Cool project

[Gareth]

I've had experience writing a PHP filter for wordpress and found this
project. It will be cool to integrate it with PHPIDS etc :)

Here's one problem I've found in the code:-
function _walkArray($input, $method) {
// DOS attack possible by supplying large arrays
// Multidimensional arrays should be truncated to a maximum
amount of dimensions
foreach($input as $key=>$val) {
if (is_array($val)) {
$input[$key]=Inspekt::_walkArray($val, $method);
} else {
$val = Inspekt::$method($val);
$input[$key]=$val;
}
}

[Gareth]

[Ed Finkler]

That's a good idea. Thoughts on what is a practical limit? For the
sake of form processing it wouldn't need to be very high (5 max)? If
someone were storing a large-ish hash, it could be larger, but I
expect the number of people doing that and using Inspekt to clean
access it is pretty small.

--
--
Ed Finkler
http://funkatron.com
AIM: funka7ron
ICQ: 3922133
Skype: funka7ron

[Gareth]

Yep by default it could be a low number and anyone with large amount
could set it with a function call or configuration setting.

Sorry about the double post btw but Google groups doesn't seem to like
me :)

On Jan 21, 11:43 pm, "Ed Finkler" <funkat...@gmail.com> wrote:
> That's a good idea. Thoughts on what is a practical limit? For the
> sake of form processing it wouldn't need to be very high (5 max)? If
> someone were storing a large-ish hash, it could be larger, but I
> expect the number of people doing that and using Inspekt to clean
> access it is pretty small.
>

> On Jan 21, 2008 6:10 PM, Gareth <gazhe...@gmail.com> wrote:
>
>
>
>
>
>
>
>
>
> > I've had experience writing a PHP filter for wordpress and found this
> > project. It will be cool to integrate it with PHPIDS etc :)
>
> > Here's one problem I've found in the code:-
> > function _walkArray($input, $method) {
> > // DOS attack possible by supplying large arrays
> > // Multidimensional arrays should be truncated to a maximum
> > amount of dimensions
> > foreach($input as $key=>$val) {
> > if (is_array($val)) {
> > $input[$key]=Inspekt::_walkArray($val, $method);
> > } else {
> > $val = Inspekt::$method($val);
> > $input[$key]=$val;
> > }
> > }
>
> --
> --

> Ed Finklerhttp://funkatron.com

[Ed Finkler]

On Jan 21, 2008 7:44 PM, Gareth <gazh...@gmail.com> wrote:
>
> Yep by default it could be a low number and anyone with large amount
> could set it with a function call or configuration setting.

Right. I implemented a hard-coded limit in the SVN repo last night of
10; it was quick and dirty, though, and more experienced eyes on it
would be appreciated.

> Sorry about the double post btw but Google groups doesn't seem to like
> me :)

Bastards!

--
--
Ed Finkler