Re: Preliminary PHP taint support available

Nuno Lopes: > Hi, > > It sounds cool, indeed. > The obvious question now is: how it performs with real-world applications? This is the main reason I asked for feedback from the list :-) > Have you been able to identify security bugs (either new or already known)? > I don't have time to perform these tests myself, but I would love to see > some results. I have played with very few applications. Right now I am focused on making taint easy to use, and on minimizing the performance hit. If I can keep it down at the 1-2% level, that would be great. It takes time to go through all the possible web pages, especially with unfamiliar applications. I'll let the application authors know first, should I find a serious problem. Wietse > Regards, > Nuno