Re: Categorising engine bugs caused by nonsensical/malicious callback handlers as Undefined Behaviour and to not fix them

On Tue, Sep 8, 2026 at 9:08 AM Ilija Tovilo <tovilo.ilija@gmail.com> wrote: > > As such I'd like to hear the opinions of Internals on if we can come to > a consensus (ideally without an RFC...) that registering callbacks that > mess around with state in non-intended ways is Undefined Behaviour (UB). > > I'd still very much be in favor of fixing these issues, mainly because > they are a big time sink for the security team as well, due to > false-positive reports. Arnaud and I were planning on proposing an RFC > that mitigates at least a large portion of them, before we got occupied > with other things. > That is absolutely the ideal fix for this class of issues. > > I absolutely do not think each case should be considered individually, > because we already tried this and the issues never stop coming. > True, but UB exists outside that class and those issues are worth the attention imho. -- Ilia Alshanetsky Technologist, CTO, Entrepreneur E: ilia@ilia.ws T: @iliaa B: http://ilia.ws