Re: Re: PHP taint support: first results

Rasmus Lerdorf: > Wietse Venema wrote: > > Rasmus Lerdorf: > >> Consider very common (abbreviated) code like this: > >> > >> $user_data = $_REQUEST['data']; > >> switch($output_format) { > > > > Question: where is the output format feature documented? > > > > Once I know the output format is not HTML, then I know > > that applying HTML-style restrictions is not appropriate. > > > > I did search around but came up empty handed. > > That's just an example. People building REST-based web services will > typically include an output format parameter. Or they determine the > output format based on other criteria. It's completely up to the script > author which output format he wants to use and how he wants to make that > decision. Would perhaps the Content-Type: information be stored somewhere in HTTP response, or is this hopeless because of multi-part documents? If Content-Type: header information were available, then I could use that to choose the proper rule. As I mentioned, I don't want to get involved with guessing games. Wietse