Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60917
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain googlemail.com designates 209.85.217.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEZPtU4tVeMy1h3phgabO1pYnRKfym12WgXkf3VBVYZGRumHog@mail.gmail.com>
References: <CAF+90c-T9hPbuS3bUxnHw-+B+Y2VLu55wQJ8UrtzrcC7TiKyVw@mail.gmail.com>
	<CAEZPtU4tVeMy1h3phgabO1pYnRKfym12WgXkf3VBVYZGRumHog@mail.gmail.com>
Date: Thu, 21 Jun 2012 11:21:07 +0200
Message-ID: <CAF+90c94c9kTie44fcugXp40E8aSiaizLzRgE2-fBJTm6C2-+Q@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] json_encode() behavior for incorrectly encoded strings
From: nikita.ppv@googlemail.com (Nikita Popov)

On Thu, Jun 21, 2012 at 8:47 AM, Pierre Joye <pierre.php@gmail.com> wrote:
>> The reason for this situation is that a patch was applied for all
>> branches, and then reverted, because Stas didn't consider the change
>> towards always throwing a warning (even with display_errors=on)
>> appropriate without further discussion.
>
> Well, not sure we have to discuss why such thing is bad.
> display_errors must be respected.
This kind of very ugly error handling is currently used in several
places. It is meant to protect server administrators that are running
production servers with display_errors=On from leaking information
about encoding issues (which could be valuable to attackers). So the
error is only thrown if it isn't shown to the client but logged
instead. Personally I really don't like this, but I agree with Stas
that this is a security relevant issue and shouldn't be simply changed
without further discussion.

> 5.3 should be brought in line with 5.4.
So you think that the corrected code should be backed out from PHP 5.3
and the incorrect 5.4/master behavior be restored?

Thanks,
Nikita