Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112336
To: Aimeos | Norbert Sendetzky <norbert@aimeos.com>,
 PHP internals <internals@lists.php.net>
References: <b845d5bf-63da-d564-1f0f-cc934188d693@aimeos.com>
 <b546b5bf-27f8-62cc-cc4b-d859132998a4@gmx.de>
 <0774c293-afd7-d8b9-175f-217ed600d1ea@aimeos.com>
Message-ID: <fad4cc49-0f40-53f1-400c-90ff01ffdccb@gmx.de>
Date: Tue, 1 Dec 2020 18:43:24 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.5.0
MIME-Version: 1.0
In-Reply-To: <0774c293-afd7-d8b9-175f-217ed600d1ea@aimeos.com>
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: quoted-printable
Subject: Re: PHP 8 is_file/is_dir input handling
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 01.12.2020 at 18:35, Aimeos | Norbert Sendetzky wrote:

> Am 01.12.20 um 18:24 schrieb Christoph M. Becker:
>>
>>> In PHP 7, this returns FALSE:
>>>
>>> php -r 'var_dump(is_file("ab\0c"));'
>>>
>>> In PHP 8, the same code throws a ValueException. Problem is now that
>>> it's not possible to check upfront if the passed argument is a valid
>>> path to avoid the exception being thrown.
>>
>> This is only about the NUL byte in the filename.  You can easily check
>> for that yourself. :)
>
> There may be other checks that will throw a ValueException. I'm not sure
> how it's implemented in detail because the filestat.c file doesn't
> thrown an exception at all:

The exception is thrown from inside the parameter parsing routines
(zend_parse_parameters() and friends).  Internal function differenciate
between string and path, whereas the latter is an arbitrary string which
does not contain NUL bytes.

It would likely make sense to document that.  OTOH, it's probably a good
idea to check (almost) all user input for NUL bytes.

> https://github.com/php/php-src/blob/1e9db80d7264911fa4089cb7e4b3dc7f97b1=
9c6e/ext/standard/filestat.c
>
> Can you tell me how you would check for NULL bytes?

See e.g. <https://3v4l.org/5WK3n>.

Regards,
Christoph