Hi
Am 2026-06-02 14:18, schrieb Sjoerd Langkemper:
I am starting the vote on this RFC next Friday, 5 June 2026. The RFC
suggests limiting the maximum number of filters in php://filter URLs,
for security reasons. The latest change is that the maximum number of
filters can be configured through a stream context option.
RFC: https://wiki.php.net/rfc/limit-maximum-number-of-filter-chains
Discussion thread: https://news-web.php.net/php.internals/130813
Pull request: https://github.com/php/php-src/pull/22110
Can you please clean out the “Open Issues” and add an example as to how
the `filter.max_filter_count` context option would be used (i.e. what
folks would need to write if they wanted to modify the default value)
and possibly also one showing how `stream_filter_append()` can be used
to programmatically add filters to avoid the limit? Please also fix the
title of the voting widget, it says “Implement $feature as outlined in
the RFC?”. For completeness it would also be helpful if the “Backward
Incompatible Changes” section would mention if the new context option is
forward compatible (i.e. whether it's silently ignored in existing PHP
versions).
I'm generally in favor of the proposal, but want to see the examples to
make an educated decision. These will also be helpful for the upgrading
guide if / when the RFC is accepted.
Best regards
Tim Düsterhus
