I suggest using "poka-yoke" more often - it's a great concept with a cool name ;).
http://blog.astrumfutura.com/archives/260-Doing-the-Poka-Yoke.html Many many moons ago I wrote about it. Pádraic Brady http://blog.astrumfutura.com http://www.patternsforphp.com OpenID Europe Foundation Member-Subscriber ----- Original Message ---- From: Matthew Weier O'Phinney <[EMAIL PROTECTED]> To: [email protected] Sent: Wednesday, July 30, 2008 8:14:35 PM Subject: Re: [fw-general] Cross site scripting inZend_Db_Statement_Exception handling -- Terre Porter <[EMAIL PROTECTED]> wrote (on Wednesday, 30 July 2008, 02:54 PM -0400): > >Matthew wrote: > >The potential failure here is that Zend_View probably should be escaping > variables by > >default, and this is an improvement slated for 2.0.0. > > Is this for all fields that are sent to a view? > > Are we talking about something like: > > $this->view->myvar = "blah"; > > And that being automatically escaped ? > > What happens if I pass pre-HTML-escaped value to the view, do I get those > annoying extra \\ in there? > > What if I pass a pre-processed html or another view? Ajax for example. > > However, I could be confused on what is going to be escaped. First off, 2.0.0 is not for another year at the earliest, so let's not get too worked up. :) Second, if we escape by default, there will be a method for pulling the raw value, so that you can prevent any double escaping (or any escaping at all). The idea is to have a poka-yoke -- do the right thing by default and protect developers from mistakes, and provide functionality for knowledgable developers to work around the system on a case-by-case basis. > -----Original Message----- > From: Matthew Weier O'Phinney [mailto:[EMAIL PROTECTED] > Sent: Wednesday, July 30, 2008 1:50 PM > To: [email protected] > Subject: Re: [fw-general] Cross site scripting inZend_Db_Statement_Exception > handling > > -- Bill Karwin <[EMAIL PROTECTED]> wrote > (on Wednesday, 30 July 2008, 10:14 AM -0700): > > Matthew Weier O'Phinney-3 wrote: > > > > > > However, you're right -- the value should be escaped. I'll escalate > > > the issue. > > > > > > > Really? Message strings in Exceptions should be HTML-escaped? > > > > If this constitutes an XSS vulnerability, then one could equally argue > > that PHP should automatically escape any error or exception output if > > it is being directed to the page. Though it's hard for PHP to know > > when to do this, because of other conditions, e.g. output buffering > > may be in effect, and PHP doesn't know whether you plan to escape the > contents of the ob. > > > > My point is that escaping output is the responsibility of the > > application, not the framework (or the language). Only the > > application developer knows when it's the right thing to do. > > When I discovered that the original string is generated by PDO, I came to > the same conclusion. This is not a failure on ZF's part, but a failure on > the developer to (a) prevent exceptions showing in their output, and (b) not > escaping the output when they did allow exceptions to be shown. > > The potential failure here is that Zend_View probably should be escaping > variables by default, and this is an improvement slated for 2.0.0. > > -- > Matthew Weier O'Phinney > Software Architect | [EMAIL PROTECTED] > Zend Framework | http://framework.zend.com/ > -- Matthew Weier O'Phinney Software Architect | [EMAIL PROTECTED] Zend Framework | http://framework.zend.com/
