Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:56761
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.42 as permitted sender)
MIME-Version: 1.0
Sender: laruence@gmail.com
In-Reply-To: <CAH-PCH76g4LwEwzaEvU3Hp7PeeyMUN4sc0uZExkedhHvYYnm9A@mail.gmail.com>
References: <4EDA4989.2010702@akbkhome.com> <CAH-PCH76g4LwEwzaEvU3Hp7PeeyMUN4sc0uZExkedhHvYYnm9A@mail.gmail.com>
Date: Sun, 4 Dec 2011 22:25:41 +0800
Message-ID: <CABBJUpfNRaa580ZCtsYHCbDat1Sxbo7tNz2MiNQ68foPFTq61g@mail.gmail.com>
To: Ferenc Kovacs <tyra3l@gmail.com>
Cc: Alan Knowles <alan@akbkhome.com>, PHP Internals List <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Fixing string offsets of strings.
From: laruence@php.net (Laruence)

+1.

thanks.

On Sun, Dec 4, 2011 at 10:05 PM, Ferenc Kovacs <tyra3l@gmail.com> wrote:
> On Sat, Dec 3, 2011 at 5:08 PM, Alan Knowles <alan@akbkhome.com> wrote:
>
>> I've had a look at making string offsets of strings a bit saner.
>>
>> At present with the fix for array dereferencing : =C2=A0?search=3Dhello =
and a
>> test like isset($_GET['search']['name']) =C2=A0results in true, which is=
 has
>> potential security problems and is very confusing for any programmer
>> finding and working out why something like that may be failing.
>>
>> To solve this quite a few people agreed that not allowing non-numeric
>> string offsets on strings would be the smart way to go, the change is go=
ing
>> to break BC, so the idea is to at least not break it too badly...
>>
>> This patch is a start.
>> https://bugs.php.net/patch-**display.php?bug_id=3D60362&**
>> patch=3Dfirst_effort_to_fix_**this&revision=3Dlatest<https://bugs.php.ne=
t/patch-display.php?bug_id=3D60362&patch=3Dfirst_effort_to_fix_this&revisio=
n=3Dlatest>
>>
>> It's been quite a while since I hacked on the engine, so the patch only
>> works reasonably well.. (see the FIXME on the tests at the bottom of the
>> patch.)
>>
>> The patch changes the following:
>> =C2=A0* $s =3D "string"; =C2=A0$s['offset'] -- produces a warning (and r=
eturns an
>> empty string)
>> =C2=A0* $s =3D "string"; =C2=A0$s['1'] -- works as before..
>> =C2=A0* $s =3D "string"; =C2=A0$s[true] $s[false] $s[0.1] -- give a noti=
ce (cast it to
>> an int if you want to get rid of the notice) - however work as before.
>> =C2=A0* changes the warning on invalid indexes to say "Uninitialized or
>> invalid" rather than just "Uninitialized"
>> =C2=A0* fixes most of the related tests
>>
>
> I think that those changes are pretty much in line with the discussion th=
at
> we had.
> Thanks for fixing this!
>
>
> --
> Ferenc Kov=C3=A1cs
> @Tyr43l - http://tyrael.hu



--=20
Laruence =C2=A0Xinchen Hui
http://www.laruence.com/