php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning.

Browse Source
This commit is contained in:
Derick Rethans
2022-09-09 16:54:03 +01:00
parent 198f3f509d
commit 0611be4e82
3 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
NEWS
View File

@@ -1,5 +1,11 @@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
29 Sep 2022, PHP 7.4.31
- Core:
. Fixed bug #81727: Don't mangle HTTP variable names that clash with ones
that have a specific semantic meaning. (Derick)
09 Jun 2022, PHP 7.4.30
- mysqlnd:

15
ext/standard/tests/bug81727.phpt Normal file
View File

@@ -0,0 +1,15 @@
--TEST--
Bug #81727: $_COOKIE name starting with ..Host/..Secure should be discarded
--COOKIE--
..Host-test=ignore; __Host-test=correct; . Secure-test=ignore; . Elephpant=Awesome;
--FILE--
<?php
var_dump($_COOKIE);
?>
--EXPECT--
array(2) {
["__Host-test"]=>
string(7) "correct"
["__Elephpant"]=>
string(7) "Awesome"
}

14
main/php_variables.c
View File

@@ -115,6 +115,20 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
}
var_len = p - var;
/* Discard variable if mangling made it start with __Host-, where pre-mangling it did not start with __Host- */
if (strncmp(var, "__Host-", sizeof("__Host-")-1) == 0 && strncmp(var_name, "__Host-", sizeof("__Host-")-1) != 0) {
zval_ptr_dtor_nogc(val);
free_alloca(var_orig, use_heap);
return;
}
/* Discard variable if mangling made it start with __Secure-, where pre-mangling it did not start with __Secure- */
if (strncmp(var, "__Secure-", sizeof("__Secure-")-1) == 0 && strncmp(var_name, "__Secure-", sizeof("__Secure-")-1) != 0) {
zval_ptr_dtor_nogc(val);
free_alloca(var_orig, use_heap);
return;
}
if (var_len==0) { /* empty variable name, or variable name with a space in it */
zval_ptr_dtor_nogc(val);
free_alloca(var_orig, use_heap);