Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124899
Message-ID: <fbc70bec-4cf7-4e85-ad95-d1ad046f434f@gmx.de>
Date: Mon, 12 Aug 2024 19:34:40 +0200
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV][Discussion] Should All String Functions
 BecomeMulti-Byte Safe?
To: Nick Lockheart <lists@ageofdream.com>, internals@lists.php.net
References: <CAPn3h8LunRRAEfQXbfuDzMsxwGeFZfsHXs7oB=DTMhN2fgphUg@mail.gmail.com>
 <CAPzBOBOCHO069RPRMHTArv33ZkjOJiweqZpCd6iR12rvNE_XRQ@mail.gmail.com>
 <9bce8dd60b23486ec34caa0174d844096eed26af.camel@ageofdream.com>
Content-Language: de-DE
In-Reply-To: <9bce8dd60b23486ec34caa0174d844096eed26af.camel@ageofdream.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:AvIW/LOlEBY=;cChcmAWW4bOGe39NxH8CTtc+MLk
 eXn5HyF1fylK3xHF5Zx/MYlzpQ8e6qITvrYdeM48o74j60cOu8bKgT0I2pw7DKa5L5N7TFESo
 /Ccs7JKMw1mqIQdz6WJL8V8auVbUfIF9AYnRh8X7lj83TU+6KSTBONcmdkQU+BQ2tzjB54GLz
 hClIODe7k2Fcv7ZHpcFAaks8GWcx22hYNq5lQCEy3FDmOpx81POsQfbhtTqxpE9rfd7Si9tuD
 p+s8FjRoswAbwKU0rVjqNu6B5l0Q+tJ4ss2RxCMk6zsQrBrQ5Pyr8q3Chv5DFtyJBvz92iKel
 Hw6xHVvpoGKW1H+SpXCRt6oSOzaY+DyQdd2+Ouln9uGBQs8hSti0hjnoa9cx23Q+chs7oUWWk
 MenX2jzofsZ4Yq4OxcKln1e/+pdh0IZsscD/LMKfJ2DODe6IO0ClN0bP35j7n1z3kgzIQrf1Z
 mPJk4SD764e/AaVX8dr4LbwKzpd9rVf7zilSbr7psetYnQg6b1XOwLmHUCm9zqVzgUDdiJH4u
 eTER2Azb57QEPojCLtkF+F2v0yFgKwEzWdxSVqw0H5rhLn0SELK5Qekzb63KlcE9tR1g9LCXR
 qZbLlPhbsd1fASGYLuMycVPoZGass5EMMrfBZmBpb1t/M9C6QsOC9e+UiSPAPTtL8EwtYxnCV
 X9ub2RSazcpy3zAchzOWzHE7eSWl8Db9Lek6wQSClde1m0UY9RwWVjD8W+yuai2c8ncRiF8sk
 scBBNyknwxIxH/g5Rmm1XqcMuEFNUSvvrqbbAcMTl8j2Oui5iiCXdzoILu8HZAw8Sl3B/I919
 zx7n6ZbjWZ0bbNo/7wG7MbBddguxJ9BGWGeK/TJS7ahXQ=
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 12.08.2024 at 19:15, Nick Lockheart wrote:

> One report is: https://www.unicode.org/reports/tr36
>
> There's several things in their guide.
>
> They recommend that illegal byte sequences not be deleted as this can
> create an attack vector where two bytes that fit together are split by
> an illegal sequence, that, once removed, puts the two bytes back
> together to make something new, *after* the program has checked for
> dangerous characters:
>
> https://www.unicode.org/reports/tr36/#SecureEncodingConversion
>
>
> In PHP, you should be able to do that with:
>
> $ScrubbedBody =3D mb_scrub($_POST['body'], 'UTF-8');

I suggest to *validate*, not to *sanitize*.  If a malicious user submits
illegal UTF-8, just reject the request right away.  Regular users
shouldn't even notice this.

Christoph