Re: Re: PHP taint support: first results

Wietse Venema: > Rasmus Lerdorf: > > Wietse Venema wrote: > > > Rasmus Lerdorf: > > >> Consider very common (abbreviated) code like this: > > >> > > >> $user_data = $_REQUEST['data']; > > >> switch($output_format) { > > > > > > Question: where is the output format feature documented? > > > > > > Once I know the output format is not HTML, then I know > > > that applying HTML-style restrictions is not appropriate. > > > > > > I did search around but came up empty handed. > > > > That's just an example. People building REST-based web services will > > typically include an output format parameter. Or they determine the > > output format based on other criteria. It's completely up to the script > > author which output format he wants to use and how he wants to make that > > decision. > > Would perhaps the Content-Type: information be stored somewhere in > HTTP response, or is this hopeless because of multi-part documents? As shown in Rasmus's example, when the information is supplied with a header("Content-Type: foo") call before the output is echo-ed, I can determine the MIME type. I just need to hook into the header() function and do a little parsing. Thanks for clarifying this mystery. Wietse