Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:55357
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain yahoo.co.jp designates 114.111.99.167 as permitted sender)
DomainKey-Status: good
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=yj20050223; d=yahoo.co.jp;
  h=Received:X-Apparently-From:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:Content-Type:Content-Transfer-Encoding;
  b=Wt1UJrcZDWErbhBq7pbZVWbr8vu6a6rcRGguswgT3G60NHWgoMJrLRp/NIxBdoLC0WJTPNAHVmFJXlRcm+h87U9w/iDDQNkrqitPTHurHT8iGrcsKyVRHY5tDkDXwldA  ;
Message-ID: <4E6C39AC.3000607@yahoo.co.jp>
Date: Sun, 11 Sep 2011 13:31:40 +0900
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.21) Gecko/20110831 Thunderbird/3.1.13
MIME-Version: 1.0
To: internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: proposal for change the argument of parse_str/mb_parse_str
From: rui_hirokawa@yahoo.co.jp (Rui Hirokawa)

Hello,

I think the second argument of parse_str/mb_parse_str
should be changed from optional to mandatory.

parse_str(string encoded_string [, array result])
-> parse_str(string encoded_string , array result)

It is to reduce the risk of vulnerability, and it has neary same risk
as register_globals which is removed from PHP 5.4.

The vulnerability against code injection attack found in a recent 
version of
phpMyAdmin is just a example.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2505
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2506

The current implementation of parse_str changes
the active symbol table in the function.
I think that it has the possible security risk like,
http://www.php-security.org/MOPB/MOPB-26-2007.html

The side effect is that thhe old code like parse_str($query_string) should
be changed, but, I think it is good direction to improve the security.

Rui

--
Rui Hirokawa <hirokawa@php.net>