Re: [PEAR-QA] is_a() and the need for improved testing

On 2011-08-29 03:04, Daniel O'Connor wrote:

>> As you may have noticed or heard about, is_a() was modified in 5.3.7.
>> One issue was adding a warning if the first argument wasn't an object,
>> though that was removed before 5.3.7 went out the door.  Another issue
>> is autoload being called if the first argument is a string:
>>        https://bugs.php.net/bug.php?id=55475
>>    http://marc.info/?t=131399222400001&r=1&w=2
>>    http://marc.info/?l=php-internals&m=131415106807521&w=2
>>
>> Un-reverting the fix for PEAR bug 18656 (done in r313340) (or something
>> along those lines) PLUS fixing the other uses of is_a() througout pear-core
>> and getting a new release out the door seems prudent.
>>
>> Then Alan provided a list of all uses of is_a() in all PEAR packages:
>>    http://marc.info/?l=php-internals&m=131432741919689&w=2
>> I've take care of the is_a() usage in DB and XML_RPC and will get releases
>> out soon.

Please, give it higher priority. This is a security issue.

Imagine a system where autoloader is used and it calls e.g.
include_once. Then

// It can be any local or remote file location
$var = 'http://some.site/script.php';
if (PEAR::isError($var))
    ....

Of course you can say it's autoloader's fault, but hey, it wasn't an
issue before PHP 5.3.7. I hope, at least main PEAR package would be
fixed and released soon.

-- 
Aleksander 'A.L.E.C' Machniak
LAN Management System Developer [http://lms.org.pl]
Roundcube Webmail Developer  [http://roundcube.net]
---------------------------------------------------
PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl