php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

[RFC] FILTER_THROW_ON_FAILURE (#18896)

Browse Source 
https://wiki.php.net/rfc/filter_throw_on_failure
This commit is contained in:
Daniel Scherzer
2025-08-26 03:16:39 -07:00
committed by GitHub
parent 1193823541
commit 0b326dcbab
14 changed files with 520 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ext/filter/callback_filter.c
View File

@@ -16,7 +16,7 @@
#include "php_filter.h"
void php_filter_callback(PHP_INPUT_FILTER_PARAM_DECL)
zend_result php_filter_callback(PHP_INPUT_FILTER_PARAM_DECL)
{
zval retval;
int status;
@@ -25,7 +25,7 @@ void php_filter_callback(PHP_INPUT_FILTER_PARAM_DECL)
zend_type_error("%s(): Option must be a valid callback", get_active_function_name());
zval_ptr_dtor(value);
ZVAL_NULL(value);
return;
return SUCCESS;
}
status = call_user_function(NULL, NULL, option_array, &retval, 1, value);
@@ -37,4 +37,5 @@ void php_filter_callback(PHP_INPUT_FILTER_PARAM_DECL)
zval_ptr_dtor(value);
ZVAL_NULL(value);
}
return SUCCESS;
}

119
ext/filter/filter.c
View File

@@ -30,11 +30,12 @@ ZEND_DECLARE_MODULE_GLOBALS(filter)
#include "zend_attributes.h"
#include "filter_private.h"
#include "filter_arginfo.h"
#include "zend_exceptions.h"
typedef struct filter_list_entry {
const char *name;
int id;
void (*function)(PHP_INPUT_FILTER_PARAM_DECL);
zend_result (*function)(PHP_INPUT_FILTER_PARAM_DECL);
} filter_list_entry;
/* {{{ filter_list */
@@ -77,6 +78,9 @@ static const filter_list_entry filter_list[] = {
static unsigned int php_sapi_filter(int arg, const char *var, char **val, size_t val_len, size_t *new_val_len);
static unsigned int php_sapi_filter_init(void);
zend_class_entry *php_filter_exception_ce;
zend_class_entry *php_filter_failed_exception_ce;
/* {{{ filter_module_entry */
zend_module_entry filter_module_entry = {
STANDARD_MODULE_HEADER,
@@ -160,6 +164,9 @@ PHP_MINIT_FUNCTION(filter)
sapi_register_input_filter(php_sapi_filter, php_sapi_filter_init);
php_filter_exception_ce = register_class_Filter_FilterException(zend_ce_exception);
php_filter_failed_exception_ce = register_class_Filter_FilterFailedException(php_filter_exception_ce);
return SUCCESS;
}
/* }}} */
@@ -251,6 +258,16 @@ static void php_zval_filter(zval *value, zend_long filter, zend_long flags, zval
ce = Z_OBJCE_P(value);
if (!ce->__tostring) {
zval_ptr_dtor(value);
if (flags & FILTER_THROW_ON_FAILURE) {
zend_throw_exception_ex(
php_filter_failed_exception_ce,
0,
"filter validation failed: object of type %s has no __toString() method",
ZSTR_VAL(ce->name)
);
ZVAL_NULL(value);
return;
}
/* #67167: doesn't return null on failure for objects */
if (flags & FILTER_NULL_ON_FAILURE) {
ZVAL_NULL(value);
@@ -264,7 +281,29 @@ static void php_zval_filter(zval *value, zend_long filter, zend_long flags, zval
/* Here be strings */
convert_to_string(value);
filter_func.function(value, flags, options, charset);
zend_string *copy_for_throwing = NULL;
if (flags & FILTER_THROW_ON_FAILURE) {
copy_for_throwing = zend_string_copy(Z_STR_P(value));
}
zend_result result = filter_func.function(value, flags, options, charset);
if (flags & FILTER_THROW_ON_FAILURE) {
ZEND_ASSERT(copy_for_throwing != NULL);
if (result == FAILURE) {
zend_throw_exception_ex(
php_filter_failed_exception_ce,
0,
"filter validation failed: filter %s not satisfied by '%s'",
filter_func.name,
ZSTR_VAL(copy_for_throwing)
);
zend_string_delref(copy_for_throwing);
return;
}
zend_string_delref(copy_for_throwing);
copy_for_throwing = NULL;
}
handle_default:
if (options && Z_TYPE_P(options) == IS_ARRAY &&
@@ -450,7 +489,8 @@ PHP_FUNCTION(filter_has_var)
static void php_filter_call(
zval *filtered, zend_long filter, HashTable *filter_args_ht, zend_long filter_args_long,
zend_long filter_flags
zend_long filter_flags,
uint32_t options_arg_num
) /* {{{ */ {
zval *options = NULL;
char *charset = NULL;
@@ -492,10 +532,28 @@ static void php_filter_call(
}
}
/* Cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE */
if ((filter_flags & FILTER_NULL_ON_FAILURE) && (filter_flags & FILTER_THROW_ON_FAILURE)) {
zval_ptr_dtor(filtered);
ZVAL_NULL(filtered);
zend_argument_value_error(
options_arg_num,
"cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE"
);
return;
}
if (Z_TYPE_P(filtered) == IS_ARRAY) {
if (filter_flags & FILTER_REQUIRE_SCALAR) {
zval_ptr_dtor(filtered);
if (filter_flags & FILTER_NULL_ON_FAILURE) {
if (filter_flags & FILTER_THROW_ON_FAILURE) {
ZVAL_NULL(filtered);
zend_throw_exception(
php_filter_failed_exception_ce,
"filter validation failed: not a scalar value (got an array)",
0
);
} else if (filter_flags & FILTER_NULL_ON_FAILURE) {
ZVAL_NULL(filtered);
} else {
ZVAL_FALSE(filtered);
@@ -506,6 +564,17 @@ static void php_filter_call(
return;
}
if (filter_flags & FILTER_REQUIRE_ARRAY) {
if (filter_flags & FILTER_THROW_ON_FAILURE) {
zend_throw_exception_ex(
php_filter_failed_exception_ce,
0,
"filter validation failed: not an array (got %s)",
zend_zval_value_name(filtered)
);
zval_ptr_dtor(filtered);
ZVAL_NULL(filtered);
return;
}
zval_ptr_dtor(filtered);
if (filter_flags & FILTER_NULL_ON_FAILURE) {
ZVAL_NULL(filtered);
@@ -516,6 +585,10 @@ static void php_filter_call(
}
php_zval_filter(filtered, filter, filter_flags, options, charset);
/* Don't wrap in an array if we are throwing an exception */
if (EG(exception)) {
return;
}
if (filter_flags & FILTER_FORCE_ARRAY) {
zval tmp;
ZVAL_COPY_VALUE(&tmp, filtered);
@@ -530,7 +603,7 @@ static void php_filter_array_handler(zval *input, HashTable *op_ht, zend_long op
) /* {{{ */ {
if (!op_ht) {
ZVAL_DUP(return_value, input);
php_filter_call(return_value, -1, NULL, op_long, FILTER_REQUIRE_ARRAY);
php_filter_call(return_value, -1, NULL, op_long, FILTER_REQUIRE_ARRAY, 2);
} else {
array_init(return_value);
zend_string *arg_key;
@@ -557,8 +630,12 @@ static void php_filter_array_handler(zval *input, HashTable *op_ht, zend_long op
php_filter_call(&nval, -1,
Z_TYPE_P(arg_elm) == IS_ARRAY ? Z_ARRVAL_P(arg_elm) : NULL,
Z_TYPE_P(arg_elm) == IS_ARRAY ? 0 : zval_get_long(arg_elm),
FILTER_REQUIRE_SCALAR
FILTER_REQUIRE_SCALAR,
2
);
if (EG(exception)) {
RETURN_THROWS();
}
zend_hash_update(Z_ARRVAL_P(return_value), arg_key, &nval);
}
} ZEND_HASH_FOREACH_END();
@@ -598,11 +675,35 @@ PHP_FUNCTION(filter_input)
if (!filter_args_ht) {
filter_flags = filter_args_long;
} else {
zval *option, *opt, *def;
zval *option;
if ((option = zend_hash_str_find(filter_args_ht, "flags", sizeof("flags") - 1)) != NULL) {
filter_flags = zval_get_long(option);
}
}
/* Cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE */
if ((filter_flags & FILTER_NULL_ON_FAILURE) && (filter_flags & FILTER_THROW_ON_FAILURE)) {
zend_argument_value_error(
4,
"cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE"
);
RETURN_THROWS();
}
if (filter_flags & FILTER_THROW_ON_FAILURE) {
zend_throw_exception_ex(
php_filter_failed_exception_ce,
0,
"input value '%s' not found",
ZSTR_VAL(var)
);
RETURN_THROWS();
}
/* FILTER_THROW_ON_FAILURE overrides defaults, needs to be checked
* before the default is used. */
if (filter_args_ht) {
zval *opt, *def;
if ((opt = zend_hash_str_find_deref(filter_args_ht, "options", sizeof("options") - 1)) != NULL &&
Z_TYPE_P(opt) == IS_ARRAY &&
(def = zend_hash_str_find_deref(Z_ARRVAL_P(opt), "default", sizeof("default") - 1)) != NULL
@@ -626,7 +727,7 @@ PHP_FUNCTION(filter_input)
ZVAL_DUP(return_value, tmp);
php_filter_call(return_value, filter, filter_args_ht, filter_args_long, FILTER_REQUIRE_SCALAR);
php_filter_call(return_value, filter, filter_args_ht, filter_args_long, FILTER_REQUIRE_SCALAR, 4);
}
/* }}} */
@@ -652,7 +753,7 @@ PHP_FUNCTION(filter_var)
ZVAL_DUP(return_value, data);
php_filter_call(return_value, filter, filter_args_ht, filter_args_long, FILTER_REQUIRE_SCALAR);
php_filter_call(return_value, filter, filter_args_ht, filter_args_long, FILTER_REQUIRE_SCALAR, 3);
}
/* }}} */

