[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 05 May 2015 08:53:42 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: PHP and some == wonkiness
On 05/04/2015 08:34 PM, Pádraic Brady wrote:
> It all boils down to PHP loose typing/type juggling for == and strict
> type comparison for ===. The first option will trigger a set of rules
> capable of converting strings into floats or integers, based on
> whether both strings are representative of a float (i.e. your
> example), or where one of the values being compared is already an
> integer/float. Unfortunately, it is indeed a common weakness to not
> use strict comparisons in security related code. For example, Laravel
> had a recent issue in comparing CSRF tokens where passing in a zero
> always passed the check from this mistake,
Oh.
But the current case apparently needs a string from a very specific set.
Do we know the digests which trigger this? If it has to be "0e"
followed by only digits on both sides, it is somewhat unlikely that you
have a reference string with this property, especially if SHA-1 is used
(around 6.84×10¯¹¹, if I'm not mistaken).
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
