php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-17 04:51:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.3'

Browse Source 
* PHP-7.3:
  Fix #76688: Disallow excessive parameters after options array
This commit is contained in:
Christoph M. Becker
2018-08-12 15:49:46 +02:00
parent 92b04da505 a16aee6cee
commit 9ea7d259ef
4 changed files with 47 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
ext/session/session.c
View File

@@ -1704,6 +1704,15 @@ static PHP_FUNCTION(session_set_cookie_params)
zend_string *key;
zval *value;
if (path) {
path = NULL;
domain = NULL;
secure_null = 1;
httponly_null = 1;
php_error_docref(NULL, E_WARNING, "Cannot pass arguments after the options array");
RETURN_FALSE;
}
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(lifetime_or_options), key, value) {
if (key) {
ZVAL_DEREF(value);

9
ext/session/tests/session_set_cookie_params_variation7.phpt
View File

@@ -36,6 +36,10 @@ var_dump(ini_get("session.cookie_lifetime"));
var_dump(session_set_cookie_params(["lifetime" => 42]));
var_dump(ini_get("session.cookie_lifetime"));
var_dump(ini_get("session.cookie_path"));
var_dump(session_set_cookie_params(["path" => "newpath/"], "arg after options array"));
var_dump(ini_get("session.cookie_path"));
echo "Done";
ob_end_flush();
?>
@@ -57,4 +61,9 @@ string(6) "please"
string(1) "0"
bool(true)
string(2) "42"
string(1) "/"
Warning: session_set_cookie_params(): Cannot pass arguments after the options array in %s
bool(false)
string(1) "/"
Done

10
ext/standard/head.c
View File

@@ -211,6 +211,15 @@ static int php_head_parse_cookie_options_array(zval *options, zend_long *expires
zend_string *key;
zval *value;
if (*path) {
*path = NULL;
*domain = NULL;
*secure = 0;
*httponly = 0;
php_error_docref(NULL, E_WARNING, "Cannot pass arguments after the options array");
return 0;
}
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(options), key, value) {
if (key) {
ZVAL_DEREF(value);
@@ -243,7 +252,6 @@ static int php_head_parse_cookie_options_array(zval *options, zend_long *expires
/* Array is not empty but no valid keys were found */
if (found == 0 && zend_hash_num_elements(Z_ARRVAL_P(options)) > 0) {
php_error_docref(NULL, E_WARNING, "No valid options were found in the given array");
return 0;
}
return 1;

22
ext/standard/tests/network/setcookie_error.phpt
View File

@@ -10,9 +10,15 @@ ob_start();
// Unrecognized key and no valid keys
setcookie('name', 'value', ['unknown_key' => 'only']);
// Numeric key and no valid keys
setcookie('name', 'value', [0 => 'numeric_key']);
setcookie('name2', 'value2', [0 => 'numeric_key']);
// Unrecognized key
setcookie('name', 'value', ['path' => '/path/', 'foo' => 'bar']);
setcookie('name3', 'value3', ['path' => '/path/', 'foo' => 'bar']);
// Arguments after options array (will not be set)
setcookie('name4', 'value4', [], "path", "domain.tld", true, true);
var_dump(headers_list());
--EXPECTHEADERS--
--EXPECTF--
Warning: setcookie(): Unrecognized key 'unknown_key' found in the options array in %s
@@ -24,3 +30,15 @@ Warning: setcookie(): Numeric key found in the options array in %s
Warning: setcookie(): No valid options were found in the given array in %s
Warning: setcookie(): Unrecognized key 'foo' found in the options array in %s
Warning: setcookie(): Cannot pass arguments after the options array in %s
array(4) {
[0]=>
string(%d) "X-Powered-By: PHP/%s"
[1]=>
string(22) "Set-Cookie: name=value"
[2]=>
string(24) "Set-Cookie: name2=value2"
[3]=>
string(37) "Set-Cookie: name3=value3; path=/path/"
}