From 4fc38589cd029bf5b980b118d89f9cc870fd7828 Mon Sep 17 00:00:00 2001 From: jvoisin Date: Thu, 31 Dec 2020 19:03:10 +0100 Subject: Mention PHP8's security features --- doc/source/features.rst | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'doc') diff --git a/doc/source/features.rst b/doc/source/features.rst index b3cdd9d..2eebc88 100644 --- a/doc/source/features.rst +++ b/doc/source/features.rst @@ -161,8 +161,10 @@ without the need to invalidate any data. A nice side-effect of this feature is that it will defeat various memory corruption issues related to the complexity of ``unserialize``'s implementation, -and the amount of control if provides to an attacker, like `CVE-2016-9137, CVE-2016-9138 `_, -`2016-7124 `_, `CVE-2016-5771 and CVE-2016-5773 `_. +and the amount of control if provides to an attacker, like `CVE-2016-9137, +CVE-2016-9138 `_, `2016-7124 +`_, `CVE-2016-5771 and CVE-2016-5773 +`_. Examples of related vulnerabilities @@ -327,6 +329,8 @@ and various other types mismatch. This feature is largely inspired from the `autostrict `_ module from `krakjoe `__. +PHP8 already has [this feature](https://wiki.php.net/rfc/consistent_type_errors) for internal functions. + .. _sloppy-comparisons-feature: @@ -349,6 +353,9 @@ but also the `in_array `__ and `array_keys `__ functions. +PHP8 is implementing [a subset](https://wiki.php.net/rfc/consistent_type_errors) of this feature. + + .. _readonly-exec-feature: Preventing execution of writable PHP files -- cgit v1.3