Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130567
Content-Type: text/plain; charset=utf-8
Message-ID: <1775376880059.1437066672.2965818070@yahoo.de>
To: rob@bottled.codes
Cc: internals@lists.php.net
Subject: Re: [PHP-DEV] [RFC] [Discussion] array_get and array_has functions
Date: Sun, 05 Apr 2026 08:22:18 +0000
In-Reply-To: <2c0a3342-aba5-4ca2-969e-350dd4cfcd9d@app.fastmail.com>
References: <2c0a3342-aba5-4ca2-969e-350dd4cfcd9d@app.fastmail.com>
User-Agent: Vivaldi Mail/7.9.3970.47
Content-Transfer-Encoding: quoted-printable
Precedence: list
MIME-Version: 1.0
From: hanskrentel@yahoo.de (Hans Krentel)





On Sunday 05 April 2026 08:51:30 (+02:00), Rob Landers wrote:

> On Sat, Apr 4, 2026, at 16:06, Barel wrote:
> > Hi,
> >=20
> > I would like to open the discussion on my proposal to add two small, =
focused array functions for retrieving and checking nested array elements =
using dot notation.
> >=20
> > This is the link to the RFC: https://wiki.php.net/rfc/array_get_and_arr=
ay_has
> >=20
> > This is the link to the proposed implementation: https://github.=
com/php/php-src/pull/21637
> >=20
> > Thanks!!
> >=20
> > Carlos
>=20
> Hi Barel,
>=20
> Interesting! As dot-notation isn't used anywhere else, and I don't see it=
 discussed as part of the RFC, how are developers to prevent injections of =
dots in user input? With SQL, we have parameters and escaping ... but I =
don't see any of that here.
>=20
> As an example:
>=20
> $user =3D [ 'data' =3D> [...], 'password' =3D> 'secret' ];
>=20
> If the path is completely user-controlled (as in the examples given), =
then they can access sensitive information in the array. Even if it is =
prefixed, ie., "data.%s" -- an attacker can simply enumerate all possible =
keys and subkeys.
>=20
> As it stands, it appears to add a new vulnerability to PHP that will be =
unfamiliar with PHP developers -- unless they're using a framework that =
already does this sort of notation.

I wouldn=E2=80=99t go that far, but I=E2=80=99d like to start by =
emphasizing that the dot notation described here clearly does not provide a=
 mechanism for escaping the dot. That=E2=80=99s probably a shortcoming, but=
 if any user-supplied string key poses a security risk, then PHP arrays are=
 also affected, and this vulnerability would be nothing new! (Rather, it =
would be to be expected.)

-- hakre