« first day (4520 days earlier)      last day (652 days later) » 

00:20
@Danack Don't get me started on him
@Girgias do you have any actual useful stuff (other than the all of the manual pages that just have placeholder pages) that he could be pointed at?
@Danack I think the main frustration is when you ask him to make change to get his stuff merged (like rebase onto master) he refuses because he doesn't think it should be done that way but then will ping you to get his shait merged without addressing the comments
Also acting like he's in charge of the project and giving his, mostly dumb, opinions
I've sent an email to the folks at VMWare about the WASM PR to ignore his comments and focus on those from actually relevant people
00:56
apropos of nothing - someone made a comment on twitter that "all aspects of the behaviour of your application becomes part of the backwards compatibility promise". The context was related to github changing how they calculate hashes of archives.....anyone got a link, or know what "law" that is?
01:12
I prefer "Only documented behaviour of our application is part of our backwards compatibility promise" ... that's why I don't document things
Ah yes, I would very much like this approach as it would have allowed us to yank dynamic properties lol
btw @Girgias if you're so inclined, there's a thread on r/php right now about the comparison behaviour that you could drop in and explain about
Ah yes I saw that while I was waiting for a friend to go to a pub, probably should reply to that
Having taken another look through, it looks like therealgaxbo gave a pretty good one
That's true, although someone depending on it doesn't mean it's part of your promise.
No, but it means things like the way golang deliberately randomise the ordering of slices, to prevent people from depending on a particular order, are probably good ideas.
01:49
So, @Girgias, apropos of nothing, the LiteralString mkii RFC. Although I don't think it would damage the language the question I have is "exactly what problem is this solving?"
I ain't he, but I did talk to Craig pretty extensively about it, and the underlying want is to be able to detect the difference between a string defined in code, and a string brought in from user input, and then only allow the string defined in code to be used as part of the command element of an SQL statement.
Making sure that the variables was defined by the developer, which can help to ensure that no runtime value is used in specific contexts (e.g. building an SQL query and using a variable for the field name which can't use parametrized queries). I suppose the combination of this and actual literal type unions could also create a whitelist instead of needing an enum (which I still think is kinda eeeeeeeeee).
But ideally it would be possible to track all types to be literals instead of just strings (well maybe exclude objects) as that would fit somewhat the same purpose (e.g. certain flag parameters that definitely should not be determined at run time).
Someone in Scala did something pretty interesting by using literal types to validate at compile time that the query is valid and does not inject any runtime values (but it was doing some pretty magical stuff which scala macros)
@Girgias yeah I saw that.....but think it still has the same flaw in thinking......
What do you consider the flaw?
I think @MarkR has closest to a pithy answer which is something like "make it possible to detect user input in SQL and block those queries.". But I don't think that is the absolutely best goal. A better goal would be "Make it trivial to make write queries that include user input, and have them be secure. And also block insecure queries."
The is_literal RFC, and the python and Scala equivalent all only do the 'blocking' none of them do the 'making it trivial to write secure code'. I don't think forcing people to use prepared statements and binding parameters is hugely difficult, but it's definitely not trivial.
02:03
Even prepared statements etc don't offer protection if the statement in them is built from a string
That's what the RFC wants to solve, the ability to detect that something, for example a prepared statement string, is untainted by user input. The library itself could refuse to accept a prepared statement if it wasn't a static string from the code.
@MarkR yeah, but I'd imagine that if is_literal or equivalent was available, then that bit would be used....
So the thing is the "Make it trivial to make write queries that include user input, and have them be secure. And also block insecure queries." problem can be solved using (aka stealing) string template literals from Javascript.
Imagining we have literal strings, and we are design PDO 2.0, one of the things that would probably be done is that trying to pass a non-literal query string would be a type error as it would force you to use prepared statements.
Because a query string might conditionally add a WHERE clause and then ensuring it isn't fulfiled with a runtime value being concatenated/interpolated is hard except if you set up taint analysis.
But other than creating a SQLBuilder that returns SQLBuiltQuery objects that provide an API that takes care of building and carrying the placeholders eeeeeeh
That would allows you to write something like:
$sql = ```
  select * from foo
  where user_id = {$_SESSION['user_id']} and
  topic like {$_REQUEST['search']}
```;
And the string part would be provably written by a programmer, and the variables part would be separated out to be handled separately.
