airship

and a lot smaller to boot. Sure, use a framework. And then this happens: https://kivikakk.ee/cryptography/2016/02/20/breaking-homegro... I designed my own because, unfortunately, most of the PHP community either doesn't prioritize security enough to be trustworthy, or is simply in over their heads. We use third party libraries (Twig for templates, HTML Purifier for allowing some HTML but avoiding XSS vulnerabilities) because they're well-studied and trustworthy libraries. However, I do not trust most other PHP developers to do anything security-critical correctly. And thus, I will not design something meant to be secure based on an insecure foundation. If your only reason for Airship's status as "probably insecure" is because it's "ad-hoc" and/or "bespoke": Sorry, that's insufficient. Got a PoC handy? Otherwise: we're talking about pure hypotheticals that are far removed from the real world and there's not much point in that. You can frame your criticism as "things to make the code easier to read/understand" and whatnot, and they stand alone. Citing them as "probably a vulnerability" is questionable, however. > It's hard to tell, in this graph (https://github.com/paragonie/airship/graphs/contributors) is 'paragonie-security' a single person? For the moment, I'm the only technical person at Paragon. That will change, and that account will be delegated to signing/committing the code changes made by other employees. > As someone who works in the security industry it's just a bit tiring to see yet another homegrown PHP half-framework full of it's own intricacies and potential issues with the ever familiar problems described in all my comments above, coupled with a post saying how it was engineered to be secure from the ground up. You've raised legitimate concerns over: - Apparent NIH-syndrome, which in this case is justified - Minor code quality nits, which are now fixed - Bus factor ...but none of those are, directly, a security problem. :)

> If so, then anyone reading this thread who's aware of any vulnerabilities will be interested... This is great! I wish more companies did this. However, as stated previously, the ad-hoc nature of the code and the single-developer nature[1] makes this pretty hard to do from a code review point of view. Again, using a framework makes your code way easier to review and a lot smaller to boot. Anyone with Django experience can pick up a Django app and start to review it, rather than have to learn whatever bespoke framework the developers of the project dreamed up. Also I just wanted to add that I don't mean to come across as a dick, your project looks interesting for sure and a lot of work has gone into it. PHP CMS's need to start taking security seriously, things like Joomla and random Wordpress plugins are a blight and anything taking security seriously is great! As someone who works in the security industry it's just a bit tiring to see yet another homegrown PHP half-framework full of it's own intricacies and potential issues with the ever familiar problems described in all my comments above, coupled with a post saying how it was engineered to be secure from the ground up. 1. It's hard to tell, in this graph (https://github.com/paragonie/airship/graphs/contributors) is 'paragonie-security' a single person?

the years? https://scott.arciszewski.me/open-source/ https://paragonie.com/security/advisories I wasn't in a hurry to pick up other peoples' technical debt, especially if we're paying money for vulnerabilities: https://hackerone.com/paragonie 5. That's simply a paranoia/convenience feature. If you've got a better way to automagically convert filename.txt into filename-5.txt if filename.txt, filename-2.txt, filename-3.txt, and filename-4.txt already exist, I'm all ears. 6-10. Good eye. I think that can be refactored to repeat itself less. 11. I don't see a problem with this? 12. I don't see a problem with this either.

of places[7][8][9][10]), escaping[11], mime whitelisting[12] etc and not much about a CMS. This is where security bugs appear. 1. https://github.com/paragonie/airship/blob/eb4293aee5be59e329... 2. https://github.com/paragonie/airship/blob/c4c9384d4d7860738d... 3. https://github.com/paragonie/airship/blob/c4c9384d4d7860738d... 4. https://github.com/paragonie/airship/blob/95af23ca782e8ecb10... 5. https://github.com/paragonie/airship/blob/63cf0661ba21cbb3f3... 6. https://github.com/paragonie/airship/blob/master/src/view_fu... 7. https://github.com/paragonie/airship/blob/master/src/view_fu... 8. https://github.com/paragonie/airship/blob/master/src/view_fu... 9. https://github.com/paragonie/airship/blob/63cf0661ba21cbb3f3... 10. https://github.com/paragonie/airship/blob/2a8a87934921ecda85... 11. https://github.com/paragonie/airship/blob/eb4638eb31510028f4... 12. https://github.com/paragonie/airship/blob/eb4638eb31510028f4...