Re: Re: [PEPr] Comment on RFC::EvalForbiddance

On 8/16/2005 9:32 PM, Alexey Borzov spake the following words: >> Well, if you look over the proposal again you'll notice that there is a >> section entitled "Exceptions". This means that as long as you can >> justify >> your usage of eval() with _good_ reasons and as long as you take >> special care that nothing maliciously creeps in there, using eval() is >> fine. > > > Yes, I understood this section. But consider this: without this > proposal, if you don't like the way eval() is used in my packages you > can still open the bug report, start the thread in pear-dev, etc. We > also already have the QA team that theoretically should review the > packages for security threats like these. What exactly prevents these > guys from reviewing packages right now? Time :) We currently evaluate the first stable release of each package. We check for BC breaks and other common issues. For other releases, we have monitored the commit logs and occasionally done searches for bugs when a vulnerability comes to our attention. We have not done any really extensive security review until the recent xml_rpc problems (i.e., eval()). We are going to take a much more proactive approach from now on. But don't worry that we'll slap you or anyone else for false positives (things that may look dangerous at first glance, but are there for a good reason). If there's a really important security problem, expect us to approach the maintainer to see if we can't work out a solution. No one knows a package as well as the maintainer. :) So in short, expect to see much more of QA in the future. :) Klaus