Re: FFI & Security
| From: | Stanislav Malyshev | Date: | Mon, 14 Oct 2019 07:47:31 +0000 |
| Subject: | Re: FFI & Security | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-107535@lists.php.net to get a copy of this message | ||
Hi!
> Recently we voted on classification criteria for security bugs [1], we
> include under "not an issue" any issue that "requires invocation of
> specific code, which may be valid but is obviously malicious".
>
> I would like to add an explicit clause under the "not an issue" section for
> anything related to FFI.
I agree, most of the issues with regard to FFI would not qualify as
security issues, and we may as well state that explicitly.
--
Stas Malyshev
smalyshev@gmail.com