> I find it fascinating that people are putting so much efforts optimizing exploitation techniques, yet ~nobody bothers fixing them, even if it only takes a couple of lines of code and 20 minutes. Like it or not, exploiting seems just more fun and rewarding. A lot of people will be interested to learn on your blog how you came to find and exploit a vulnerability. The 10 line of code patch gets little attention. Not e…
Upcoming Hardening in PHP
61–70 of 130 posts
Re: Upcoming Hardening in PHP
#62> Suggestion to make those parts read-only was rejected as a 0.6% performance impact was deemed too expensive for too little gain. Big Oof. :( :( :(
At a large PHP shop, 0.6% can be tens of millions of dollars.
Re: Upcoming Hardening in PHP
#63Something I'd really like is for PHP to somehow be stricter on the number of arguments passed to a function. As of now, PHP emits an error if arguments are missing but not if there are too many. A way to bake that in without breaking old code would be to allow function definition to put an explicit stop to the argument list, for example using the void type keyword: function foo (int $a, string $b, void) : bool { ...…
Re: Upcoming Hardening in PHP
#64Something I'd really like is for PHP to somehow be stricter on the number of arguments passed to a function. As of now, PHP emits an error if arguments are missing but not if there are too many. A way to bake that in without breaking old code would be to allow function definition to put an explicit stop to the argument list, for example using the void type keyword: function foo (int $a, string $b, void) : bool { ...…
FWIW, core PHP functions do throw an ArgumentCountError when passing fewer OR more parameters than the signature allows.
Re: Upcoming Hardening in PHP
#65Earlier quoted context omitted.
I'd be curious to read about what percentage of active PHP devs use the recent features. The last time I worked in a PHP codebase (2020?) was half PHP 5 (bad) and half PHP 7 (much nicer). Curious if there's any real info out there on this
php 7 has been released 9 years ago.
`if ($a) { $previouslyUndefined = 2; } if ($previouslyUndefined) { echo "yeah"; }`
PHP still knows what $previouslyUndefined is or isn't at the second if statement, but it'll throw an error now in the first statement if you hadn't declared it outside the block. Why? Who cares? Scope in PHP is still understood to be inline, not in block; there is no equivalent to let vs var in JS. Stop telling me where I can check a variable if you're not enforcing various kinds of scope.
Re: Upcoming Hardening in PHP
#66Something I'd really like is for PHP to somehow be stricter on the number of arguments passed to a function. As of now, PHP emits an error if arguments are missing but not if there are too many. A way to bake that in without breaking old code would be to allow function definition to put an explicit stop to the argument list, for example using the void type keyword: function foo (int $a, string $b, void) : bool { ...…
I think this would be nice ergonomically, from a coding perspective, but I'm curious as to how it would be a security threat to pass too many arguments. What's the potential exploit here?
Re: Upcoming Hardening in PHP
#67Earlier quoted context omitted.
Yup, that's even better.
That's equivalent to my initial proposal, except that mine adds the information in the type signature of the function rather than in a decorator.
Thus if understanding this right that would require to update every function signature to new behavior rather than marking a few functions to get the old behavior and automatically get the new better behavior of every other function for free.
Re: Upcoming Hardening in PHP
#68Re: Upcoming Hardening in PHP
#69Earlier quoted context omitted.
My complaint was adding lots of breaking changes to minor version upgrades. The fact, that historically they didn’t do breaking changes in major version upgrades does not excuse going against industry standards. There are literally companies stuck on PHP 7 because going to 8 is too painful. And honestly with my decade of experience your claim that going from 4 to 8 isn’t that painful sounds like nonsense and somethin…
Like everything... It depends. Just use rector https://github.com/rectorphp/rector
Re: Upcoming Hardening in PHP
#70Earlier quoted context omitted.
That's equivalent to my initial proposal, except that mine adds the information in the type signature of the function rather than in a decorator.
If I understood your proposal correctly, to get the new behavior add an explicit stop to the function, my proposal add attribute to keep old behavior. Thus if understanding this right that would require to update every function signature to new behavior rather than marking a few functions to get the old behavior and automatically get the new better behavior of every other function for free.