Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:112358 Return-Path: Delivered-To: mailing list internals@lists.php.net Received: (qmail 19341 invoked from network); 1 Dec 2020 20:43:00 -0000 Received: from unknown (HELO php-smtp4.php.net) (45.112.84.5) by pb1.pair.com with SMTP; 1 Dec 2020 20:43:00 -0000 Received: from php-smtp4.php.net (localhost [127.0.0.1]) by php-smtp4.php.net (Postfix) with ESMTP id D3BE01804C9 for ; Tue, 1 Dec 2020 12:10:30 -0800 (PST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on php-smtp4.php.net X-Spam-Level: X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,SPF_PASS autolearn=no autolearn_force=no version=3.4.2 X-Spam-Virus: No X-Envelope-From: Received: from mail.thelounge.net (mail.thelounge.net [91.118.73.15]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by php-smtp4.php.net (Postfix) with ESMTPS for ; Tue, 1 Dec 2020 12:10:30 -0800 (PST) Received: from srv-rhsoft.rhsoft.net (rh.vpn.thelounge.net [10.10.10.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256)) (No client certificate requested) (Authenticated sender: h.reindl@thelounge.net) by mail.thelounge.net (THELOUNGE MTA) with ESMTPSA id 4CltWS3T5nzXVk; Tue, 1 Dec 2020 21:10:28 +0100 (CET) To: Stanislav Malyshev , PHP Internals References: <0774c293-afd7-d8b9-175f-217ed600d1ea@aimeos.com> <29529061-dc71-c759-590a-b4786936f8c5@aimeos.com> <96e40442-a649-f9af-a0cc-dd43cfd1bd0c@gmx.de> Organization: RH Software Message-ID: <2729ea34-b44d-da3d-f33e-4a31666112a2@rhsoft.net> Date: Tue, 1 Dec 2020 21:10:28 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] Re: PHP 8 is_file/is_dir input handling From: harry@rhsoft.net ("Reindl Harald (privat)") Am 01.12.20 um 21:06 schrieb Stanislav Malyshev: > Hi! > >> First, assuming that a null byte in a file name *is* an error >> condition, is >> the PHP 8 behavior better than in PHP 7? I think the answer to this >> one is >> very clearly "yes". The above code snippet and the subtle way in which it > > For me as a user that would be a very clear "no". Now if I have any > usage of these functions in my existing code, I have to go and replace > them with safe wrapper to ensure it doesn't bail out in random places yeah, you should think about external input *before* do anything with it, always! if you pass a random path with NULL you did not do anything to validate the input millions of security issues in whatever programming language are the result of "i throw the input somewhere and don't mind" if you ever reach that exception you have a stacktrace up to the point where you should have stopped proceed at all