Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:130456 X-Original-To: internals@lists.php.net Delivered-To: internals@lists.php.net Received: from php-smtp4.php.net (php-smtp4.php.net [45.112.84.5]) by lists.php.net (Postfix) with ESMTPS id B23351A00BC for ; Wed, 25 Mar 2026 19:20:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=php.net; s=mail; t=1774466438; bh=zRC3IRlM0oXuRQ89egu6VeNoedlfeEHHkTOF0a48OUI=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=nKqnZL/Il7bd3lJkwK+DK2sunIHCTcvHUjxOV17UXCVpAF8Ou2pkpqEOf3YVWdGN4 z5WHYMCljOXwf2s8ZEey9rPuTOpqVC+mcQexB+shvH2g/CoatS/3zjITk4wY/pCxZ4 oRs/OPXKM1g1qut5SCGiQgTGxUf0BwQwgbun+dFMjaAN0Gzylg9pBOD9mQ1CS5bEX0 3fwdwAnVfUcTufcRXqxI46YtFPiBS9fIZ7ABG2oXqL2aMqkRi6E7tV/OQdCSOVPXIn vyrAu9IPmFy9YA+eL4y2QNuBFjXvPbV46wYXnW25bOufwzew+nPGWWR5Byohs8CY4T cSPfEEJEZL8bA== Received: from php-smtp4.php.net (localhost [127.0.0.1]) by php-smtp4.php.net (Postfix) with ESMTP id 3D3E6180062 for ; Wed, 25 Mar 2026 19:20:34 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on php-smtp4.php.net X-Spam-Level: *** X-Spam-Status: No, score=3.8 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_50, DKIM_SIGNED,DKIM_VALID,DMARC_MISSING,HTML_MESSAGE,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_SOFTFAIL autolearn=no autolearn_force=no version=4.0.1 X-Spam-Virus: No X-Envelope-From: Received: from mail-ej1-f52.google.com (mail-ej1-f52.google.com [209.85.218.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by php-smtp4.php.net (Postfix) with ESMTPS for ; Wed, 25 Mar 2026 19:20:33 +0000 (UTC) Received: by mail-ej1-f52.google.com with SMTP id a640c23a62f3a-b8f97c626aaso25931766b.2 for ; Wed, 25 Mar 2026 12:20:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1774466428; cv=none; d=google.com; s=arc-20240605; b=TdTCt2510bLU+Lyxx8wI8Uc3CNV22Z1vKHK3V+8IEWUUaO+jxHvpaV/A/nVhOe0dJY JqqA8pIi3Dpl7gyfKkVIJyYsl2+lrezmfQaxFX5GwnpOFnz5/ejTrZJxlEtVB9NAmFL1 wPI0FOHcE4gwo+nofWXMqwHwu/mTTUdHnO4SrADtLLiOBkEvnDvBvpsQCYv9/gWpqfM+ v4RSMddVCfU2ALrWx7wzdRlj0W3bT+91zW9JgHCGroyruJNTpRE7zepJC0gsrMJbx3u2 7sUSA5WkS3tk4dtgWI6Wj92At72pLlmWAITmrmgHzpj2lA61SRXJQOdNAInJZ0uV/AEL xx8A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=RDTkR0EXdXC/3K3vjhepdGozXL4ZbeJzHuWq0EH3G+E=; fh=qlVqNpzd5JAjVxu5TFIZ0+XZzzut7zIwV6lsb7AXs34=; b=cMJaOcxKz9Qc3TYPiTU6R1Ih1/MUgIcEmQd34xKqSE2pFBp3i9bDDtnxgg+aoPeI8A 7JL2YHtaMpUuM+C9PEVI1wVz6LPRDUGodqJvxLv4E8ChKSm2lkLbjsoQ8Wpz0o++Ztt5 PzZSPDpB8zn33T6SCGN9yhMoibBDk29BNRuPyLuGduAiaVU3KEZGZF8IXJvhSpOn7mbl 638dlcxHEIajtuOXhxQ3vaUxy0zmWx8S8jWF+cgs0kH31gvmSoAa1XnwJJAc+nhPJiRi SkPwShcsD73aQBeQ5icFdXABUhL1ad7IeU5znW4jLNvuUJcd/0Z+ytXj4SV2ryqkPthe zuTA==; darn=lists.php.net ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=golemon-com.20230601.gappssmtp.com; s=20230601; t=1774466428; x=1775071228; darn=lists.php.net; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=RDTkR0EXdXC/3K3vjhepdGozXL4ZbeJzHuWq0EH3G+E=; b=WZMEpchGi/+Bf3gCG39v/6O/tYhJYtUm2koxQMwtXUQBs2hMIdv0ouQuwEL1f46DU2 0frY8JcpbPd4hyFXzg3w4hNx+zq39iv/+LsjxOeEgX9BnYrYUW23jaftGl4mlvOzViZt J3JhZrExwHS4jAr9k5oE7hPn2IGVoXIFxDa2920OEqGksa2HtEKVIUSLDBcl1Znu6m+X ct5MySYjdZu20TQwgkv7ZxJ4KgMep+xRWxGuwjfT3bZuZXTQjI4sSyhio9TwMSyutjKP JT3WE/AdQIhSyALlygvWEgUFZXQCmMSg71IRCPaj1IUpGqJT3a4PEsWkBCWkSFDFGaQc FckQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774466428; x=1775071228; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=RDTkR0EXdXC/3K3vjhepdGozXL4ZbeJzHuWq0EH3G+E=; b=JaOkaQxS/40SVKbluzJCA3xRCBGYyNuYB2kL5vZAfYh7tb2xp4sWFRzWL7F4Pxb6eu LpaEj1zHGrnj6juwNMvBY7gj6W1BoX1RLY2OxbX9qsIMtmiI50nKb3sbiQ2KEI+mzQ9r