Re: Run-time taint support proposal

Hello, On 12/20/06, Stanislav Malyshev <stas@zend.com> wrote:

Now, about taint mode, is it possible to leave the input filtering for a second and explain me what else you like to do? How do you plan to manage the contexts? Do you want this horrible mode 3? Or will you I'm not sure what you mean by "contexts".

output to browser, output to system (console/whatever else), sql, xml, streams, etc... all of them require special attentions.

I suppose by "mode 3" you mean

I refer to the three mode proposed by Wietse (http://news.php.net/php.internals/27102).

mode in which tainted data output or passed to function which is not marked safe to accept tainted data causes error? Yes, I think I want it.

I do not want the mode 3, for the reasons I explained earlier. I also think many developers have the same reasons against it. It will be enabled by default by many ISP and will bring back the pain of safe_mode.

However, if you use only filtered data, you have nothing to worry about and probably would never know about tainting. However, not many of existing application work like that, unfortunately.

That's why I'm a fan of a drastic change, drop GPCES superglobals and force the developers to use the filter functions. At least it can be something the taint mode can do.

argue about input filtering, sory taint mode until next year? :) New year is in 12 days now, so I would not be surprised if the discussion continued beyond that date :)

:) --Pierre