16
ext/filter/filter.stub.php
View File

@@ -2,6 +2,7 @@
/** @generate-class-entries */
namespace {
/**
* @var int
* @cvalue PARSE_POST
@@ -54,6 +55,11 @@ const FILTER_FORCE_ARRAY = UNKNOWN;
* @cvalue FILTER_NULL_ON_FAILURE
*/
const FILTER_NULL_ON_FAILURE = UNKNOWN;
/**
* @var int
* @cvalue FILTER_THROW_ON_FAILURE
*/
const FILTER_THROW_ON_FAILURE = UNKNOWN;
/**
* @var int
@@ -313,3 +319,13 @@ function filter_var_array(array $array, array|int $options = FILTER_DEFAULT, boo
function filter_list(): array {}
function filter_id(string $name): int|false {}
}
namespace Filter {
class FilterException extends \Exception {}
class FilterFailedException extends FilterException {}
}

23
ext/filter/filter_arginfo.h generated
View File

@@ -1,5 +1,5 @@
/* This is a generated file, edit the .stub.php file instead.
* Stub hash: a0f9a546d59bb27854af79a92e353f118ca6bdaf */
* Stub hash: c3eb55dfec619af1e46be206f51a2b0893ed399f */
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_filter_has_var, 0, 2, _IS_BOOL, 0)
ZEND_ARG_TYPE_INFO(0, input_type, IS_LONG, 0)
@@ -69,6 +69,7 @@ static void register_filter_symbols(int module_number)
REGISTER_LONG_CONSTANT("FILTER_REQUIRE_ARRAY", FILTER_REQUIRE_ARRAY, CONST_PERSISTENT);
REGISTER_LONG_CONSTANT("FILTER_FORCE_ARRAY", FILTER_FORCE_ARRAY, CONST_PERSISTENT);
REGISTER_LONG_CONSTANT("FILTER_NULL_ON_FAILURE", FILTER_NULL_ON_FAILURE, CONST_PERSISTENT);
REGISTER_LONG_CONSTANT("FILTER_THROW_ON_FAILURE", FILTER_THROW_ON_FAILURE, CONST_PERSISTENT);
REGISTER_LONG_CONSTANT("FILTER_VALIDATE_INT", FILTER_VALIDATE_INT, CONST_PERSISTENT);
REGISTER_LONG_CONSTANT("FILTER_VALIDATE_BOOLEAN", FILTER_VALIDATE_BOOL, CONST_PERSISTENT);
REGISTER_LONG_CONSTANT("FILTER_VALIDATE_BOOL", FILTER_VALIDATE_BOOL, CONST_PERSISTENT);
@@ -129,3 +130,23 @@ static void register_filter_symbols(int module_number)
ZVAL_STR_COPY(&attribute_Deprecated_const_FILTER_SANITIZE_STRIPPED_0->args[1].value, attribute_Deprecated_const_FILTER_SANITIZE_STRING_0_arg1_str);
attribute_Deprecated_const_FILTER_SANITIZE_STRIPPED_0->args[1].name = ZSTR_KNOWN(ZEND_STR_MESSAGE);
}
static zend_class_entry *register_class_Filter_FilterException(zend_class_entry *class_entry_Exception)
{
zend_class_entry ce, *class_entry;
INIT_NS_CLASS_ENTRY(ce, "Filter", "FilterException", NULL);
class_entry = zend_register_internal_class_with_flags(&ce, class_entry_Exception, 0);
return class_entry;
}
static zend_class_entry *register_class_Filter_FilterFailedException(zend_class_entry *class_entry_Filter_FilterException)
{
zend_class_entry ce, *class_entry;
INIT_NS_CLASS_ENTRY(ce, "Filter", "FilterFailedException", NULL);
class_entry = zend_register_internal_class_with_flags(&ce, class_entry_Filter_FilterException, 0);
return class_entry;
}

