[PHP-BUG] Bug #54391 [NEW]: escapeshellarg strip non-ascii characters

[c dot madmax at gmail dot com]

From:             
Operating system: All Debian and Ubuntu Versions
PHP version:      5.3.6
Package:          Program Execution
Bug Type:         Bug
Bug description:escapeshellarg strip non-ascii characters

Description:
------------
escapeshellarg() strip non-ascii characters if the LANG environment
variable is not set to somthing like LANG=*.ISO-8959-1 e.g.
LANG=en_US.ISO-8959-1



The job of escapeshellarg() is only to escape characters and NOT to remove
them!!! The manual say nothing about removing characters!!!



Removing characters can cause horrible results!!!



It should doesn't matter if a shell arg has a ISO-8959-1 charset or UTF-8
charset or any other charset, because it is possible that a filename has a
ISO-8959-1 charset and a other filename has a UTF-8 charset!!!



escapeshellarg() should only look for quotes and escape them, and nothing
else!!!



PS:

setlocale(LC_ALL, 'en_US.ISO-8959-1') and/or
putenv('LANG=en_US.ISO-8959-1') dosn't fix this problem! And i think even
if this work it's not good a solution!

Test script:
---------------
<?php



$path = escapeshellarg('/home/www-data/äöüÄÖÜß'); // ISO-8959-1
characters =  "\xE4\xF6\xFC\xC4\xD6\xDC\xDF" in hex format



shell_exec(sprintf('rm -fr %s', $path));



echo sprintf('%s removed', $path);



?>

Expected result:
----------------
The test script should remove the folder /home/www-data/äöüÄÖÜß and
output:



'/home/www-data/äöüÄÖÜß' removed

Actual result:
--------------
The test script remove the folder /home/www-data/ and output



'/home/www-data/' removed

-- 
Edit bug report at http://bugs.php.net/bug.php?id=54391&edit=1
-- 
Try a snapshot (PHP 5.2):            
http://bugs.php.net/fix.php?id=54391&r=trysnapshot52
Try a snapshot (PHP 5.3):            
http://bugs.php.net/fix.php?id=54391&r=trysnapshot53
Try a snapshot (trunk):              
http://bugs.php.net/fix.php?id=54391&r=trysnapshottrunk
Fixed in SVN:                        
http://bugs.php.net/fix.php?id=54391&r=fixed
Fixed in SVN and need be documented: 
http://bugs.php.net/fix.php?id=54391&r=needdocs
Fixed in release:                    
http://bugs.php.net/fix.php?id=54391&r=alreadyfixed
Need backtrace:                      
http://bugs.php.net/fix.php?id=54391&r=needtrace
Need Reproduce Script:               
http://bugs.php.net/fix.php?id=54391&r=needscript
Try newer version:                   
http://bugs.php.net/fix.php?id=54391&r=oldversion
Not developer issue:                 
http://bugs.php.net/fix.php?id=54391&r=support
Expected behavior:                   
http://bugs.php.net/fix.php?id=54391&r=notwrong
Not enough info:                     
http://bugs.php.net/fix.php?id=54391&r=notenoughinfo
Submitted twice:                     
http://bugs.php.net/fix.php?id=54391&r=submittedtwice
register_globals:                    
http://bugs.php.net/fix.php?id=54391&r=globals
PHP 4 support discontinued:          http://bugs.php.net/fix.php?id=54391&r=php4
Daylight Savings:                    http://bugs.php.net/fix.php?id=54391&r=dst
IIS Stability:                       
http://bugs.php.net/fix.php?id=54391&r=isapi
Install GNU Sed:                     
http://bugs.php.net/fix.php?id=54391&r=gnused
Floating point limitations:          
http://bugs.php.net/fix.php?id=54391&r=float
No Zend Extensions:                  
http://bugs.php.net/fix.php?id=54391&r=nozend
MySQL Configuration Error:           
http://bugs.php.net/fix.php?id=54391&r=mysqlcfg