PaNW2x88xoQMHosRVws6cuZvBo2pWfzqxYLqDgQ+xgHW+uk8gpn4Wn6T/Fr9aZzfWwCq p9esh6VCZUVlkkgJSshGLSn+XH93GBWb1yAXQjbZRSsYXEy32PfskT7feFRBLb+C3vGx AQh2Ma8jenAE6q7wzpM19bRti6w2AMye5J7TrFHyNx9cMDjKpCZgN8F/nG7UOpVUQcTT JfXQ== X-Gm-Message-State: AOJu0YyIeUiDkZXSJJcCSeEafjbcloAix8P7chxmdQKhZCYm9Vw2RJ3o qhYNpWfsRllEUOEwb5bX98JWIqPOIsC3lGwThAxkGSlyxRf+QVrqu7k1L0Uck7Cp1740Urwotwn kWUkElU6yXzbRhGU3PuUJ5pFsgiCmuGU0LQPoKTrmWQ== X-Gm-Gg: ATEYQzyI5Iks5DL4LGJtuyWWBFROltQ/Ke4n+F9FfCrR4rF+pNJp/E3y3IS1mRtU0/K lQNmx2Sg9fNje8KFFzeKowWfQPyPZNWQjbwsSEqEE9tkHoafyuNgMPFv67I0+7F8xn9pR1UixDd //jBtozE6OC/RD89JYfbIHKBo/+YQ1JC0UfVE9TDj4/g+ckEZ9x0ZgwgOeOlkESd5CicwEjveGB eyibszyzsWiUVFrZ6VCvzp0Z94FyTesYgjNBXFy6xB9XukW1/+hvOTVFvxKjx5y+IvbOslUU3J+ IvFJS9M= X-Received: by 2002:a17:907:d096:b0:b94:1bd:13fa with SMTP id a640c23a62f3a-b9a3f1b0b8bmr340140666b.21.1774466427531; Wed, 25 Mar 2026 12:20:27 -0700 (PDT) Precedence: list list-help: list-unsubscribe: list-post: List-Id: x-ms-reactions: disallow MIME-Version: 1.0 References: <3f4f6959.eaf.19cf0276cd8.Coremail.lamentxu@163.com> In-Reply-To: <3f4f6959.eaf.19cf0276cd8.Coremail.lamentxu@163.com> Date: Wed, 25 Mar 2026 14:20:11 -0500 X-Gm-Features: AQROBzDDzI8D5pggZtbTlW17Jsd0Mi5C6-n5Dbpq_ZkCDGpZJ813kzOIykqiqkM Message-ID: Subject: Re: [PHP-DEV] [RFC] Remove \0 from default trim() character mask To: LamentXU Cc: "internals@lists.php.net" Content-Type: multipart/alternative; boundary="000000000000143e66064dde2907" From: php@golemon.com (Sara Golemon) --000000000000143e66064dde2907 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Mar 15, 2026 at 1:24=E2=80=AFAM LamentXU wrote: > I am sending this to introduce my new RFC: https://wiki.php.net/RFC/dont_trim_NUL > I'm not a fan of this for the reasons that several others have already stated. While \0 may not be technically whitespace, you have 30 years of scripts expecting it to be trimmed and undoing that potentially (though perhaps not actually) opens up new security vulnerability for dubious gain. I hope nobody is depending on this to remove *all* null bytes, because of course it won't, but I fail to see how a text oriented function (the notion of whitespace makes this not binary oriented) should be in favor of preserving nulls under any circumstance. If anything functions like this which are specifically text oriented should (perhaps, but for performance and historical raisins probably not) be elevated to throw on discovering null bytes anywhere in the string. -Sara --000000000000143e66064dde2907 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sun, Mar 15, 2026 at 1:24=E2=80=AFAM LamentXU <lamentxu@163.com> wrote:
> I am= sending this to introduce my new RFC: https://wiki.php.net/RFC/dont_trim_NUL
>
=C2=A0=
I'm not a fan of this for the reasons that several others have alre= ady stated.=C2=A0 While \0 may not be technically whitespace, you have 30 y= ears of scripts expecting it to be trimmed and undoing that potentially (th= ough perhaps not actually) opens up new security vulnerability for dubious = gain.=C2=A0 I hope nobody is depending on this to remove *all* null bytes, = because of course it won't, but I fail to see how a text oriented funct= ion (the notion of whitespace makes this not binary oriented) should be in = favor of preserving nulls under any circumstance.=C2=A0 If anything functio= ns like this which are specifically text oriented should (perhaps, but for = performance and historical raisins probably not) be elevated to throw on di= scovering null bytes anywhere in the string.

-Sara
=
--000000000000143e66064dde2907--