Skip to content

Instantly share code, notes, and snippets.

@rdlowrey

rdlowrey/strict-scalars.php

Last active August 29, 2015 14:15
Show Gist options
  • Save rdlowrey/0d4a57dc56c70be303a7 to your computer and use it in GitHub Desktop.
Save rdlowrey/0d4a57dc56c70be303a7 to your computer and use it in GitHub Desktop.
Download ZIP
Are you *sure* you don't need strict scalar typehints?
Raw
strict-scalars.php
<?php
$ch = curl_init();
// 1: only verify that the peer cert HAS a name field
// 2: verify that the name ACTUALLY matches the domain you connected to
// true: cast to 1
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, true);
// Mercifully the newest versions of libcurl now disable 1 for this setting.
// This is a prime example of undetectable scalar conversion catastrophe.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment