Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112782
MIME-Version: 1.0
References: <CAFv4g+GezouDRdyeyOV2eTvNi0K-jko+jf2QBc+MhjbwNiqR1Q@mail.gmail.com>
In-Reply-To: <CAFv4g+GezouDRdyeyOV2eTvNi0K-jko+jf2QBc+MhjbwNiqR1Q@mail.gmail.com>
Date: Wed, 6 Jan 2021 16:46:38 +0100
Message-ID: <CAF+90c-Zhsw-s1VjN1NXHEkuYO+wOTVwbkMbNOJ=EA3mdnQGwQ@mail.gmail.com>
To: Craig Francis <craig@craigfrancis.co.uk>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000084938b05b83d3be6"
Subject: Re: [PHP-DEV] ENT_COMPAT for htmlentities and htmlspecialchars
From: nikita.ppv@gmail.com (Nikita Popov)

--00000000000084938b05b83d3be6
Content-Type: text/plain; charset="UTF-8"

On Sat, Dec 26, 2020 at 12:03 PM Craig Francis <craig@craigfrancis.co.uk>
wrote:

> Hi,
>
> Could htmlspecialchars() use ENT_QUOTES by default?
>
> I recently worked on an example script, where I tried to keep it simple by
> using htmlspecialchars directly, e.g.
>
>     echo "<img src='" . htmlspecialchars($url) . "'>";
>
> I'd completely forgotten that single quotes are not escaped by default,
> creating a XSS vulnerability, e.g.
>
>     $url = "/' onerror='alert(1)";
>
> All the common frameworks I could find use ENT_QUOTES to do this safely
> (details below).
>
> Christoph (cmb69) suggests this was done for HTML4 compatibility, with
> older versions of PHP possibly having issues with numeric character
> references (a quick search suggests PHP 5.4?).
>
> PHP uses the numeric version &#039; with ENT_QUOTES, and it should continue
> to do so - because the named version, &apos; was added in HTML5, but can
> still cause problems with legacy parsers; for example Android 4, and the
> one still in use by Microsoft Outlook (&amp;/&gt;/&lt; was in the
> original HTML spec, and &quot; was added in HTML2).
>
> I'd also be tempted to suggest ENT_SUBSTITUTE should be included, as I
> prefer to keep as much of the valid data (rather than losing everything),
> but that's not as important as escaping the apostrophe by default.
>
> Craig
>
>
>
>
> WordPress uses ENT_QUOTES (ish).
>
> https://developer.wordpress.org/reference/functions/esc_html/
>
> Laravel, with Blade, uses ENT_QUOTES:
>
> https://github.com/illuminate/support/blob/master/helpers.php#L118
>
> Symfony or Slim, with Twig, uses ENT_QUOTES | ENT_SUBSTITUTE:
>
>
> https://github.com/twigphp/Twig/blob/3.x/src/Extension/EscaperExtension.php#L243
>
> CodeIgniter uses ENT_QUOTES | ENT_SUBSTITUTE:
>
>
> https://github.com/codeigniter4/CodeIgniter4/blob/develop/system/ThirdParty/Escaper/Escaper.php#L120
>
> CakePHP uses ENT_QUOTES | ENT_SUBSTITUTE:
>
> https://github.com/cakephp/cakephp/blob/master/src/Core/functions.php#L67
>
> YII uses ENT_QUOTES | ENT_SUBSTITUTE:
>
>
> https://github.com/yiisoft/yii2/blob/master/framework/helpers/BaseHtml.php#L111
>
> Phalcon uses ENT_QUOTES:
>
> https://github.com/phalcon/phalcon/blob/v5.0.x/src/Html/Escaper.php#L78
>
> FuelPHP uses ENT_QUOTES:
>
> https://github.com/fuel/core/blob/1.9/develop/config/config.php#L459


I agree that we should switch the default to ENT_QUOTES. I also agree that
we should enable ENT_SUBSTITUTE by default. I don't see any downside to
these two options.

Would you like to submit a PR?

Nikita

--00000000000084938b05b83d3be6--