Re: Security Audit Priorities

Hello, On Mon, Sep 25, 2023, 3:49 PM Derick Rethans <derick@php.net> wrote: > . > > Typical areas would be where user input can be (automatically read) > remotely, such as > our RFC 1867 HTTP header parser. But we are sure there are other > important areas as well, and we would like your input. > > So, if you can suggest an area where doing an external review would have > high impact, please reply to this email. > thanks for the feedback request :) the sapi in general (and the underlying used APIs, like http headers you mentioned) would be on top on my mind. The embedded sapi may take more importance soon I think. It won't be as wide as fpm but frankenphp (or similar) will see a significant increase in usage, for good reasons:) best, Pierre >