Re: [PHP-DEV] [RFC] [Discuss] Random Functions Throwing Exceptions in PHP 7.0.0

Anthony Ferrara wrote on 22.08.2015 21:58:

> All,
>
> I am putting a simple RFC up for discussion to make random_* throw
> exceptions on failure in order to ensure we fail-closed.
>
> https://wiki.php.net/rfc/random-function-exceptions
>
> Considering this topic has already been discussed, I intend to open
> voting on this as soon as allowable. Given the voting policy specifies
> 2 weeks for language changes and 1 week for another, this is assumed
> to require 1 week of "discussion".
>
> With that in mind, I intend to put this RFC up to vote on August 29/30th.
>
> Thanks!
>
> Anthony
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>

Hi,

I think there are a lot of security problems if people ignore return values, e.g. password comparison, user lookup in database, lookups for permissions, etc.

Having false + E_WARNING highlighted in the documentation with a yellow box and the Caution title should be enough.

For those who want exceptions can implement this in userland:
$rand = random_int(10,100);
if ($rand === false) {
throw new Exception('error ...');
}
// or write a wrapper like random_int_exception(...).

If people use this function without reading documentation, they will also use other things without documentation like database queries without binding/escaping, inject html without escaping, etc.
Having core functions suddenly throw exceptions causes many problems in the code structure.

Regards
Thomas


--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php