Re: Preliminary PHP taint support available
| From: | (Wietse Venema) | Date: | Thu, 08 Nov 2007 13:27:59 +0000 |
| Subject: | Re: Preliminary PHP taint support available | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-33063@lists.php.net to get a copy of this message | ||
Christian Schneider:
> First of all: I've been playing around with it and it looks great!
>
> Some comments:
> 1) I added taint support to func_get_args() and func_get_arg(), a patch
> is attached.
Thanks. I will add a .phpt test script so that from now on it will
always work.
> 2) Maybe the functions should be renamed to taint_xxx (e.g. taint_set,
> taint_clear, taint_check or the like) to reside in their own 'namespace'.
I hope to revise the user interface after I have caught up with
PHP 5.2.5. The longer I wait the harder it will be.
> I hope your work will be integrated in the main PHP tree as it provides
> a useful tool to developers IMHO.
>
> For now I plan to use your patch on our development machines so I might
> have more feedback in the near future.
Wietse