Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:32496
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 66.249.92.168 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:from:subject:date:user-agent:mime-version:to:content-type:message-id;
        b=pj5VFBYhRqeioknAlzp0Qz5uaFP3cYTvYhlnpvGqQF4gzDGeoPqX4KPZH2wmCfYcQ6YcDoTqcNXGM/SZpuFGhFYsN231nxTxXzusnBYgzdLQOTCzmFwrwmD7bR8oT936pKSJKcxLUzxiiWCTMYot1BPOWPcHmruih2lL+MCzJXU=
Date: Sat, 29 Sep 2007 16:54:26 +0200
User-Agent: KMail/1.9.7
MIME-Version: 1.0
To: "PHP Internals List" <internals@lists.php.net>
Content-Type: Multipart/Mixed;
  boundary="Boundary-00=_icm/Ga/cTW/Ukem"
Message-ID: <200709291654.26242.arnaud.lb@gmail.com>
Subject: [PATCH] Bug#42718 (FILTER_UNSAFE_RAW not applied when configured as default filter, even with flags)
From: arnaud.lb@gmail.com ("Arnaud.lb")

--Boundary-00=_icm/Ga/cTW/Ukem
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi,

Here is a patch to fix bug #42718:

http://bugs.php.net/?id=42718&edit=1

The "unsafe_raw" filter is not applied when configured as default 
filter.

I found that the php_sapi_filter() internal function in 
ext/filter/filter.c intentionally bypass this filter:

if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW)){
 (apply default filter)
} else [...]

The unsafe_raw filter does nothing by default, but it 
can "optionally strip or encode special characters", and it is the 
only filter which is able to do that without doing any other 
filtering.

I suggest to not bypass the unsafe_raw filter when default_filter_flags is 
different than 0 (bug42718.patch attached).

I also wrote a testcase for this bug: bug42718.phpt.

And an other testcase (052.phpt) to check if the patch does not modify the 
behavior of the php_sapi_filter() function:

- Apply filter, only if filter will do something (unsafe_raw with no 
flags do nothing)
- Else, fallback to magic_quotes_gpc if enabled

Regards

--Boundary-00=_icm/Ga/cTW/Ukem
Content-Type: text/x-diff;
  charset="iso-8859-1";
  name="bug42718.patch"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
	filename="bug42718.patch"

SW5kZXg6IGV4dC9maWx0ZXIvZmlsdGVyLmMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQpSQ1MgZmlsZTogL3JlcG9zaXRv
cnkvcGhwLXNyYy9leHQvZmlsdGVyL2ZpbHRlci5jLHYKcmV0cmlldmluZyByZXZpc2lvbiAxLjUy
LjIuMzkKZGlmZiAtdSAtcjEuNTIuMi4zOSBmaWx0ZXIuYwotLS0gZXh0L2ZpbHRlci9maWx0ZXIu
Ywk0IEFwciAyMDA3IDIwOjUwOjI2IC0wMDAwCTEuNTIuMi4zOQorKysgZXh0L2ZpbHRlci9maWx0
ZXIuYwkyMyBTZXAgMjAwNyAxNTo0NToyMSAtMDAwMApAQCAtNDAzLDcgKzQwMyw3IEBACiAJCVpf
U1RSTEVOKG5ld192YXIpID0gdmFsX2xlbjsKIAkJWl9UWVBFKG5ld192YXIpID0gSVNfU1RSSU5H
OwogCi0JCWlmICghKElGX0coZGVmYXVsdF9maWx0ZXIpID09IEZJTFRFUl9VTlNBRkVfUkFXKSkg
eworCQlpZiAoIShJRl9HKGRlZmF1bHRfZmlsdGVyKSA9PSBGSUxURVJfVU5TQUZFX1JBVykgfHwg
SUZfRyhkZWZhdWx0X2ZpbHRlcl9mbGFncykgIT0gMCkgewogCQkJenZhbCAqdG1wX25ld192YXIg
PSAmbmV3X3ZhcjsKIAkJCVpfU1RSVkFMKG5ld192YXIpID0gZXN0cm5kdXAoKnZhbCwgdmFsX2xl
bik7CiAJCQlJTklUX1BaVkFMKHRtcF9uZXdfdmFyKTsK

--Boundary-00=_icm/Ga/cTW/Ukem
Content-Type: text/plain;
  charset="iso-8859-1";
  name="bug42718.phpt"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
	filename="bug42718.phpt"

LS1URVNULS0KQnVnICM0MjcxOCAodW5zYWZlX3JhdyBmaWx0ZXIgbm90IGFwcGxpZWQgd2hlbiBj
b25maWd1cmVkIGFzIGRlZmF1bHQgZmlsdGVyKQotLVNLSVBJRi0tCjw/cGhwIGlmICghZXh0ZW5z
aW9uX2xvYWRlZCgiZmlsdGVyIikpIGRpZSgic2tpcCIpOyA/PgotLUlOSS0tCm1hZ2ljX3F1b3Rl
c19ncGM9MApmaWx0ZXIuZGVmYXVsdD11bnNhZmVfcmF3CmZpbHRlci5kZWZhdWx0X2ZsYWdzPTQK
LS1HRVQtLQphPTElMDAKLS1GSUxFLS0KPD9waHAKZWNobyBpbmlfZ2V0KCdmaWx0ZXIuZGVmYXVs
dCcpIC4gIlxuIjsKZWNobyBpbmlfZ2V0KCdmaWx0ZXIuZGVmYXVsdF9mbGFncycpIC4gIlxuIjsK
ZWNobyBhZGRjc2xhc2hlcygkX0dFVFsnYSddLCJcMCIpIC4gIlxuIjsKPz4KLS1FWFBFQ1QtLQp1
bnNhZmVfcmF3CjQKMQo=

--Boundary-00=_icm/Ga/cTW/Ukem
Content-Type: text/plain;
  charset="iso-8859-1";
  name="052.phpt"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
	filename="052.phpt"

LS1URVNULS0KZmFsbGJhY2sgdG8gbWFnaWNfcXVvdGVzIHdoZW4gbm8gZmlsdGVyIGlzIHRvIGJl
IGFwcGxpZWQKLS1TS0lQSUYtLQo8P3BocCBpZiAoIWV4dGVuc2lvbl9sb2FkZWQoImZpbHRlciIp
KSBkaWUoInNraXAiKTsgPz4KLS1JTkktLQptYWdpY19xdW90ZXNfZ3BjPTEKZmlsdGVyLmRlZmF1
bHQ9dW5zYWZlX3JhdwpmaWx0ZXIuZGVmYXVsdF9mbGFncz0KLS1HRVQtLQphPTElMDAKLS1GSUxF
LS0KPD9waHAKZWNobyBpbmlfZ2V0KCdmaWx0ZXIuZGVmYXVsdCcpIC4gIlxuIjsKZWNobyBpbmlf
Z2V0KCdmaWx0ZXIuZGVmYXVsdF9mbGFncycpIC4gIlxuIjsKZWNobyBhZGRjc2xhc2hlcygkX0dF
VFsnYSddLCJcMCIpIC4gIlxuIjsKPz4KLS1FWFBFQ1QtLQp1bnNhZmVfcmF3CgoxXDAK

--Boundary-00=_icm/Ga/cTW/Ukem--