Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:116759
Date: Sun, 02 Jan 2022 12:05:45 +0000
To: internals <internals@lists.php.net>
User-Agent: K-9 Mail for Android
In-Reply-To: <1641095231.967164658@f750.i.mail.ru>
References: <CABEW5qdH4w3JJpvZP4pD4R2tTvAFLiPZ_UNBnwA_38cZ4Mf8og@mail.gmail.com> <1640910093.890171965@f721.i.mail.ru> <fe1cd7bb-0b28-4e49-32ba-913674d8b6a8@gmail.com> <1641095231.967164658@f750.i.mail.ru>
Message-ID: <2DC31ED4-8C27-4ADF-9946-8369C6E0A42F@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: =?US-ASCII?Q?Re=3A_=5BPHP-DEV=5D_RFC=3A_Stop_to_automatically_cast_nu?= =?US-ASCII?Q?meric-string_to_int_when_using_them_as_array-key?=
From: rowan.collins@gmail.com (Rowan Tommins)

On 2 January 2022 03:47:11 GMT, Kirill Nesmeyanov <nesk@xakep=2Eru> wrote:
>
>I just gave an example of what at the moment can cause an exception in an=
y application that is based on the PSR=2E It is enough to send the header "=
0: Farewell to the server"=2E In some cases (for example, as is the case wi=
th RoadRunner) - this can cause a physical stop and restart of the server=
=2E

Any library where a crafted HTTP request can cause a server shutdown has a=
 bug which needs addressing right now - possibly more than one, actually, a=
s it implies error handling is leaking across request boundaries=2E A chang=
e to the language applied in the next major version would fix this some tim=
e around 2025, once people start adopting it=2E A workaround in the library=
 itself can be applied within weeks=2E

I already gave a simple solution that such libraries can apply right now, =
with very little chance of negative impact: sanitise headers more aggressiv=
ely than the HTTP standard requires, as Apache httpd does, in this case dis=
carding any header containing only digits=2E This is likely to be about thr=
ee lines of code inside a loop preprocessing raw headers:

if ( ctype_digit($rawHeaderName) ) {
     trigger_error("Numeric HTTP header '$rawHeaderName' has been discarde=
d=2E", E_USER_WARNING);
     continue;
}

If I was the maintainer of such a library, I might consider even stricter =
validation, considering what seems like an accidentally broad definition in=
 the HTTP spec, and the possibility of an application receiving even more e=
xotic characters if processing raw TCP traffic=2E


The idea of an array_keys variant or option that forces everything back to=
 string seems like it might be useful (and easy to polyfill for old version=
s)=2E Changing such a fundamental language behaviour in the hope that it wi=
ll fix more code than it breaks is just not worth it=2E

Regards,

--=20
Rowan Tommins
[IMSoP]