iliaa Mon Dec 18 04:22:05 2006 UTC
Added files: (Branch: PHP_5_2)
/php-src/ext/filter/tests 042.phpt 043.phpt
Modified files:
/php-src/ext/filter sanitizing_filters.c
/php-src/ext/filter/tests 025.phpt
/php-src/ext/standard string.c
/php-src NEWS
Log:
Filter fixes:
Fixed possible double encoding problem with sanitizing filters
Make use of space-strict strip_tags() function
http://cvs.php.net/viewvc.cgi/php-src/ext/filter/sanitizing_filters.c?r1=1.11.2.5&r2=1.11.2.6&diff_format=u
Index: php-src/ext/filter/sanitizing_filters.c
diff -u php-src/ext/filter/sanitizing_filters.c:1.11.2.5
php-src/ext/filter/sanitizing_filters.c:1.11.2.6
--- php-src/ext/filter/sanitizing_filters.c:1.11.2.5 Tue Oct 3 11:42:23 2006
+++ php-src/ext/filter/sanitizing_filters.c Mon Dec 18 04:22:04 2006
@@ -16,7 +16,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: sanitizing_filters.c,v 1.11.2.5 2006/10/03 11:42:23 pajoye Exp $ */
+/* $Id: sanitizing_filters.c,v 1.11.2.6 2006/12/18 04:22:04 iliaa Exp $ */
#include "php_filter.h"
#include "filter_private.h"
@@ -27,52 +27,29 @@
/* }}} */
/* {{{ HELPER FUNCTIONS */
-static void php_filter_encode_html(zval *value, const char* chars, int
encode_nul)
+static void php_filter_encode_html(zval *value, const unsigned char *chars)
{
- register int x, y;
smart_str str = {0};
int len = Z_STRLEN_P(value);
- char *s = Z_STRVAL_P(value);
+ unsigned char *s = (unsigned char *)Z_STRVAL_P(value);
+ unsigned char *e = s + len;
if (Z_STRLEN_P(value) == 0) {
return;
}
- for (x = 0, y = 0; len--; x++, y++) {
- if (strchr(chars, s[x]) || (encode_nul && s[x] == 0)) {
+ while (s < e) {
+ if (chars[*s]) {
smart_str_appendl(&str, "&#", 2);
- smart_str_append_long(&str, s[x]);
+ smart_str_append_unsigned(&str, (unsigned long)*s);
smart_str_appendc(&str, ';');
} else {
- smart_str_appendc(&str, s[x]);
+ /* XXX: this needs to be optimized to work with blocks
of 'safe' chars */
+ smart_str_appendc(&str, *s);
}
+ s++;
}
- smart_str_0(&str);
- efree(Z_STRVAL_P(value));
- Z_STRVAL_P(value) = str.c;
- Z_STRLEN_P(value) = str.len;
-}
-
-static void php_filter_encode_html_high_low(zval *value, long flags)
-{
- register int x, y;
- smart_str str = {0};
- int len = Z_STRLEN_P(value);
- unsigned char *s = (unsigned char *)Z_STRVAL_P(value);
- if (Z_STRLEN_P(value) == 0) {
- return;
- }
-
- for (x = 0, y = 0; len--; x++, y++) {
- if (((flags & FILTER_FLAG_ENCODE_LOW) && (s[x] < 32)) ||
((flags & FILTER_FLAG_ENCODE_HIGH) && (s[x] > 127))) {
- smart_str_appendl(&str, "&#", 2);
- smart_str_append_unsigned(&str, s[x]);
- smart_str_appendc(&str, ';');
- } else {
- smart_str_appendc(&str, s[x]);
- }
- }
smart_str_0(&str);
efree(Z_STRVAL_P(value));
Z_STRVAL_P(value) = str.c;
@@ -181,9 +158,28 @@
void php_filter_string(PHP_INPUT_FILTER_PARAM_DECL)
{
size_t new_len;
-
+ unsigned char enc[256] = {0};
+
+ /* strip high/strip low ( see flags )*/
+ php_filter_strip(value, flags);
+
+ if (!(flags & FILTER_FLAG_NO_ENCODE_QUOTES)) {
+ enc['\''] = enc['"'] = 1;
+ }
+ if (flags & FILTER_FLAG_ENCODE_AMP) {
+ enc['&'] = 1;
+ }
+ if (flags & FILTER_FLAG_ENCODE_LOW) {
+ memset(enc, 1, 32);
+ }
+ if (flags & FILTER_FLAG_ENCODE_HIGH) {
+ memset(enc + 127, 1, sizeof(enc) - 127);
+ }
+
+ php_filter_encode_html(value, enc);
+
/* strip tags, implicitly also removes \0 chars */
- new_len = php_strip_tags(Z_STRVAL_P(value), Z_STRLEN_P(value), NULL,
NULL, 0);
+ new_len = php_strip_tags(Z_STRVAL_P(value), Z_STRLEN_P(value), NULL,
NULL, -1);
Z_STRLEN_P(value) = new_len;
if (new_len == 0) {
@@ -191,21 +187,6 @@
ZVAL_EMPTY_STRING(value);
return;
}
-
- if (! (flags & FILTER_FLAG_NO_ENCODE_QUOTES)) {
- /* encode ' and " to numerical entity */
- php_filter_encode_html(value, "'\"", 0);
- }
- /* strip high/strip low ( see flags )*/
- php_filter_strip(value, flags);
-
- /* encode low/encode high flags */
- php_filter_encode_html_high_low(value, flags);
-
