A PHP internals mailing list thread discussing a proposed RFC to harden PHP against filter chain attacks by limiting the maximum number of filters allowed in php://filter URLs. The proposal suggests a default limit of 16 filters (most exploits require 50-100+), introduced first as a deprecation warning before becoming a hard error. Key design decisions debated include: whether to use an INI setting or stream context option (stream context option was favored), whether to throw a ValueError or return false/warning (consistent with stream function behavior), and whether the limit should be hardcoded or configurable. A bug in the dechunk filter that incorrectly truncates strings starting with hex characters is also addressed. The RFC is moving toward a vote on June 5, 2026.
