Re: [PHP-DEV] [RFC] JSON Schema validation support

2025-07-23 Thread Alexandre Daubois
Hi Jakub, Le mer. 23 juil. 2025 à 17:41, Jakub Zelenka a écrit : > In addition it could be useful to create it from array or from class (sort of > auto generate schema) Writing schema by hand is painful, so that would be amazing to see this feature land one day. > I actually took that name fr

Re: [PHP-DEV] Study on unsafe extract() usage

2025-07-23 Thread Bob Weinand
 Hey Kamil, On 23.7.2025 21:01:14, Kamil Tekiela wrote: This would prevent most of the vulnerabilities found in the dataset and we cannot think of a valid use case for allowing this behavior But not all. This function is dangerous on its own. Attack vectors are 99% throug

Re: [PHP-DEV] Study on unsafe extract() usage

2025-07-23 Thread Kamil Tekiela
> > This would prevent most of the vulnerabilities found in the dataset and we cannot think of a valid use case for allowing this behavior But not all. This function is dangerous on its own. Attack vectors are 99% through superglobals but could come from other sources too. However, this functio

[PHP-DEV] Study on unsafe extract() usage

2025-07-23 Thread Jannik Hartung
Hey everyone, as part of our security research, we studied the attack surface of the extract() function when being called with user-controlled input. Calling extract($_GET) allows an attacker to overwrite all variables in the current scope, which could lead to vulnerabilities. We analyzed the

Re: [PHP-DEV] [RFC] JSON Schema validation support

2025-07-23 Thread Jakub Zelenka
Hi Alex, On Wed, Jul 23, 2025 at 3:57 PM Alexandre Daubois < alex.daubois+...@gmail.com> wrote: > Thank you for proposing such a feature! I personally really like it > and would be glad to see this land into PHP. > I think it would be even more useful if JsonSchema offers more ways to > load a sc

Re: [PHP-DEV] [RFC] "Abstain" voting option for RFCs

2025-07-23 Thread Andreas Heigl
Hey Am 23.07.25 um 17:21 schrieb Volker Dusch: On Wed, Jul 23, 2025 at 4:30 PM Andreas Heigl wrote: Adding an Abstain in combination with one of these changes * Introducing a certain amount of minimum votes (including abstains) * Connecting voting karma to actual particiation in votes sound

Re: [PHP-DEV] [RFC] "Abstain" voting option for RFCs

2025-07-23 Thread Volker Dusch
On Wed, Jul 23, 2025 at 4:30 PM Andreas Heigl wrote: > Adding an Abstain in combination with one of these changes > > * Introducing a certain amount of minimum votes (including abstains) > * Connecting voting karma to actual particiation in votes > > sounds very reasonable and worthwile in my opi

Re: [PHP-DEV] [RFC] "Abstain" voting option for RFCs

2025-07-23 Thread Andreas Heigl
Hey Am 23.07.25 um 00:03 schrieb Tim Düsterhus: Hi Adding an "Abstain" option to RFCs was an idea that floated around multiple times in the past and it now came up again as part of (more than) one of the RFCs that recently went to vote. I've therefore finally written up a policy RFC to add s

Re: [PHP-DEV] [RFC] JSON Schema validation support

2025-07-23 Thread Alexandre Daubois
Hi Jakub Le mer. 23 juil. 2025 à 15:33, Jakub Zelenka a écrit : > > Hello, > > I would like introduce and open discussion for RFC proposing the addition of > JSON Schema validation support to JSON extension: > > https://wiki.php.net/rfc/json_schema_validation > > If this is successful, it should

Re: [PHP-DEV] [RFC] "Abstain" voting option for RFCs

2025-07-23 Thread Larry Garfield
On Tue, Jul 22, 2025, at 5:03 PM, Tim Düsterhus wrote: > Hi > > Adding an "Abstain" option to RFCs was an idea that floated around > multiple times in the past and it now came up again as part of (more > than) one of the RFCs that recently went to vote. I've therefore finally > written up a poli

Re: [PHP-DEV] [RFC] Partial Function Application v2

2025-07-23 Thread Larry Garfield
On Tue, Jul 22, 2025, at 3:18 PM, Tim Düsterhus wrote: > Hi > > Am 2025-07-22 22:02, schrieb Larry Garfield: >> It seems the discussion has quieted down and wasn't particularly >> contentious to begin with (whew), so we're just about ready for a vote. > > Would it not be appropriate to answer unan

Re: [PHP-DEV] [RFC] Partial Function Application v2

2025-07-23 Thread Larry Garfield
On Wed, Jul 23, 2025, at 3:56 AM, Tim Düsterhus wrote: > Hi > > Am 2025-06-28 07:06, schrieb Larry Garfield: >> https://wiki.php.net/rfc/partial_function_application_v2 > > I've now given the RFC an in-depth read. I have the following remarks: > > 1. > >> If the function is variadic, there are two

Re: [PHP-DEV] [RFC] Warnings for PHP 8.5

2025-07-23 Thread Tim Düsterhus
Hi Am 2025-07-23 13:30, schrieb Nicolas Grekas: About destructuring non-array values, null is a very common case that allows writing nice readable code. Here is a dummy example: if ([$a, $b] = $array[$key] ?? null) { /*...*/ } Turning this into a warning will have a significant impact for sure.

Re: [PHP-DEV] [RFC] Partial Function Application v2

2025-07-23 Thread Tim Düsterhus
Hi Am 2025-07-22 22:02, schrieb Larry Garfield: It seems the discussion has quieted down and wasn't particularly contentious to begin with (whew), so we're just about ready for a vote. However, Arnaud went on vacation and didn't remember to tell me when he'd be back. :-) So I'm going to wait

Re: [PHP-DEV] [RFC] Warnings for PHP 8.5

2025-07-23 Thread Nicolas Grekas
Le ven. 18 juil. 2025 à 14:54, Gina P. Banyard a écrit : > On Tuesday, 15 July 2025 at 18:16, Nicolas Grekas < > nicolas.grekas+...@gmail.com> wrote: > > Hi Gina, > > Le lun. 14 juil. 2025 à 18:22, Gina P. Banyard a > écrit : > >> Hello internals, >> >> Similar to the mass deprecation RFC, I wou

Re: [PHP-DEV] [RFC] Partial Function Application v2

2025-07-23 Thread Tim Düsterhus
Hi Am 2025-06-28 07:06, schrieb Larry Garfield: https://wiki.php.net/rfc/partial_function_application_v2 I've now given the RFC an in-depth read. I have the following remarks: 1. If the function is variadic, there are two additional rules: - Any positional placeholders that run into the v