mirror of
https://github.com/php/php-src.git
synced 2026-03-26 09:12:14 +01:00
7e339a335e
Currently we treat paths with null bytes as a TypeError, which is incorrect, and rather inconsistent, as we treat empty paths as ValueError. We do this because the error is generated by zpp and it's easier to always throw TypeError there. This changes the zpp implementation to throw a TypeError only if the type is actually wrong and throw ValueError for null bytes. The error message is also split accordingly, to be more precise. Closes GH-6094.
24 lines
388 B
PHP
24 lines
388 B
PHP
--TEST--
|
|
Bug #68089 (NULL byte injection - cURL lib)
|
|
--SKIPIF--
|
|
<?php
|
|
include 'skipif.inc';
|
|
|
|
?>
|
|
--FILE--
|
|
<?php
|
|
$url = "file:///etc/passwd\0http://google.com";
|
|
$ch = curl_init();
|
|
|
|
try {
|
|
curl_setopt($ch, CURLOPT_URL, $url);
|
|
} catch (ValueError $exception) {
|
|
echo $exception->getMessage() . "\n";
|
|
}
|
|
|
|
?>
|
|
Done
|
|
--EXPECT--
|
|
curl_setopt(): cURL option must not contain any null bytes
|
|
Done
|