diff --git a/ext/standard/string.c b/ext/standard/string.c index 66778f90434..c6de4dba98e 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -4893,7 +4893,7 @@ int php_tag_find(char *tag, size_t len, const char *set) { if (state == 0) { state=1; } - if (c != '/') { + if (c != '/' || (*(t-1) != '<' && *(t+1) != '>')) { *(n++) = c; } } else { diff --git a/ext/standard/tests/strings/bug78814.phpt b/ext/standard/tests/strings/bug78814.phpt new file mode 100644 index 00000000000..c8ad8373e06 --- /dev/null +++ b/ext/standard/tests/strings/bug78814.phpt @@ -0,0 +1,8 @@ +--TEST-- +Bug #78814 (strip_tags allows / in tag name => whitelist bypass) +--FILE-- +b", ""); +?> +--EXPECT-- +b