16
ext/filter/filter_private.h
View File

@@ -24,6 +24,7 @@
#define FILTER_FORCE_ARRAY 0x4000000
#define FILTER_NULL_ON_FAILURE 0x8000000
#define FILTER_THROW_ON_FAILURE 0x10000000
#define FILTER_FLAG_ALLOW_OCTAL 0x0001
#define FILTER_FLAG_ALLOW_HEX 0x0002
@@ -50,7 +51,7 @@
#define FILTER_FLAG_IPV6 0x00200000
#define FILTER_FLAG_NO_RES_RANGE 0x00400000
#define FILTER_FLAG_NO_PRIV_RANGE 0x00800000
#define FILTER_FLAG_GLOBAL_RANGE 0x10000000
#define FILTER_FLAG_GLOBAL_RANGE 0x20000000
#define FILTER_FLAG_HOSTNAME 0x100000
@@ -93,9 +94,18 @@
|| (id >= FILTER_VALIDATE_ALL && id <= FILTER_VALIDATE_LAST) \
|| id == FILTER_CALLBACK)
/* When using FILTER_THROW_ON_FAILURE, we can't actually throw the error here
* because we don't have access to the name of the filter. Returning FAILURE
* from the filter handler indicates that validation failed *and* an exception
* should thus be thrown. */
#define RETURN_VALIDATION_FAILED \
if (EG(exception)) { \
return; \
return SUCCESS; \
} else if (flags & FILTER_THROW_ON_FAILURE) { \
zval_ptr_dtor(value); \
ZVAL_NULL(value); \
return FAILURE; \
} else if (flags & FILTER_NULL_ON_FAILURE) { \
zval_ptr_dtor(value); \
ZVAL_NULL(value); \
@@ -103,7 +113,7 @@
zval_ptr_dtor(value); \
ZVAL_FALSE(value); \
} \
return; \
return SUCCESS; \
#define PHP_FILTER_TRIM_DEFAULT(p, len) PHP_FILTER_TRIM_DEFAULT_EX(p, len, 1);

32
ext/filter/logical_filters.c
View File

@@ -198,7 +198,7 @@ static bool php_filter_parse_hex(const char *str, size_t str_len, zend_long *ret
}
/* }}} */
void php_filter_int(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
zend_result php_filter_int(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
{
zval *option_val;
zend_long min_range, max_range, option_flags;
@@ -269,12 +269,12 @@ void php_filter_int(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
} else {
zval_ptr_dtor(value);
ZVAL_LONG(value, ctx_value);
return;
}
return SUCCESS;
}
/* }}} */
void php_filter_boolean(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
zend_result php_filter_boolean(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
{
const char *str = Z_STRVAL_P(value);
size_t len = Z_STRLEN_P(value);
@@ -340,10 +340,11 @@ void php_filter_boolean(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
zval_ptr_dtor(value);
ZVAL_BOOL(value, ret);
}
return SUCCESS;
}
/* }}} */
void php_filter_float(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
zend_result php_filter_float(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
{
size_t len;
const char *str, *end;
@@ -470,10 +471,11 @@ error:
RETURN_VALIDATION_FAILED
}
efree(num);
return SUCCESS;
}
/* }}} */
void php_filter_validate_regexp(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
zend_result php_filter_validate_regexp(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
{
zval *option_val;
zend_string *regexp;
@@ -506,6 +508,7 @@ void php_filter_validate_regexp(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
if (rc < 0) {
RETURN_VALIDATION_FAILED
}
return SUCCESS;
}
static bool php_filter_validate_domain_ex(const zend_string *domain, zend_long flags) /* {{{ */
@@ -560,11 +563,12 @@ static bool php_filter_validate_domain_ex(const zend_string *domain, zend_long f
}
/* }}} */
void php_filter_validate_domain(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
zend_result php_filter_validate_domain(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
{
if (!php_filter_validate_domain_ex(Z_STR_P(value), flags)) {
RETURN_VALIDATION_FAILED
}
return SUCCESS;
}
/* }}} */
@@ -592,7 +596,7 @@ static bool php_filter_is_valid_ipv6_hostname(const zend_string *s)
return *ZSTR_VAL(s) == '[' && *t == ']' && _php_filter_validate_ipv6(ZSTR_VAL(s) + 1, ZSTR_LEN(s) - 2, NULL);
}
void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
zend_result php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
{
size_t old_len = Z_STRLEN_P(value);
@@ -662,10 +666,11 @@ void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
}
php_uri_struct_free(uri);
return SUCCESS;
}
/* }}} */
void php_filter_validate_email(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
zend_result php_filter_validate_email(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
{
/*
* The regex below is based on a regex by Michael Rushton.
@@ -731,6 +736,7 @@ void php_filter_validate_email(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
if (rc < 0) {
RETURN_VALIDATION_FAILED
}
return SUCCESS;
}
/* }}} */
@@ -991,7 +997,7 @@ static bool ipv6_get_status_flags(const int ip[8], bool *global, bool *reserved,
* to throw out reserved ranges; multicast ranges... etc. If both allow_ipv4
* and allow_ipv6 flags flag are used, then the first dot or colon determine
* the format */
void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
zend_result php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
{
int ip[8];
int mode;
@@ -1019,7 +1025,7 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
}
if (!ipv4_get_status_flags(ip, &flag_global, &flag_reserved, &flag_private)) {
return; /* no special block */
return SUCCESS; /* no special block */
}
}
else if (mode == FORMAT_IPV6) {
@@ -1028,7 +1034,7 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
}
if (!ipv6_get_status_flags(ip, &flag_global, &flag_reserved, &flag_private)) {
return; /* no special block */
return SUCCESS; /* no special block */
}
}
@@ -1043,10 +1049,11 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
if ((flags & FILTER_FLAG_NO_RES_RANGE) && flag_reserved == true) {
RETURN_VALIDATION_FAILED
}
return SUCCESS;
}
/* }}} */
void php_filter_validate_mac(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
zend_result php_filter_validate_mac(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
{
const char *input = Z_STRVAL_P(value);
size_t input_len = Z_STRLEN_P(value);
@@ -1105,5 +1112,6 @@ void php_filter_validate_mac(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
RETURN_VALIDATION_FAILED
}
}
return SUCCESS;
}
/* }}} */

