Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130565
Feedback-ID: ifab94697:Fastmail
Precedence: list
MIME-Version: 1.0
Date: Sun, 05 Apr 2026 08:51:30 +0200
To: internals@lists.php.net
Message-ID: <2c0a3342-aba5-4ca2-969e-350dd4cfcd9d@app.fastmail.com>
In-Reply-To: 
 <CABVsipicHroAcWJSEpjwM4+y6p-6axV-6tO__MejThESFVCP3A@mail.gmail.com>
References: 
 <CABVsipicHroAcWJSEpjwM4+y6p-6axV-6tO__MejThESFVCP3A@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] [Discussion] array_get and array_has functions
Content-Type: multipart/alternative;
 boundary=ceda96355f5c45d892a533391998f811
From: rob@bottled.codes ("Rob Landers")

--ceda96355f5c45d892a533391998f811
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On Sat, Apr 4, 2026, at 16:06, Barel wrote:
> Hi,
>=20
> I would like to open the discussion on my proposal to add two small, f=
ocused array functions for retrieving and checking nested array elements=
 using dot notation.
>=20
> This is the link to the RFC: https://wiki.php.net/rfc/array_get_and_ar=
ray_has
>=20
> This is the link to the proposed implementation: https://github.com/ph=
p/php-src/pull/21637
>=20
> Thanks!!
>=20
> Carlos

Hi Barel,

Interesting! As dot-notation isn't used anywhere else, and I don't see i=
t discussed as part of the RFC, how are developers to prevent injections=
 of dots in user input? With SQL, we have parameters and escaping ... bu=
t I don't see any of that here.

As an example:

$user =3D [ 'data' =3D> [...], 'password' =3D> 'secret' ];

If the path is completely user-controlled (as in the examples given), th=
en they can access sensitive information in the array. Even if it is pre=
fixed, ie., "data.%s" -- an attacker can simply enumerate all possible k=
eys and subkeys.

As it stands, it appears to add a new vulnerability to PHP that will be =
unfamiliar with PHP developers -- unless they're using a framework that =
already does this sort of notation.

=E2=80=94 Rob
--ceda96355f5c45d892a533391998f811
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><title></title></head><body><div>On Sat, Apr =
4, 2026, at 16:06, Barel wrote:</div><blockquote type=3D"cite" id=3D"qt"=
 style=3D""><div dir=3D"ltr"><div>Hi,</div><div><br></div><div><div>I wo=
uld like to open the discussion on my proposal to add two small, focused=
 array functions for retrieving and checking nested array elements using=
 dot notation.</div><div><br></div><div>This is the link to the RFC:&nbs=
p;<a href=3D"https://wiki.php.net/rfc/array_get_and_array_has">https://w=
iki.php.net/rfc/array_get_and_array_has</a></div><div><br></div><div>Thi=
s is the link to the proposed implementation:&nbsp;<a href=3D"https://gi=
thub.com/php/php-src/pull/21637">https://github.com/php/php-src/pull/216=
37</a></div></div><div><br></div><div>Thanks!!</div><div><br></div><div>=
Carlos</div></div></blockquote><div><br></div><div>Hi Barel,</div><div><=
br></div><div>Interesting! As dot-notation isn't used anywhere else, and=
 I don't see it discussed as part of the RFC, how are developers to prev=
ent injections of dots in user input? With SQL, we have parameters and e=
scaping ... but I don't see any of that here.</div><div><br></div><div>A=
s an example:</div><div><br></div><pre style=3D"border-top-width:1px;bor=
der-right-width:1px;border-bottom-width:1px;border-left-width:1px;border=
-top-style:solid;border-right-style:solid;border-bottom-style:solid;bord=
er-left-style:solid;border-top-color:rgb(204, 204, 204);border-right-col=
or:rgb(204, 204, 204);border-bottom-color:rgb(204, 204, 204);border-left=
-color:rgb(204, 204, 204);border-image-source:initial;border-image-slice=
:initial;border-image-width:initial;border-image-outset:initial;border-i=
mage-repeat:initial;border-top-left-radius:3px;border-top-right-radius:3=
px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;backgrou=
nd-image:initial;background-position-x:initial;background-position-y:ini=
tial;background-size:initial;background-repeat:initial;background-attach=
ment:initial;background-origin:initial;background-clip:initial;backgroun=
d-color:rgb(246, 246, 246);font-family:menlo, consolas, monospace;font-s=
ize:90%;margin-top:7px;margin-right:0px;margin-bottom:7px;margin-left:0p=
x;padding-top:7px;padding-right:10px;padding-bottom:7px;padding-left:10p=
x;white-space-collapse:preserve;text-wrap-mode:wrap;overflow-wrap:break-=
word;">$user =3D [ 'data' =3D&gt; [...], 'password' =3D&gt; 'secret' ];<=
/pre><div><br></div><div>If the path is completely user-controlled (as i=
n the examples given), then they can access sensitive information in the=
 array. Even if it is prefixed, ie., "data.%s" -- an attacker can simply=
 enumerate all possible keys and subkeys.</div><div><br></div><div>As it=
 stands, it appears to add a new vulnerability to PHP that will be unfam=
iliar with PHP developers -- unless they're using a framework that alrea=
dy does this sort of notation.</div><div><br></div><div id=3D"sig1212291=
52">=E2=80=94 Rob</div></body></html>
--ceda96355f5c45d892a533391998f811--