Re: Run-time taint support proposal
| From: | Ilia Alshanetsky | Date: | Sat, 16 Dec 2006 00:04:10 +0000 |
| Subject: | Re: Run-time taint support proposal | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-27011@lists.php.net to get a copy of this message | ||
On 15-Dec-06, at 7:01 PM, Stanislav Malyshev wrote:
Something that most servers do (almost 80% by recent stats). http://www.nexen.net/images/stories/phpinfos/display_errors.png Ilia Alshanetskythe harm. One simple exploit leading to information disclosure is to pass it an array() causing the function to generate an error exposing the script's path.You mean when running with display_errors = on? Ouch.