40
ext/filter/php_filter.h
View File

@@ -53,27 +53,27 @@ ZEND_TSRMLS_CACHE_EXTERN()
#define IF_G(v) ZEND_MODULE_GLOBALS_ACCESSOR(filter, v)
#define PHP_INPUT_FILTER_PARAM_DECL zval *value, zend_long flags, zval *option_array, char *charset
void php_filter_int(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_boolean(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_float(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_validate_regexp(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_validate_domain(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_validate_email(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_validate_mac(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_int(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_boolean(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_float(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_validate_regexp(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_validate_domain(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_validate_email(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_validate_mac(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_string(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_encoded(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_special_chars(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_full_special_chars(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_unsafe_raw(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_email(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_url(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_number_int(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_number_float(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_add_slashes(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_string(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_encoded(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_special_chars(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_full_special_chars(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_unsafe_raw(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_email(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_url(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_number_int(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_number_float(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_add_slashes(PHP_INPUT_FILTER_PARAM_DECL);
void php_filter_callback(PHP_INPUT_FILTER_PARAM_DECL);
zend_result php_filter_callback(PHP_INPUT_FILTER_PARAM_DECL);
#endif /* FILTER_H */

31
ext/filter/sanitizing_filters.c
View File

@@ -168,7 +168,7 @@ static void filter_map_apply(zval *value, const filter_map *map)
/* }}} */
/* {{{ php_filter_string */
void php_filter_string(PHP_INPUT_FILTER_PARAM_DECL)
zend_result php_filter_string(PHP_INPUT_FILTER_PARAM_DECL)
{
size_t new_len;
unsigned char enc[256] = {0};
@@ -206,23 +206,24 @@ void php_filter_string(PHP_INPUT_FILTER_PARAM_DECL)
} else {
ZVAL_EMPTY_STRING(value);
}
return;
}
return SUCCESS;
}
/* }}} */
/* {{{ php_filter_encoded */
void php_filter_encoded(PHP_INPUT_FILTER_PARAM_DECL)
zend_result php_filter_encoded(PHP_INPUT_FILTER_PARAM_DECL)
{
/* apply strip_high and strip_low filters */
php_filter_strip(value, flags);
/* urlencode */
php_filter_encode_url(value, (unsigned char *)DEFAULT_URL_ENCODE, sizeof(DEFAULT_URL_ENCODE)-1);
return SUCCESS;
}
/* }}} */
/* {{{ php_filter_special_chars */
void php_filter_special_chars(PHP_INPUT_FILTER_PARAM_DECL)
zend_result php_filter_special_chars(PHP_INPUT_FILTER_PARAM_DECL)
{
unsigned char enc[256] = {0};
@@ -239,11 +240,12 @@ void php_filter_special_chars(PHP_INPUT_FILTER_PARAM_DECL)
}
php_filter_encode_html(value, enc);
return SUCCESS;
}
/* }}} */
/* {{{ php_filter_full_special_chars */
void php_filter_full_special_chars(PHP_INPUT_FILTER_PARAM_DECL)
