Hi,
Here is a patch to fix bug #42718:
http://bugs.php.net/?id=42718&edit=1
The "unsafe_raw" filter is not applied when configured as default
filter.
I found that the php_sapi_filter() internal function in
ext/filter/filter.c intentionally bypass this filter:
if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW)){
(apply default filter)
} else [...]
The unsafe_raw filter does nothing by default, but it
can "optionally strip or encode special characters", and it is the
only filter which is able to do that without doing any other
filtering.
I suggest to not bypass the unsafe_raw filter when default_filter_flags is
different than 0 (bug42718.patch attached).
I also wrote a testcase for this bug: bug42718.phpt.
And an other testcase (052.phpt) to check if the patch does not modify the
behavior of the php_sapi_filter() function:
- Apply filter, only if filter will do something (unsafe_raw with no
flags do nothing)
- Else, fallback to magic_quotes_gpc if enabled
Regards
Index: ext/filter/filter.c
===================================================================
RCS file: /repository/php-src/ext/filter/filter.c,v
retrieving revision 1.52.2.39
diff -u -r1.52.2.39 filter.c
--- ext/filter/filter.c 4 Apr 2007 20:50:26 -0000 1.52.2.39
+++ ext/filter/filter.c 23 Sep 2007 15:45:21 -0000
@@ -403,7 +403,7 @@
Z_STRLEN(new_var) = val_len;
Z_TYPE(new_var) = IS_STRING;
- if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW)) {
+ if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW) || IF_G(default_filter_flags) != 0) {
zval *tmp_new_var = &new_var;
Z_STRVAL(new_var) = estrndup(*val, val_len);
INIT_PZVAL(tmp_new_var);
--TEST--
Bug #42718 (unsafe_raw filter not applied when configured as default filter)
--SKIPIF--
<?php if (!extension_loaded("filter")) die("skip"); ?>
--INI--
magic_quotes_gpc=0
filter.default=unsafe_raw
filter.default_flags=4
--GET--
a=1%00
--FILE--
<?php
echo ini_get('filter.default') . "\n";
echo ini_get('filter.default_flags') . "\n";
echo addcslashes($_GET['a'],"\0") . "\n";
?>
--EXPECT--
unsafe_raw
4
1
--TEST--
fallback to magic_quotes when no filter is to be applied
--SKIPIF--
<?php if (!extension_loaded("filter")) die("skip"); ?>
--INI--
magic_quotes_gpc=1
filter.default=unsafe_raw
filter.default_flags=
--GET--
a=1%00
--FILE--
<?php
echo ini_get('filter.default') . "\n";
echo ini_get('filter.default_flags') . "\n";
echo addcslashes($_GET['a'],"\0") . "\n";
?>
--EXPECT--
unsafe_raw
1\0
--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php