- /* also all the flags - & encode as %xx */
- if (flags & FILTER_FLAG_ENCODE_AMP) {
- php_filter_encode_html(value, "&", 0);
- }
}
/* }}} */
@@ -222,11 +203,21 @@
/* {{{ php_filter_special_chars */
void php_filter_special_chars(PHP_INPUT_FILTER_PARAM_DECL)
{
+ unsigned char enc[256] = {0};
+
+ php_filter_strip(value, flags);
+
/* encodes ' " < > & \0 to numerical entities */
- php_filter_encode_html(value, "'\"<>&", 1);
+ enc['\''] = enc['"'] = enc['<'] = enc['>'] = enc['&'] = enc[0] = 1;
+
/* if strip low is not set, then we encode them as &#xx; */
- php_filter_strip(value, flags);
- php_filter_encode_html_high_low(value, FILTER_FLAG_ENCODE_LOW | flags);
+ memset(enc, 1, 32);
+
+ if (flags & FILTER_FLAG_ENCODE_HIGH) {
+ memset(enc + 127, 1, sizeof(enc) - 127);
+ }
+
+ php_filter_encode_html(value, enc);
}
/* }}} */
@@ -235,11 +226,21 @@
{
/* Only if no flags are set (optimization) */
if (flags != 0 && Z_STRLEN_P(value) > 0) {
+ unsigned char enc[256] = {0};
+
php_filter_strip(value, flags);
+
if (flags & FILTER_FLAG_ENCODE_AMP) {
- php_filter_encode_html(value, "&", 0);
+ enc['&'] = 1;
}
- php_filter_encode_html_high_low(value, flags);
+ if (flags & FILTER_FLAG_ENCODE_LOW) {
+ memset(enc, 1, 32);
+ }
+ if (flags & FILTER_FLAG_ENCODE_HIGH) {
+ memset(enc + 127, 1, sizeof(enc) - 127);
+ }
+
+ php_filter_encode_html(value, enc);
}
}
/* }}} */
http://cvs.php.net/viewvc.cgi/php-src/ext/filter/tests/025.phpt?r1=1.4.2.1&r2=1.4.2.2&diff_format=u
Index: php-src/ext/filter/tests/025.phpt
diff -u php-src/ext/filter/tests/025.phpt:1.4.2.1
php-src/ext/filter/tests/025.phpt:1.4.2.2
--- php-src/ext/filter/tests/025.phpt:1.4.2.1 Tue Oct 3 02:16:52 2006
+++ php-src/ext/filter/tests/025.phpt Mon Dec 18 04:22:04 2006
@@ -17,7 +17,7 @@
string(0) ""
string(0) ""
string(12) "[EMAIL PROTECTED]&*()'""
-string(32) "[EMAIL PROTECTED]&*()&#39;&#34;"
+string(24) "[EMAIL PROTECTED]&*()'""
string(11) "`1234567890"
string(5) "`123`"
string(1) "."
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.31&r2=1.445.2.14.2.32&diff_format=u
Index: php-src/ext/standard/string.c
diff -u php-src/ext/standard/string.c:1.445.2.14.2.31
php-src/ext/standard/string.c:1.445.2.14.2.32
--- php-src/ext/standard/string.c:1.445.2.14.2.31 Wed Dec 13 15:39:12 2006
+++ php-src/ext/standard/string.c Mon Dec 18 04:22:04 2006
@@ -18,7 +18,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: string.c,v 1.445.2.14.2.31 2006/12/13 15:39:12 iliaa Exp $ */
+/* $Id: string.c,v 1.445.2.14.2.32 2006/12/18 04:22:04 iliaa Exp $ */
/* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
@@ -4143,7 +4143,7 @@
case '\0':
break;
case '<':
- if (isspace(*(p + 1))) {
+ if (isspace(*(p + 1)) && allow_len >=- 0) {
goto reg_char;
}
if (state == 0) {
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.433&r2=1.2027.2.547.2.434&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.547.2.433 php-src/NEWS:1.2027.2.547.2.434
--- php-src/NEWS:1.2027.2.547.2.433 Sun Dec 17 18:22:53 2006
+++ php-src/NEWS Mon Dec 18 04:22:05 2006
@@ -51,6 +51,8 @@
. Added "default" option that allows a default value to be set for
an invalid or missing value.
. Invalid filters fails instead of returning unsafe value
+ . Fixed possible double encoding problem with sanitizing filters
+ . Make use of space-strict strip_tags() function
- Fixed FastCGI impersonation for persistent connections on Windows. (Dmitry)
- Fixed wrong signature initialization in imagepng (Takeshi Abe)
- Added optimization for imageline with horizontal and vertial lines (Pierre)
http://cvs.php.net/viewvc.cgi/php-src/ext/filter/tests/042.phpt?view=markup&rev=1.1
Index: php-src/ext/filter/tests/042.phpt
+++ php-src/ext/filter/tests/042.phpt
http://cvs.php.net/viewvc.cgi/php-src/ext/filter/tests/043.phpt?view=markup&rev=1.1
Index: php-src/ext/filter/tests/043.phpt
+++ php-src/ext/filter/tests/043.phpt
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