zend_result php_filter_full_special_chars(PHP_INPUT_FILTER_PARAM_DECL)
{
zend_string *buf;
int quotes;
@@ -258,11 +260,12 @@ void php_filter_full_special_chars(PHP_INPUT_FILTER_PARAM_DECL)
/* charset_hint */ NULL, /* double_encode */ 0, /* quiet */ 0);
zval_ptr_dtor(value);
ZVAL_STR(value, buf);
return SUCCESS;
}
/* }}} */
/* {{{ php_filter_unsafe_raw */
void php_filter_unsafe_raw(PHP_INPUT_FILTER_PARAM_DECL)
zend_result php_filter_unsafe_raw(PHP_INPUT_FILTER_PARAM_DECL)
{
/* Only if no flags are set (optimization) */
if (flags != 0 && Z_STRLEN_P(value) > 0) {
@@ -285,6 +288,7 @@ void php_filter_unsafe_raw(PHP_INPUT_FILTER_PARAM_DECL)
zval_ptr_dtor(value);
ZVAL_NULL(value);
}
return SUCCESS;
}
/* }}} */
@@ -295,7 +299,7 @@ void php_filter_unsafe_raw(PHP_INPUT_FILTER_PARAM_DECL)
#define PUNCTUATION "<>#%\""
#define RESERVED ";/?:@&="
void php_filter_email(PHP_INPUT_FILTER_PARAM_DECL)
zend_result php_filter_email(PHP_INPUT_FILTER_PARAM_DECL)
{
/* Check section 6 of rfc 822 http://www.faqs.org/rfcs/rfc822.html */
const unsigned char allowed_list[] = LOWALPHA HIALPHA DIGIT "!#$%&'*+-=?^_`{|}~@.[]";
@@ -304,11 +308,12 @@ void php_filter_email(PHP_INPUT_FILTER_PARAM_DECL)
filter_map_init(&map);
filter_map_update(&map, 1, allowed_list);
filter_map_apply(value, &map);
return SUCCESS;
}
/* }}} */
/* {{{ php_filter_url */
void php_filter_url(PHP_INPUT_FILTER_PARAM_DECL)
zend_result php_filter_url(PHP_INPUT_FILTER_PARAM_DECL)
{
/* Strip all chars not part of section 5 of
* http://www.faqs.org/rfcs/rfc1738.html */
@@ -318,11 +323,12 @@ void php_filter_url(PHP_INPUT_FILTER_PARAM_DECL)
filter_map_init(&map);
filter_map_update(&map, 1, allowed_list);
filter_map_apply(value, &map);
return SUCCESS;
}
/* }}} */
/* {{{ php_filter_number_int */
void php_filter_number_int(PHP_INPUT_FILTER_PARAM_DECL)
zend_result php_filter_number_int(PHP_INPUT_FILTER_PARAM_DECL)
{
/* strip everything [^0-9+-] */
const unsigned char allowed_list[] = "+-" DIGIT;
@@ -331,11 +337,12 @@ void php_filter_number_int(PHP_INPUT_FILTER_PARAM_DECL)
filter_map_init(&map);
filter_map_update(&map, 1, allowed_list);
filter_map_apply(value, &map);
return SUCCESS;
}
/* }}} */
/* {{{ php_filter_number_float */
void php_filter_number_float(PHP_INPUT_FILTER_PARAM_DECL)
zend_result php_filter_number_float(PHP_INPUT_FILTER_PARAM_DECL)
{
/* strip everything [^0-9+-] */
const unsigned char allowed_list[] = "+-" DIGIT;
@@ -355,15 +362,17 @@ void php_filter_number_float(PHP_INPUT_FILTER_PARAM_DECL)
filter_map_update(&map, 4, (const unsigned char *) "eE");
}
filter_map_apply(value, &map);
return SUCCESS;
}
/* }}} */
/* {{{ php_filter_add_slashes */
void php_filter_add_slashes(PHP_INPUT_FILTER_PARAM_DECL)
zend_result php_filter_add_slashes(PHP_INPUT_FILTER_PARAM_DECL)
{
zend_string *buf = php_addslashes(Z_STR_P(value));
zval_ptr_dtor(value);
ZVAL_STR(value, buf);
return SUCCESS;
}
/* }}} */

29
ext/filter/tests/throw-on-failure/filter_input_array_failure.phpt Normal file
View File

@@ -0,0 +1,29 @@
--TEST--
FILTER_THROW_ON_FAILURE: filter_input_array() failure
--EXTENSIONS--
filter
--GET--
a=1
--FILE--
<?php
echo "\nvalidation fails (array type check)\n";
try {
filter_input_array(INPUT_GET, ['a' => ['flags' => FILTER_REQUIRE_ARRAY | FILTER_THROW_ON_FAILURE]]);
} catch (Filter\FilterFailedException $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nvalidation fails (filter value)\n";
try {
filter_input_array(INPUT_GET, ['a' => ['filter' => FILTER_VALIDATE_EMAIL, 'flags' => FILTER_THROW_ON_FAILURE]]);
} catch (Filter\FilterFailedException $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
?>
--EXPECT--
validation fails (array type check)
Filter\FilterFailedException: filter validation failed: not an array (got string)
validation fails (filter value)
Filter\FilterFailedException: filter validation failed: filter validate_email not satisfied by '1'

