Edit report at http://bugs.php.net/bug.php?id=54391&edit=1
ID: 54391
Updated by: fel...@php.net
Reported by: c dot madmax at gmail dot com
Summary: escapeshellarg strip non-ascii characters
Status: Open
Type: Bug
Package: Program Execution
Operating System: All Debian and Ubuntu Versions
PHP Version: 5.3.6
Block user comment: N
Private report: N
New Comment:
See bug #44945
Previous Comments:
------------------------------------------------------------------------
[2011-03-26 15:12:53] c dot madmax at gmail dot com
Description:
------------
escapeshellarg() strip non-ascii characters if the LANG environment
variable is not set to somthing like LANG=*.ISO-8959-1 e.g.
LANG=en_US.ISO-8959-1
The job of escapeshellarg() is only to escape characters and NOT to
remove them!!! The manual say nothing about removing characters!!!
Removing characters can cause horrible results!!!
It should doesn't matter if a shell arg has a ISO-8959-1 charset or
UTF-8 charset or any other charset, because it is possible that a
filename has a ISO-8959-1 charset and a other filename has a UTF-8
charset!!!
escapeshellarg() should only look for quotes and escape them, and
nothing else!!!
PS:
setlocale(LC_ALL, 'en_US.ISO-8959-1') and/or
putenv('LANG=en_US.ISO-8959-1') dosn't fix this problem! And i think
even if this work it's not good a solution!
Test script:
---------------
<?php
$path = escapeshellarg('/home/www-data/äöüÃÃÃÃ'); // ISO-8959-1
characters = "\xE4\xF6\xFC\xC4\xD6\xDC\xDF" in hex format
shell_exec(sprintf('rm -fr %s', $path));
echo sprintf('%s removed', $path);
?>
Expected result:
----------------
The test script should remove the folder /home/www-data/äöüÃÃÃÃ
and output:
'/home/www-data/äöüÃÃÃÃ' removed
Actual result:
--------------
The test script remove the folder /home/www-data/ and output
'/home/www-data/' removed
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/bug.php?id=54391&edit=1
