3 ms·
I specifically said "large PHP applications" instead of just "PHP applications" because the difficulty is not in writing, it's in auditing and enforcing. Even
by lucideer 5y ago
I specifically said "large PHP applications" instead of just "PHP applications" because the difficulty is not in writing, it's in auditing and enforcing.
Even within templating libraries there are different levels of advancement around context-awareness: e.g. <div onclick="{{ val }}"> is still dangerous in languages like Twig, and is similarly challenging to audit. Alternatives like Latte mitigate this but even Twig is still a large degree easier to work with than vanilla PHP.
- omgitsabird 5y ago"Large PHP applications" doesn't immediately express to me that you combine styles, scripts, and markup in your templates and have a need for automated context-aware escaping.
- lucideer 5y agoIt doesn't need to. "Large PHP application" just means "at scale", in terms of LoC, and - most likely - contributors. Which means (a) potentially anything may be combined in templates by somebody at some point without careful manual code-review, which is difficult to audit at scale, and (b) there are a larger number of files to audit, likely with a degree of complexity to their overall structure, which further adds to that difficulty.
- omgitsabird 5y agoYou can overcome this using a linter that doesn't allow expressions in those contexts, no?