39
ext/filter/tests/throw-on-failure/filter_input_failure.phpt Normal file
View File

@@ -0,0 +1,39 @@
--TEST--
FILTER_THROW_ON_FAILURE: filter_input() failure
--EXTENSIONS--
filter
--GET--
a=1
--FILE--
<?php
echo "missing value\n";
try {
filter_input(INPUT_GET, 'b', FILTER_DEFAULT, FILTER_THROW_ON_FAILURE);
} catch (Filter\FilterFailedException $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nvalidation fails (array type check)\n";
try {
filter_input(INPUT_GET, 'a', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY | FILTER_THROW_ON_FAILURE);
} catch (Filter\FilterFailedException $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nvalidation fails (filter value)\n";
try {
filter_input(INPUT_GET, 'a', FILTER_VALIDATE_EMAIL, FILTER_THROW_ON_FAILURE);
} catch (Filter\FilterFailedException $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
?>
--EXPECT--
missing value
Filter\FilterFailedException: input value 'b' not found
validation fails (array type check)
Filter\FilterFailedException: filter validation failed: not an array (got string)
validation fails (filter value)
Filter\FilterFailedException: filter validation failed: filter validate_email not satisfied by '1'

68
ext/filter/tests/throw-on-failure/filter_success.phpt Normal file
View File

@@ -0,0 +1,68 @@
--TEST--
FILTER_THROW_ON_FAILURE: successful filters do not throw
--EXTENSIONS--
filter
--GET--
a=daniel.e.scherzer@gmail.com
--FILE--
<?php
class MyString {
public function __construct(private string $wrapped) {}
public function __toString(): string { return $this->wrapped; }
}
echo "filter_input:\n";
var_dump(filter_input(INPUT_GET, 'a', FILTER_DEFAULT, FILTER_THROW_ON_FAILURE));
var_dump(filter_input(INPUT_GET, 'a', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR | FILTER_THROW_ON_FAILURE));
var_dump(filter_input(INPUT_GET, 'a', FILTER_VALIDATE_EMAIL, FILTER_THROW_ON_FAILURE));
echo "\nfilter_input_array:\n";
var_dump(filter_input_array(INPUT_GET, ['a' => ['flags' => FILTER_REQUIRE_SCALAR | FILTER_THROW_ON_FAILURE]]));
var_dump(filter_input_array(INPUT_GET, ['a' => ['filter' => FILTER_VALIDATE_EMAIL, 'flags' => FILTER_THROW_ON_FAILURE]]));
echo "\nfilter_var:\n";
var_dump(filter_var('a', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR | FILTER_THROW_ON_FAILURE));
var_dump(filter_var(new MyString('daniel.e.scherzer@gmail.com'), FILTER_VALIDATE_EMAIL, FILTER_THROW_ON_FAILURE));
var_dump(filter_var('daniel.e.scherzer@gmail.com', FILTER_VALIDATE_EMAIL, FILTER_THROW_ON_FAILURE));
echo "\nfilter_var_array:\n";
var_dump(filter_var_array(['a' => 'a'], ['a' => ['flags' => FILTER_REQUIRE_SCALAR | FILTER_THROW_ON_FAILURE]]));
var_dump(filter_var_array(['a' => new MyString('bar')], ['a' => ['flags' => FILTER_THROW_ON_FAILURE]]));
var_dump(filter_var_array(['a' => 'daniel.e.scherzer@gmail.com'], ['a' => ['filter' => FILTER_VALIDATE_EMAIL, 'flags' => FILTER_THROW_ON_FAILURE]]));
?>
--EXPECT--
filter_input:
string(27) "daniel.e.scherzer@gmail.com"
string(27) "daniel.e.scherzer@gmail.com"
string(27) "daniel.e.scherzer@gmail.com"
filter_input_array:
array(1) {
["a"]=>
string(27) "daniel.e.scherzer@gmail.com"
}
array(1) {
["a"]=>
string(27) "daniel.e.scherzer@gmail.com"
}
filter_var:
string(1) "a"
string(27) "daniel.e.scherzer@gmail.com"
string(27) "daniel.e.scherzer@gmail.com"
filter_var_array:
array(1) {
["a"]=>
string(1) "a"
}
array(1) {
["a"]=>
string(3) "bar"
}
array(1) {
["a"]=>
string(27) "daniel.e.scherzer@gmail.com"
}

37
ext/filter/tests/throw-on-failure/filter_var_array_failure.phpt Normal file
View File

