php-win-ext/php-memcached
1
0
Fork 0
mirror of https://github.com/php-win-ext/php-memcached.git synced 2026-03-24 00:52:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

Check for spaces in keys when using the non-binary protocol even if key verification is disabled to avoid injection issues

Browse Source
This commit is contained in:
Rasmus Lerdorf
2023-10-20 08:00:37 -07:00
committed by Michael Wallner
parent da71ae0362
commit d15c2e2fdf
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
php_memcached.c
View File

@@ -231,14 +231,21 @@ zend_bool s_memc_valid_key_binary(zend_string *key)
}
static
zend_bool s_memc_valid_key_ascii(zend_string *key)
zend_bool s_memc_valid_key_ascii(zend_string *key, uint64_t verify_key)
{
const char *str = ZSTR_VAL(key);
size_t i, len = ZSTR_LEN(key);
for (i = 0; i < len; i++) {
if (!isgraph(str[i]) || isspace(str[i]))
return 0;
if (verify_key) {
for (i = 0; i < len; i++) {
if (!isgraph(str[i]) || isspace(str[i]))
return 0;
}
} else { /* if key verification is disabled, only check for spaces to avoid injection issues */
for (i = 0; i < len; i++) {
if (isspace(str[i]))
return 0;
}
}
return 1;
}
@@ -248,7 +255,7 @@ zend_bool s_memc_valid_key_ascii(zend_string *key)
ZSTR_LEN(key) > MEMC_OBJECT_KEY_MAX_LENGTH || \
(memcached_behavior_get(intern->memc, MEMCACHED_BEHAVIOR_BINARY_PROTOCOL) \
? !s_memc_valid_key_binary(key) \
: (memcached_behavior_get(intern->memc, MEMCACHED_BEHAVIOR_VERIFY_KEY) && !s_memc_valid_key_ascii(key)) \
: !s_memc_valid_key_ascii(key, memcached_behavior_get(intern->memc, MEMCACHED_BEHAVIOR_VERIFY_KEY)) \
))) { \
intern->rescode = MEMCACHED_BAD_KEY_PROVIDED; \
RETURN_FALSE; \
@@ -342,7 +349,7 @@ PHP_INI_MH(OnUpdateSessionPrefixString)
php_error_docref(NULL, E_WARNING, "memcached.sess_prefix too long (max: %d)", MEMCACHED_MAX_KEY - 1);
return FAILURE;
}
if (!s_memc_valid_key_ascii(new_value)) {
if (!s_memc_valid_key_ascii(new_value, 1)) {
php_error_docref(NULL, E_WARNING, "memcached.sess_prefix cannot contain whitespace or control characters");
return FAILURE;
}