rfc:escaper
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| rfc:escaper [2013/09/27 04:12] – [SPL Class or Functions?] Split into sections yohgaki | rfc:escaper [2018/06/18 10:11] (current) – This RFC appears to be inactive cmb | ||
|---|---|---|---|
| Line 3: | Line 3: | ||
| * Date: 2012-09-18 | * Date: 2012-09-18 | ||
| * Author: Pádraic Brady < | * Author: Pádraic Brady < | ||
| - | * Status: | + | * Status: |
| * First Published at: http:// | * First Published at: http:// | ||
| ===== Change Log ===== | ===== Change Log ===== | ||
| + | * 2012-09-18 Initial version edited from https:// | ||
| * 2013-09-27 Added ext/filter implementation as an option (Yasuo) | * 2013-09-27 Added ext/filter implementation as an option (Yasuo) | ||
| Line 41: | Line 42: | ||
| Including more narrowly defined and specifically targeted functions or SPL class methods into PHP will simplify the whole situation for users, offer a cohesive approach to escaping, rectify PHP's situation as only offering a partial XSS defense and, by its presence in Core, displace function misuse and homegrown escaping functions. | Including more narrowly defined and specifically targeted functions or SPL class methods into PHP will simplify the whole situation for users, offer a cohesive approach to escaping, rectify PHP's situation as only offering a partial XSS defense and, by its presence in Core, displace function misuse and homegrown escaping functions. | ||
| - | ===== Escape filter | + | ===== Escape filter |
| Implementation option as filter. | Implementation option as filter. | ||
| Line 102: | Line 103: | ||
| ===== Implementation Notes ===== | ===== Implementation Notes ===== | ||
| + | |||
| + | IMPORTANT: Since proper escape requires proper character encoding handling, multibyte string feature in core is mandatory for implementation. | ||
| I am strongly opposed to allowing these functions accept unpredictable character encoding directives via php.ini. That would require additional work to validate which is precisely what this RFC should seek to avoid. By validation, I mean having programmers determine how dependencies implement escaping, what encoding they enforce (usually the default), and then determining if it can be changed by the depending applications or if the library must be forked, re-edited, etc. Those who are concious of security will review dependencies for such issues rather than blindly trust dependencies. | I am strongly opposed to allowing these functions accept unpredictable character encoding directives via php.ini. That would require additional work to validate which is precisely what this RFC should seek to avoid. By validation, I mean having programmers determine how dependencies implement escaping, what encoding they enforce (usually the default), and then determining if it can be changed by the depending applications or if the library must be forked, re-edited, etc. Those who are concious of security will review dependencies for such issues rather than blindly trust dependencies. | ||
| Line 166: | Line 169: | ||
| The essence of this RFC is to propose including basic safe escaping functionality within PHP which addresses the need to apply context-specific escaping in web applications. By offering a simple consistent approach, it affords the opportunity to implement these specifically to target XSS and to omit other functionality that some native functions include, and which can be problematic to programmers or doesn' | The essence of this RFC is to propose including basic safe escaping functionality within PHP which addresses the need to apply context-specific escaping in web applications. By offering a simple consistent approach, it affords the opportunity to implement these specifically to target XSS and to omit other functionality that some native functions include, and which can be problematic to programmers or doesn' | ||
| - | ===== Changelog ===== | ||
| - | * 2012-09-18 Initial version edited from https:// | ||
rfc/escaper.1380255148.txt.gz · Last modified: 2017/09/22 13:28 (external edit)