It's been actual years, and there are many many things that I would probably write differently now, but I did go and write a query builder to take care of those things (possibly in a bad way): github.com/Girgias/query-builder
And migrating from:
$sql = "
  select * from foo
  where user_id = {$_SESSION['user_id']} and
  topic like {$_REQUEST['search']}
";
02:09
@Danack Huh I wasn't aware of that JS feature
The other thing I chatted about with him was rather than trying to add the flag to strings, would be to do the equivalent of how MSVC C++ has _T which turns a char[] into wchar[].
to using ``` (or whatever gets chosen) takes a few seconds per query, rather than a significantly longer time than migrating to prepared statements and bound parameters.
@Girgias yeah......it's 'quite' nice.
If the parser emitted an opcode that would generate a LiteralString in response to something like __literal("Foo") and the parser itself verified that only a string was contained within it, then it would type hint on LiteralString which would be a class.
I wrote words here - there is also an opportunity to fix one of the existing (afaik) problems with php templates, namely that you can't easily call functions as part of the string template. Which is quite annoying sometimes.
> type hint
plz no troll.
$db->execute(__literal("SELECT * FROM whatever")) - Not exactly clean but it would get around changes to zend_string. Being able to test the normal string is naturally better.
02:14
@MarkR I think you're missing my point. Queries quite often need parameters that come from user input. A solution that just blocks them is 'just annoying' and doesn't improve the language that much. A solution that makes it trivial to use them safely, dramatically improves the language.
@MarkR The changes to zend_string are really really minimal, funily we've laid down the ground work while improving support for the GC IS_VALID_UTF8 flag lol
@Danack This isn't about parameters though, it's the command section that wants protection. Then you can treat anything else as unsafe and escape it by default.
@Girgias Does that include handling concat etc?
@MarkR Yeah because I literally worked on propagating that flag when concatenating two valid UTF-8 strings xD
I mean there's another slightly over the top option more like what Danack wants... feed the function the AST.
Ah yes, Rust macros
I don't remember if Bob or Levi wanted them
02:21
or query(select foo from X where a={$blah}) would need to emit [LiteralString("SELECT foo from X where a="), UserExprResult($whateverBlahWas)]
There was meant to be triple backticks in there
@MarkR I would be satisfied with stealing the JS functionality for template strings.....it would be useful for HTML templates as well.
I just saw it but think the tagged templates is pretty much exactly what I was on about above
Except pass them both through as arrays
I like that idea a lot.
02:36
Meanwhile, in NM: kob.com/new-mexico/…
02:50
nn.
 
8 hours later…
11:12
@ircmaxell good point; I forgot about references, and the fact that unset() has special power over them (which gets confusing with object properties, where unset() has different special powers)
@Danack template literals as implemented by JavaScript make doing the right thing easy, but they don't make doing the wrong thing very hard, because the "tag function" just takes a normal array of strings
so if you have a tag of sql that creates SQLStatement objects, you can just run sql([anyOldString], []) and it will be processed into a valid SQLStatement object even though the string cannot be traced to a literal
as such, a way to detect literal strings inside that tag callback function would be a perfect complement, tackling a different part of the space
your suggestion of passing a TemplateLiteral object instead is an interesting one though - effectively, the language would be guaranteeing that getStringParts() returns only literal strings
static analysers would still have to stub that as @return literal-string[], so having a native LiteralString type still feels like a complement rather than an alternative
12:22
@Danack by the way, regarding the note on your codex page about "raw", I believe the idea is to reduce "leaning toothpick syndrome": rather than having to write \\n to get a literal \n in the output, you can write \n and access it "raw" in the template callback
12:48
posted on March 02, 2023

@Girgias I'm a Bob and I wanted these.
13:03
Morning o/
13:17
Can anyone have any idea how can I implement webrtc in Laravel ?
@MarkR Is there any vacant position for me for a job? I am a Laravel Developer and I have a good experience in Laravel PHP.
13:49
@MarkR I love this part of this song: youtube.com/watch?v=1d_qpD-voYA&t=1408s
14:27
@StatikStasis You might also like youtube.com/watch?v=PowKDo9lxWQ then, very similar style
15:05
@IMSoP "static analysers would still have to stub that as @return literal-string[]" - why would they need to do that rather than understanding that things can pass around TemplateLiteral objects?
