Re: [RFC] throwable_string_param_max_len: Configurable string length in getTraceAsString()
| From: | tyson andre | Date: | Sat, 27 Jun 2020 18:52:17 +0000 |
| Subject: | Re: [RFC] throwable_string_param_max_len: Configurable string length in getTraceAsString() | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-110749@lists.php.net to get a copy of this message | ||
Hi Dan Ack,
> Also, I didn't understand why there was a problem with formatting
> traces in userland. I saw a link to some code, but no clear
> description of what the problem was.
I expanded the description of how
getTraceAsString() might be improperly used in
existing code and moved it to
https://wiki.php.net/rfc/throwable_string_param_max_len#impact_of_raising_string_param_length_limit
(and how the code would already be unsafe, but raising the limit may make the impact of unsafe code
like that worse)
(e.g. if the code or dependency may echo $exception if it was written by an author
unaware of potential https://en.wikipedia.org/wiki/Cross-site_scripting
or sensitive data exposure)
This is mostly included to explain why I don't propose raising the defaults in the RFC
- Tyson