Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130572
Precedence: list
MIME-Version: 1.0
References: <CABVsipicHroAcWJSEpjwM4+y6p-6axV-6tO__MejThESFVCP3A@mail.gmail.com>
 <2c0a3342-aba5-4ca2-969e-350dd4cfcd9d@app.fastmail.com>
In-Reply-To: <2c0a3342-aba5-4ca2-969e-350dd4cfcd9d@app.fastmail.com>
Date: Sun, 5 Apr 2026 11:34:58 +0200
Message-ID: <CABVsipiDjDGQq9x6kZaxBzmLMhD+BEWb3ddii-8Kvu_K0=T3UA@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] [Discussion] array_get and array_has functions
To: Rob Landers <rob@bottled.codes>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary="0000000000001ae756064eb344ac"
From: barel.barelon@gmail.com (Barel)

--0000000000001ae756064eb344ac
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, 5 Apr 2026 at 08:54, Rob Landers <rob@bottled.codes> wrote:

> On Sat, Apr 4, 2026, at 16:06, Barel wrote:
>
> Hi,
>
> I would like to open the discussion on my proposal to add two small,
> focused array functions for retrieving and checking nested array elements
> using dot notation.
>
> This is the link to the RFC:
> https://wiki.php.net/rfc/array_get_and_array_has
>
> This is the link to the proposed implementation:
> https://github.com/php/php-src/pull/21637
>
> Thanks!!
>
> Carlos
>
>
> Hi Barel,
>
> Interesting! As dot-notation isn't used anywhere else, and I don't see it
> discussed as part of the RFC, how are developers to prevent injections of
> dots in user input? With SQL, we have parameters and escaping ... but I
> don't see any of that here.
>
> As an example:
>
> $user =3D [ 'data' =3D> [...], 'password' =3D> 'secret' ];
>
>
> If the path is completely user-controlled (as in the examples given), the=
n
> they can access sensitive information in the array. Even if it is prefixe=
d,
> ie., "data.%s" -- an attacker can simply enumerate all possible keys and
> subkeys.
>
> As it stands, it appears to add a new vulnerability to PHP that will be
> unfamiliar with PHP developers -- unless they're using a framework that
> already does this sort of notation.
>
> =E2=80=94 Rob
>

Thanks Rob. Probably user input is not the best use case for these
functions, I just used it in the examples because it is simple. In any
case, if your program allows unrestricted array access using a user defined
path, the vulnerability already exists, these functions just make it easier
to implement the access. If you did not have them and wanted the same
functionality you would use a custom implementation (like the one provided
by Laravel) and you would have the same vulnerability

Cheers

Carlos

--0000000000001ae756064eb344ac
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Sun, 5 Apr 2026 at 08:54, Rob Landers =
&lt;rob@bottled.codes&gt; wrote:</div><div class=3D"gmail_quote gmail_quote=
_container"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0=
.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u><div><=
div>On Sat, Apr 4, 2026, at 16:06, Barel wrote:</div><blockquote type=3D"ci=
te" id=3D"m_4106812630498853755qt"><div dir=3D"ltr"><div>Hi,</div><div><br>=
</div><div><div>I would like to open the discussion on my proposal to add t=
wo small, focused array functions for retrieving and checking nested array =
elements using dot notation.</div><div><br></div><div>This is the link to t=
he RFC:=C2=A0<a href=3D"https://wiki.php.net/rfc/array_get_and_array_has" t=
arget=3D"_blank">https://wiki.php.net/rfc/array_get_and_array_has</a></div>=
<div><br></div><div>This is the link to the proposed implementation:=C2=A0<=
a href=3D"https://github.com/php/php-src/pull/21637" target=3D"_blank">http=
s://github.com/php/php-src/pull/21637</a></div></div><div><br></div><div>Th=
anks!!</div><div><br></div><div>Carlos</div></div></blockquote><div><br></d=
iv><div>Hi Barel,</div><div><br></div><div>Interesting! As dot-notation isn=
&#39;t used anywhere else, and I don&#39;t see it discussed as part of the =
RFC, how are developers to prevent injections of dots in user input? With S=
QL, we have parameters and escaping ... but I don&#39;t see any of that her=
e.</div><div><br></div><div>As an example:</div><div><br></div><pre style=
=3D"border-width:1px;border-style:solid;border-color:rgb(204,204,204);borde=
r-radius:3px;background-image:initial;background-size:initial;background-re=
peat:initial;background-origin:initial;background-clip:initial;background-c=
olor:rgb(246,246,246);font-family:menlo,consolas,monospace;font-size:90%;ma=
rgin:7px 0px;padding:7px 10px">$user =3D [ &#39;data&#39; =3D&gt; [...], &#=
39;password&#39; =3D&gt; &#39;secret&#39; ];</pre><div><br></div><div>If th=
e path is completely user-controlled (as in the examples given), then they =
can access sensitive information in the array. Even if it is prefixed, ie.,=
 &quot;data.%s&quot; -- an attacker can simply enumerate all possible keys =
and subkeys.</div><div><br></div><div>As it stands, it appears to add a new=
 vulnerability to PHP that will be unfamiliar with PHP developers -- unless=
 they&#39;re using a framework that already does this sort of notation.</di=
v><div><br></div><div id=3D"m_4106812630498853755sig121229152">=E2=80=94 Ro=
b</div></div></blockquote><div><br></div><div>Thanks Rob. Probably user inp=
ut is not the best use case for these functions, I just used it in the exam=
ples because it is simple. In any case, if your program allows unrestricted=
 array access using a user defined path, the vulnerability already exists, =
these functions just make it easier to implement the access. If you did not=
 have them and wanted the same functionality you would use a custom impleme=
ntation (like the one provided by Laravel) and you would have the same vuln=
erability=C2=A0</div><div><br></div><div>Cheers<br><br>Carlos</div></div></=
div>

--0000000000001ae756064eb344ac--