Re: [PEPr] Comment on RFC::EvalForbiddance

On Tue Aug 16, 2005 at 09:5902AM -0400, Scott Mattocks wrote: > Martin Jansen wrote: > >Don't get me wrong -- I'm certainly not considering to ban more functions, > >but I believe that eval() is probably the best way to shoot yourself in the > >foot with PHP these days. > > I know that no one is going to turn around a propose that we ban > strpos() tomorrow but once we have the idea of banned functions we open > ourselves up for more problems. The next one on the list will probably > be __autoload() and if you can make an argument to ban that one then it > wouldn't be too hard to get __call() banned and then another function > and another... I've specifically suggested to "ban" eval() because it is darn easy to run into security trouble with it. I'm not aware of such issues with __call() and __autoload(). > Setting up a rule doesn't mean that uses of eval will be caught. It > still requires someone to go through all of the code and look for it. At another occasion Tobias mentioned something about a tool he has developed which scans the source code of the packages for certain patterns such as eval(). > Just like it does now. Security issues won't be removed by writing an > RFC. Sure, but the propability for their occurence can be reduced by this. - Martin