Re: HashDoS

2016-09-22 20:10 GMT+02:00 Jakub Zelenka <bukka@php.net>: > On Thu, Sep 22, 2016 at 10:54 AM, Rowan Collins <rowan.collins@gmail.com> > wrote: > > > On 22/09/2016 10:48, Jakub Zelenka wrote: > > > >> > >> Nope the point of the Bob's patch is to use graceful handling with > >> exception that can be easily checked by the json parser for example! See > >> https://github.com/php/php-src/pull/1706 > >> > > > > Ah, I stand corrected, I hadn't seen that version referenced before. > > > > Am I right in thinking that the idea here is that if the context is > > exception-safe it can opt in to a more graceful handling mechanism? And > > that if not, it will go ahead and bail out as in Niki's patch? > > > > > Yeah it introduces new functions for updating hash which is used by json > for updating array and it's also in std object handler which is used when > updating json object. For some other bits like updating array, it will stay > with fatal. The thing is that json parser can then easily check if there > was an exception and if so, it will set JSON_ERROR_DEPTH and clear it. It > seems much better though. But why JSON_ERROR_DEPTH and not a new constant? Regards, Niklas