analysis could do that instead of being part of the engine.
 
static analysis can tell you pretty much everything in var_dump(), I still use it and people still make more useful non-static tools with it
 
Not really apples to apples, since this incurs some overhead for every string op (though I have no idea what affect that has on performance).
 
yeh I have spent the last ~2mins working out how to clarify my thoughts there that was very poorly written :-P
my basic point is "yeh static analysis is cool but its existence is not a good enough reason to forbid inspection of important metadata at run time"
though that is inartful and debatable, but I mostly stand by it
afaict from a performance and complexity PoV this change is essentially free, so I don't see a good reason to forbid it, but I can see a good reason not to present it as part of the "standard library"
 
10:52 PM
Then to answer your actual question, I would feel better about it being a part of reflection.
 
We should just infect partials with vampirism, that way they have no reflection.
 
@Trowski in the last ~30mins I have decided I also think that /cc @CraigFrancis :-P
 
What use cases were you thinking about?
 
so, I am a stoner and borderline alcoholic, I struggle to pin down exactly what happened 10 mins agao let alone in code I wrote 5 years ago, but I remember wanting this more than once in "meta-tooling" stuff I have written in the past
stuff like generated code around WSDLs
insanely complex black boxes of generated code, basically
 
> You may need to configure the dynamic linker run-time bindings: sudo ldconfig /usr/local/lib
 
10:56 PM
the use case are typically not "good code" but nevertheless bad code can do good stuff
 
Other than, "it might not work otherwise" why would people need to configure whatever a dynamic linker run-time binding is? rather than just compile it with appropriate settings?
 
yeh that really feels like someone who looked at undocumented env vars and thought "nope, not obvious enough"
@Danack "dynamic linker runtime binding" is surely just dickspeak for "default lib search directory"?
or "base dir" or whatever
esp based on where it is pointing
pointing shit at directories can 100% of the time be solved by prepending a string to some file paths
 
ln -s /usr/local/lib/libMagickCore-7.Q16HDRI.so.9 /usr/lib/x86_64-linux-gnu/libMagickCore-7.Q16HDRI.so.9
ln -s /usr/local/lib/libMagickWand-7.Q16HDRI.so.9 /usr/lib/x86_64-linux-gnu/libMagickWand-7.Q16HDRI.so.9
is the hack I used today.....so yeah.
setting the configure option explicitly to --libdir=/usr/local/lib
did nothing.
 
@Trowski It needs to be the former or we cannot feasibly extend it later. cc @Crell
 
11:13 PM
@Danack I feel like I ran into this problem on once (on debian fwiw) but I think I resolved it with some php-config switches so prob not helpful in the least
 
@LeviMorrison The defaults aren't in the prototype, they're in the opcodes, correct?
 
@Trowski Unless I misunderstood, you said there were 4 required args and only 3 args/placeholders given. That's an error, no defaults needed.
 
11:30 PM
@LeviMorrison Oh, right, required_num_args is in zend_function, so that can error on the partial call.
I conflated that with copying the default values, but that's not necessary just for an arg count error.
 
01:00 - 17:0017:00 - 00:00

« first day (3868 days earlier)      last day (1094 days later) »