« first day (5029 days earlier)      last day (137 days later) » 

07:07
@Derick Interesting. I'll have some time later today to debug this. Not sure how they're tripping the assertion in libmongoc
@Derick The account name is "gromnan"
@alcaeus I've invited Jerome
07:52
@nielsdos Hm but how to logically find an element by key and then replace it by that key??
By not using a Stack?
@TimWolla What's the alternative? I can try the Spl linked list I guess
Don't want to deal with value semantics of array
You have not even described your problem.
@TimWolla S-expression lexer/parser
count($list) - $key might give the right index, or something similar
08:40
@alcaeus post seems deleted now
 
6 hours later…
14:37
is there any concern for unserializing user input if 'allowed_classes' is false?
I'm reviewing this code: unserialize($value['request'], ['allowed_classes' => false]);
The unserialize documentation does mention "Do not pass untrusted user input to unserialize() regardless of the options value of allowed_classes." - but I don't know why.
Any objects would still be unserialized, just into a __PHP_Incomplete_Class object. This might or might not be safe depending on what your code does with that.
Also: unserialize() is a common source of security vulnerabilities. Not ever using it on untrusted input is the most reliable way to mitigate those.
I understand this by principle, but I would love to understand it deeply.
Is __PHP_Incomplete_Class like a stdclass? Or does it inherit something from the class that was forbid?
Found it: https://www.php.net/manual/en/class.php-incomplete-class.php
Why would it be a security risk?
Object injection which would be the biggest risk isn't possible, right
It will be scalar or array of scalars like JSON
Can't be anything else, except that, or a Incomplete Class stub
I think the biggest risk it represents is that it requires discipline to handle. It's like a bomb.
Better to just use JSON
14:56
That's a conclusion I can agree with :-)
I think __PHP_Incomplete_Class isn't the issue as much as someone maliciously sneaking in "the wrong class". A class that really does exist but is not the one intended by the dev.
Deserializing JSON to an object is only an order of magnitude slower than unserialize(). :-P
@Crell That's what the allowed_classes is intended to protect against.
Right, which is why one should use it if possible. :-)
Calling unserialize() on untrusted input, without allowed_classes=false is RCEaaS.
 
6 hours later…
21:11
@Trowski Was only 1 parameter for time_nanosleep on purpose? It requires 2 args: github.com/php/php-src/blob/master/Zend/tests/fibers/…
I screwed up the executor (I think) and it executed, causing an exception because of bad args.
@LeviMorrison Nope. Seems the process never sleeps before the signal is dispatched.
@Trowski I screwed up the VM interrupt ^_^
22:11
@Girgias For the static inline changes for spl/session, should I target PHP 8.2? Asking because I see something that warns in the file on PHP 8.2 which has been fixed recently (no BC break, it's a mismatch):
/usr/local/src/php/ext/session/session.c:1299:20: warning: conflicting types for 'php_session_send_cookie' due to enum/integer mismatch; have 'zend_result(void)' {aka 'ZEND_RESULT_CODE(void)'} [-Wenum-int-mismatch]
 1299 | static zend_result php_session_send_cookie(void) /* {{{ */
      |                    ^~~~~~~~~~~~~~~~~~~~~~~
/usr/local/src/php/ext/session/session.c:100:12: note: previous declaration of 'php_session_send_cookie' with type 'int(void)'
  100 | static int php_session_send_cookie(void);
I expected that we'd port such things to all maintained branches.
@LeviMorrison Yeah sure, I don't really see the issue with that as it can't change the ABI
I think it was ported somewhat? might have missed that case
This specific one was fixed as part of some wider changes which changed signatures: github.com/php/php-src/commit/….
Yeah I think you can fix it because static

« first day (5029 days earlier)      last day (137 days later) »