Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:110150
Date: Wed, 13 May 2020 11:47:55 +0200
To: PHP Internals <internals@lists.php.net>
Message-ID: <20200513114755.5f091fb4@mcmic-probook.opensides.be>
In-Reply-To: <CAHE1EduK5idMXWLhBopX4boHfDAAryGA=MGCkDA236GxfVrpwQ@mail.gmail.com>
References: <2157564.YClJE7JIHU@mcmic-probook>
	<CAHE1EduK5idMXWLhBopX4boHfDAAryGA=MGCkDA236GxfVrpwQ@mail.gmail.com>
Organization: FusionDirectory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] max_input_vars trigger detection
From: come.chilliet@fusiondirectory.org (=?UTF-8?B?Q8O0bWU=?= Chilliet)

Le Sun, 10 May 2020 13:34:12 +0100,
Craig Duncan <php@duncanc.co.uk> a =C3=A9crit :
> Although not particularly elegant, and it does require you to
> reject =20
> requests that hit but don't exceed the limit, I've used this approach
> before:
>=20
> $max =3D ini_get("max_input_vars") - 1;
> $check =3D count($_REQUEST);
> if ($check > $max) {
>      throw new RequestException("Request is too large, only {$max}
> input variables are permitted");
> }

This is not even correct if I=E2=80=99m not mistaken, as max_input_vars app=
lies
independently to GET, POST and COOKIE as I understand it. Here with
max_input_vars/2 in GET and POST your exception would throw while the
limit was not hit.

I know this is a corner case, but it=E2=80=99s just to illustrate it=E2=80=
=99s hard to
detect whether this limit was hit and it would be better in my opinion
to have a clean way in core.