Hi Dan Ack,

> Also, I didn't understand why there was a problem with formatting
> traces in userland. I saw a link to some code, but no clear
> description of what the problem was.

I expanded the description of how `getTraceAsString()` might be improperly used 
in existing code and moved it to
https://wiki.php.net/rfc/throwable_string_param_max_len#impact_of_raising_string_param_length_limit
(and how the code would already be unsafe, but raising the limit may make the 
impact of unsafe code like that worse)

(e.g. if the code or dependency may `echo $exception` if it was written by an 
author unaware of potential https://en.wikipedia.org/wiki/Cross-site_scripting 
or sensitive data exposure)

This is mostly included to explain why I don't propose raising the defaults in 
the RFC

- Tyson
--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: https://www.php.net/unsub.php

Reply via email to