Everything
php
Learn Community Releases The PHP Project
Home » Project » Newsgroups » php.internals » FFI & Security »

FFI & Security

php.internals

Joe Watkins

6 years ago
Morning all, Recently we voted on classification criteria for security bugs [1], we include under "not an issue" any issue that "requires invocation of specific code, which may be valid but is obviously malicious". I would like to add an explicit clause under the "not an issue" section for anything related to FFI. It hardly seems worth it to run an RFC, although I'll be happy too if there is a single dissenting voice. If there are no objections, I'll modify the document 7 days from today (Monday 21st October). Cheers Joe [1] https://wiki.php.net/security

Stas Malyshev

6 years ago
Hi!
> Recently we voted on classification criteria for security bugs [1], we > include under "not an issue" any issue that "requires invocation of > specific code, which may be valid but is obviously malicious". > > I would like to add an explicit clause under the "not an issue" section for > anything related to FFI.
I agree, most of the issues with regard to FFI would not qualify as security issues, and we may as well state that explicitly.
-- Stas Malyshev smalyshev@gmail.com

Christoph Becker

6 years ago
On 14.10.2019 at 09:44, Joe Watkins wrote:
> Recently we voted on classification criteria for security bugs [1], we > include under "not an issue" any issue that "requires invocation of > specific code, which may be valid but is obviously malicious". > > I would like to add an explicit clause under the "not an issue" section for > anything related to FFI. > > It hardly seems worth it to run an RFC, although I'll be happy too if there > is a single dissenting voice. > > If there are no objections, I'll modify the document 7 days from today > (Monday 21st October). > > Cheers > Joe > > [1] https://wiki.php.net/security
What is the status here? It seems the security classification document has not yet been updated. Cheers, Christoph

Joe Watkins

6 years ago
Morning internals, Sorry about the delay, this has now been updated.
> There was an unexpected problem communicating with SMTP: Unexpected
return code - Expected: 250, Got: 451 | 451 4.3.0 Error: queue file write error Because infrastructure ... Cheers Joe On Wed, 30 Oct 2019 at 12:41, Christoph M. Becker <cmbecker69@gmx.de> wrote: