ID: 49785 Updated by: [email protected] Reported By: hello at iwamot dot com -Status: Open +Status: Bogus Bug Type: Strings related Operating System: all PHP Version: 5.3.0 New Comment:
Please do not submit the same bug more than once. An existing bug report already describes this very problem. Even if you feel that your issue is somewhat different, the resolution is likely to be the same. Thank you for your interest in PHP. Previous Comments: ------------------------------------------------------------------------ [2009-10-06 11:40:05] hello at iwamot dot com Description: ------------ Suppose htmlspecialchars() should check byte sequence more strictly for security reasons. An XSS exploit code has been unveiled. http://d.hatena.ne.jp/t_komura/20091004/1254665511 [ja] I wrote a primitive patch. http://iwamot.com/misc/html.c.patch.20091006 I don't know whether it is useful though :) Reproduce code: --------------- // overlong UTF-8 sequence echo htmlspecialchars("A\xC0\xAF&", ENT_QUOTES, 'UTF-8'); // invalid Shift_JIS sequence echo htmlspecialchars("B\x80&", ENT_QUOTES, 'Shift_JIS'); echo htmlspecialchars("C\x81\x7f&", ENT_QUOTES, 'Shift_JIS'); // invalid EUC-JP sequence echo htmlspecialchars("D\x80&", ENT_QUOTES, 'EUC-JP'); echo htmlspecialchars("E\xA1\xFF&", ENT_QUOTES, 'EUC-JP'); echo htmlspecialchars("F\x8E\xFF&", ENT_QUOTES, 'EUC-JP'); echo htmlspecialchars("G\x8F\xA1\xFF&", ENT_QUOTES, 'EUC-JP'); Expected result: ---------------- output nothing Actual result: -------------- A_&B_&C&D_&E__&F__&G___& ("_" means an invalid byte) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=49785&edit=1