@@ -0,0 +1,37 @@
--TEST--
FILTER_THROW_ON_FAILURE: filter_var_array() failure
--EXTENSIONS--
filter
--FILE--
<?php
echo "\nvalidation fails (array type check)\n";
try {
filter_var_array(['a' => 'a'], ['a' => ['flags' => FILTER_REQUIRE_ARRAY | FILTER_THROW_ON_FAILURE]]);
} catch (Filter\FilterFailedException $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nvalidation fails (object without __toString)\n";
try {
filter_var_array(['a' => new stdClass()], ['a' => ['flags' => FILTER_THROW_ON_FAILURE]]);
} catch (Filter\FilterFailedException $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nvalidation fails (filter value)\n";
try {
filter_var_array(['a' => true], ['a' => ['filter' => FILTER_VALIDATE_EMAIL, 'flags' => FILTER_THROW_ON_FAILURE]]);
} catch (Filter\FilterFailedException $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
?>
--EXPECT--
validation fails (array type check)
Filter\FilterFailedException: filter validation failed: not an array (got string)
validation fails (object without __toString)
Filter\FilterFailedException: filter validation failed: object of type stdClass has no __toString() method
validation fails (filter value)
Filter\FilterFailedException: filter validation failed: filter validate_email not satisfied by '1'

37
ext/filter/tests/throw-on-failure/filter_var_failure.phpt Normal file
View File

@@ -0,0 +1,37 @@
--TEST--
FILTER_THROW_ON_FAILURE: filter_input() failure
--EXTENSIONS--
filter
--FILE--
<?php
echo "\nvalidation fails (array type check)\n";
try {
filter_var('a', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY | FILTER_THROW_ON_FAILURE);
} catch (Filter\FilterFailedException $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nvalidation fails (object without __toString)\n";
try {
filter_var(new stdClass(), FILTER_VALIDATE_EMAIL, FILTER_THROW_ON_FAILURE);
} catch (Filter\FilterFailedException $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nvalidation fails (filter value)\n";
try {
filter_var('a', FILTER_VALIDATE_EMAIL, FILTER_THROW_ON_FAILURE);
} catch (Filter\FilterFailedException $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
?>
--EXPECT--
validation fails (array type check)
Filter\FilterFailedException: filter validation failed: not an array (got string)
validation fails (object without __toString)
Filter\FilterFailedException: filter validation failed: object of type stdClass has no __toString() method
validation fails (filter value)
Filter\FilterFailedException: filter validation failed: filter validate_email not satisfied by 'a'

86
ext/filter/tests/throw-on-failure/throw-and-null-error.phpt Normal file
View File

@@ -0,0 +1,86 @@
--TEST--
Cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE
--EXTENSIONS--
filter
--GET--
a=1
--FILE--
<?php
$flags = FILTER_THROW_ON_FAILURE | FILTER_NULL_ON_FAILURE;
echo "filter_input(), with a missing value\n";
try {
filter_input(INPUT_GET, 'b', FILTER_DEFAULT, $flags);
} catch (ValueError $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
try {
filter_input(INPUT_GET, 'b', FILTER_DEFAULT, ['flags' => $flags]);
} catch (ValueError $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nfilter_input(), with a missing value and a default\n";
try {
filter_input(INPUT_GET, 'b', FILTER_DEFAULT, ['flags' => $flags, 'options' => ['default' => 'a']]);
} catch (ValueError $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nfilter_input(), with a present value\n";
try {
filter_input(INPUT_GET, 'a', FILTER_DEFAULT, $flags);
} catch (ValueError $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
try {
filter_input(INPUT_GET, 'a', FILTER_DEFAULT, ['flags' => $flags]);
} catch (ValueError $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nfilter_var()\n";
try {
filter_var(true, FILTER_DEFAULT, $flags);
} catch (ValueError $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
try {
filter_var(true, FILTER_DEFAULT, ['flags' => $flags]);
} catch (ValueError $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nfilter_input_array()\n";
try {
filter_input_array(INPUT_GET, ['a' => ['flags' => $flags]]);
} catch (ValueError $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
echo "\nfilter_var_array()\n";
try {
filter_var_array(['a' => true], ['a' => ['flags' => $flags]]);
} catch (ValueError $e) {
echo get_class($e) . ": " . $e->getMessage() . "\n";
}
?>
--EXPECT--
filter_input(), with a missing value
ValueError: filter_input(): Argument #4 ($options) cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE
ValueError: filter_input(): Argument #4 ($options) cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE
filter_input(), with a missing value and a default
ValueError: filter_input(): Argument #4 ($options) cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE
filter_input(), with a present value
ValueError: filter_input(): Argument #4 ($options) cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE
ValueError: filter_input(): Argument #4 ($options) cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE
filter_var()
ValueError: filter_var(): Argument #3 ($options) cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE
ValueError: filter_var(): Argument #3 ($options) cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE
filter_input_array()
ValueError: filter_input_array(): Argument #2 ($options) cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE
filter_var_array()
ValueError: filter_var_array(): Argument #2 ($options) cannot use both FILTER_NULL_ON_FAILURE and FILTER_THROW_ON_FAILURE