thekid/rfc — Issue #61: RFC 0061: No access on raw environment values
Author: thekid
Created: 2011-10-09 14:49:16+00:00
State: open
Labels: draft, rfc

Scope of Change
====
Usage of the following methods or variables through direct
access at any time is deprecated:
. $_GET
. $_POST
. $_REQUEST
. $_COOKIE
. $_FILES
. getenv()
. putenv()
. getallheaders()
. header()
. echo / print

They should exclusively be accessed by the XP core
and any XP framework output layer (-> scriptlet package).

Rationale
====
Encapsulating any access to the environment and output allows for
easier replacement of the executing "container". This simplifies
unit testing and eg. using different server APIs (eg. Apache module,
CGI, self written webserver).

Note: it is clear that there is no way of really intercepting access
and calls to the raw data; so this document expresses just a not
controllable policy.

Violating the rule leads to undefined application behaviour by
definition.

Functionality
====
n/a

Security considerations
====
n/a

Speed impact
====
Slightly slower due to an additional method call.

Dependencies
====
n/a

Related documents
====

Comments
====
- kiesel, Fri Jun 23 16:53:52 CEST 2006
should $_SERVER also be restricted?

- kiesel, Mon Jun 26 11:23:37 CEST 2006
scriptlet.xml.XmlScriptletResponse::forwardTo() uses getenv('REQUEST_URI')
but does not have request object, so this case cannot be fixed without
changing the API.

- kiesel, Mon Jun 26 13:25:46 CEST 2006
Should methods accessing those "protected" variables or methods need
to set a certain indicator (eg. a special annotation)?

Example:

#[@requestEnvironment('getenv()', '$_REQUEST')]
function getEnvValue($name, $default= NULL) {
// ...
}

Maybe there's a better name for the annotation...