A new free-software forge: sr.ht

Posted Jan 10, 2019 3:54 UTC (Thu) by jkingweb (subscriber, #113039)
In reply to: A new free-software forge: sr.ht by lkundrak
Parent article: A new free-software forge: sr.ht

> Is the certain class of bugs likely to be present? (hello PHP!)

What class of bugs would that be, out of curiosity?

A new free-software forge: sr.ht

Posted Jan 10, 2019 7:41 UTC (Thu) by lkundrak (subscriber, #43452) [Link]

I had this on my mind: http://php.net/manual/en/security.globals.php
Likely not relevant for present-day PHP which I don't know much about

Then there's other such classes; i.e. you probably have somewhat higher chance of messing up handling of files with whitespace characters or begining with an "-" when writing a shell script.

A new free-software forge: sr.ht

Posted Jan 10, 2019 14:20 UTC (Thu) by domenpk (guest, #12382) [Link] (1 responses)

Very liberal type conversion can be responsible for some of those bugs. See https://www.cryptologie.net/article/268/how-to-compare-pa... for example.

A new free-software forge: sr.ht

Posted Jan 11, 2019 15:47 UTC (Fri) by jkingweb (subscriber, #113039) [Link]

I had been under the mistaken impression that such string insanity had ended, but apparently only some forms have to date been stamped out; notably 0eAnything is still alive and well, it seems. :(