Thanks for the note on toothpicks....I get it, but do you have a good example of when someone would want to use that type of thing in PHP? With two different styles of quotes, it seems less of a problem.
I mean other than this - and that's why I tend to use # as a delimeter...
@bwoebi So I was correct then :D
 
1 hour later…
16:36
@Danack I'm talking about the inside of the template tag handler - once you've called $templateLiteral->getStringParts()you're back to just normal PHP strings, and might be passed around other library functions before hitting the actual database
@Danack if you're generating JS code from PHP, for instance; you're right, if we had "tagged single-quote-style strings", like we have "single-quote-style heredocs", it would serve the purpose for the most part
the difference in JS is that the template callback decides which parts are raw, not the caller, and it can ask for some parts raw and some cooked, from the same source string
not sure how widely used that flexibility is, though
"once you've called $templateLiteral->getStringParts()you're back to just normal PHP strings" - I would imagine that would only happen inside the library that does the actual queries. Or to put it in code:
class SafeDB {
    function query(string|TemplateLiteral $query) {

        if (is_string($query) === true) {
            throw new \Exception("My dude, please use a TemplateLiteral rather than a raw string.");
        }

        // does the needful here...
    }
}
$sql = "
  select * from foo
  where user_id = {$_SESSION['user_id']} and
  topic like {$_REQUEST['search']}
";

$db = new SafeDB();
$db->query($sql);
yes, I'm talking about running a static analyser on the code in // does the needful here...
That errors....and the user has to spend a good five seconds changing the string type used.....unless you know of another reason to manipulate queries outside of the SafeDB class?
I'm not talking about the user, I'm talking about the library author being able to run PhpStan, and confirm that they're not accidentally mixing up $query->getStringParts() and $query->getValues()
@IMSoP But yes....there's always going to be a layer where the 'safe' string gets rendered down to a query string and sent (probably with some bound parameters) to the DB. And although it would always be possible to muck that up, as it's inside the DB class, there should be very few places that need to be checked.
16:44
sure; I'm just saying that LiteralString would still be a useful concept inside those few places
"confirm that they're not accidentally mixing up" - part of Chris Kern's talk that was interesting is that they found there are always a few use-cases where people need to be able to deliberately use input unsafely. It can't all be automated away to be fully statically analyzably safe.
also, it allows such libraries to be composed: you might have db-vendor/official-database-driver insist on getting a LiteralString, but not provide any user-friendly templating; then friends-of-db/database-template could define templates that wrap it
@Danack well, that wouldn't be "accidental" then - it would be an explicit escape hatch - a specific run_unsafe_query function, or UnsafeSQLString class
Yeah.....tbh, I think we may be talking past each other. There's always going to be a layer where you go from analyzably safe to the raw PDO/MySQLI access. So I think there's always a layer where you could accidentally mix things up. I'm not saying being able to check is_literal would have no value......but it's hard to see where it would provide much value.

As a different example from DBs, when you're building HTTP queries you don't actually care if the input is literal strings or not....you care whether the encoding is done with http_build_query() rather than doing some terrible implode(
17:08
to me, the vendor vs friends-of is the best example of how the features complement each other
the low-level code can make doing the wrong thing hard, and a separate layer make doing the right thing easy
I don't get the http_build_query example; neither is_literal nor template literals seem relevant there
I was trying to show there's always a layer where you fundamentally need to know what you're doing and not muck up. There's going to be somewhere where you can make a mistake e.g.
if (is_literal($foo) !== true) {
	// throw error
}

$query .= $foo;
but instead you write:
if (is_literal($foo) !== true) {
	// throw error
}

$query .= $bar; // whoops!
For the http_build_query one...you have to know to use that function rather than trying to encode it yourself.
but how is http_build_query relevant to this discussion? there's a million things that is_literal doesn't prove
That is my impression, and one of the things that I got from Mr Kerns talk. Tracking literals (and literal templates) can help against accidental mistakes across most of the codebase, but at the core parts they don't help, and you need to review that code carefully.
sure
I still think both features could be useful, together or separately
 
2 hours later…
19:06
@MarkR LOVE IT!

« first day (4520 days earlier)      last day (652 days later) »