RE: [PHP-DEV] JSON inclusion in core
| From: | Jared Williams | Date: | Sat, 21 Jan 2006 16:44:46 +0000 |
| Subject: | RE: [PHP-DEV] JSON inclusion in core | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-21628@lists.php.net to get a copy of this message | ||
>
> At 04:25 AM 1/21/2006, Jared Williams wrote:
> >What are the security implications of doing this?
> >Creating objects based on a string from a untrusted source seems not
> >good idea, unless can prevent tampering (with an HMAC or something).
>
> Well I think the right thing to do is pass an array of "allowed"
> classes into json_decode() and raise an error/exception if
> it's not in the list.
Perhaps just an interface? Like Traversable, means don't have to maintain an array.
Jared