Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112356
To: PHP Internals <internals@lists.php.net>
References: <b845d5bf-63da-d564-1f0f-cc934188d693@aimeos.com>
 <b546b5bf-27f8-62cc-cc4b-d859132998a4@gmx.de>
 <0774c293-afd7-d8b9-175f-217ed600d1ea@aimeos.com>
 <fad4cc49-0f40-53f1-400c-90ff01ffdccb@gmx.de>
 <CAN2symiHHJVGvaLYMD=Qes0Wy06dZRtzPeonNBUWOBRbiTdo5g@mail.gmail.com>
 <CAFPFaMLEdq0+hYkE49YVbcFvCt00rne6roApcoyY4aK=1ZHpuA@mail.gmail.com>
 <29529061-dc71-c759-590a-b4786936f8c5@aimeos.com>
 <96e40442-a649-f9af-a0cc-dd43cfd1bd0c@gmx.de>
 <CAF+90c-xkV0PUBmOysrQYKoH2-muw0RHSamNJmM27HX1n+Px1Q@mail.gmail.com>
Message-ID: <d798030e-e383-2ae5-f84c-d1175858970d@gmail.com>
Date: Tue, 1 Dec 2020 12:06:22 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0)
 Gecko/20100101 Thunderbird/78.5.0
MIME-Version: 1.0
In-Reply-To: <CAF+90c-xkV0PUBmOysrQYKoH2-muw0RHSamNJmM27HX1n+Px1Q@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] Re: PHP 8 is_file/is_dir input handling
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> First, assuming that a null byte in a file name *is* an error condition, is
> the PHP 8 behavior better than in PHP 7? I think the answer to this one is
> very clearly "yes". The above code snippet and the subtle way in which it

For me as a user that would be a very clear "no". Now if I have any 
usage of these functions in my existing code, I have to go and replace 
them with safe wrapper to ensure it doesn't bail out in random places. 
It may be the same for functions like fopen() where you have to 
error-check anyway, but for functions like is_* it's strictly worse. In 
fact, I am struggling to find a scenario where it's better for me as a 
user from the code robustness PoV - it's either the same or worse.

> is broken is a great illustration of that. PHP 8 makes it obvious that the
> cited code is incorrect.

But it's not incorrect. if is_file("abc\0") returns false, it's correct 
- "abc\0" is not a correct filename, so I expect it to return false. It 
does exactly what I need, so it's correct.

> Second, should a null byte in a file name be an error condition in the
> first place? This is a point I'm not sure about. It would certainly be
> possible to treat paths containing null bytes as non-existing paths, and
> abstract away the fact that paths cannot contain null bytes, and that this
> is a common attack vector.
> 
> I'd personally lean towards not considering null bytes an error condition.

This is a kind of philosophical question, like whether or not trying to 
open a file that doesn't exist is an "error condition". Throw-happy 
languages like Java think it is, other languages like C or PHP treat it 
in different way. But I think in any case what we've got in 8 with is_* 
is not an improvement.

-- 
Stas Malyshev
smalyshev@gmail.com