Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:56759
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <4EDA4989.2010702@akbkhome.com>
References: <4EDA4989.2010702@akbkhome.com>
Date: Sun, 4 Dec 2011 15:05:02 +0100
Message-ID: <CAH-PCH76g4LwEwzaEvU3Hp7PeeyMUN4sc0uZExkedhHvYYnm9A@mail.gmail.com>
To: Alan Knowles <alan@akbkhome.com>
Cc: PHP Internals List <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=0016e64082dc34bb7f04b344b066
Subject: Re: [PHP-DEV] Fixing string offsets of strings.
From: tyra3l@gmail.com (Ferenc Kovacs)

--0016e64082dc34bb7f04b344b066
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Sat, Dec 3, 2011 at 5:08 PM, Alan Knowles <alan@akbkhome.com> wrote:

> I've had a look at making string offsets of strings a bit saner.
>
> At present with the fix for array dereferencing :  ?search=3Dhello and a
> test like isset($_GET['search']['name'])  results in true, which is has
> potential security problems and is very confusing for any programmer
> finding and working out why something like that may be failing.
>
> To solve this quite a few people agreed that not allowing non-numeric
> string offsets on strings would be the smart way to go, the change is goi=
ng
> to break BC, so the idea is to at least not break it too badly...
>
> This patch is a start.
> https://bugs.php.net/patch-**display.php?bug_id=3D60362&**
> patch=3Dfirst_effort_to_fix_**this&revision=3Dlatest<https://bugs.php.net=
/patch-display.php?bug_id=3D60362&patch=3Dfirst_effort_to_fix_this&revision=
=3Dlatest>
>
> It's been quite a while since I hacked on the engine, so the patch only
> works reasonably well.. (see the FIXME on the tests at the bottom of the
> patch.)
>
> The patch changes the following:
>  * $s =3D "string";  $s['offset'] -- produces a warning (and returns an
> empty string)
>  * $s =3D "string";  $s['1'] -- works as before..
>  * $s =3D "string";  $s[true] $s[false] $s[0.1] -- give a notice (cast it=
 to
> an int if you want to get rid of the notice) - however work as before.
>  * changes the warning on invalid indexes to say "Uninitialized or
> invalid" rather than just "Uninitialized"
>  * fixes most of the related tests
>

I think that those changes are pretty much in line with the discussion that
we had.
Thanks for fixing this!


--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--0016e64082dc34bb7f04b344b066--