ID:               49785
 Comment by:       mcdmaster at auone dot jp
 Reported By:      hello at iwamot dot com
 Status:           Assigned
 Bug Type:         Strings related
 Operating System: *
 PHP Version:      5.3.0
 Assigned To:      moriyoshi
 New Comment:

I agree with Iwamot.

Jani seems that he's reluctant for all the CJK-related issues, though 
this issue specifically makes not only CJK users but also all the UTF-8

people suffer security damages e.g. XSS exploits with invalid character

code(s) injected.

It's obvious for Jani to do mix-up between this issue and the bug 
#43896, which is supposed as duplicated as he insists. I'm sure that he

should recognize that each of those issues is entirely apart, even 
though its fundamental cause were the same.

The patch that Iwamot has provided should be reviewed ASAP and made 
official. Thank you Iwamot!


Previous Comments:
------------------------------------------------------------------------

[2009-10-09 05:46:09] [email protected]

This is a valid bug IMO.

------------------------------------------------------------------------

[2009-10-06 19:51:56] hello at iwamot dot com

If #43896, Jani's comment doesn't make sense. I suppose that you
developers can change htmlspecialchars() to be more STRICT.

------------------------------------------------------------------------

[2009-10-06 12:38:05] hello at iwamot dot com

Could you tell me the report number?

------------------------------------------------------------------------

[2009-10-06 12:12:24] [email protected]

Please do not submit the same bug more than once. An existing
bug report already describes this very problem. Even if you feel
that your issue is somewhat different, the resolution is likely
to be the same. 

Thank you for your interest in PHP.



------------------------------------------------------------------------

[2009-10-06 11:40:05] hello at iwamot dot com

Description:
------------
Suppose htmlspecialchars() should check byte sequence more strictly for
security reasons. An XSS exploit code has been unveiled.
http://d.hatena.ne.jp/t_komura/20091004/1254665511 [ja]

I wrote a primitive patch.
http://iwamot.com/misc/html.c.patch.20091006
I don't know whether it is useful though :)

Reproduce code:
---------------
// overlong UTF-8 sequence
echo htmlspecialchars("A\xC0\xAF&",     ENT_QUOTES, 'UTF-8');
// invalid Shift_JIS sequence
echo htmlspecialchars("B\x80&",         ENT_QUOTES, 'Shift_JIS');
echo htmlspecialchars("C\x81\x7f&",     ENT_QUOTES, 'Shift_JIS');
// invalid EUC-JP sequence
echo htmlspecialchars("D\x80&",         ENT_QUOTES, 'EUC-JP');
echo htmlspecialchars("E\xA1\xFF&",     ENT_QUOTES, 'EUC-JP');
echo htmlspecialchars("F\x8E\xFF&",     ENT_QUOTES, 'EUC-JP');
echo htmlspecialchars("G\x8F\xA1\xFF&", ENT_QUOTES, 'EUC-JP');

Expected result:
----------------
output nothing

Actual result:
--------------
A_&B_&C&D_&E__&F__&G___&
("_" means an invalid byte)


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=49785&edit=1

Reply via email to