Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:67917
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.52 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAL+t6cGUJmfhVdSCf3XNn4Mri_fvq-Fuad40yrrKOd8c1uwxXw@mail.gmail.com>
References: <CAGa2bXYNgjhUWTqzhorcYhd7SEyEvxdhCVWyXr8O-hsZ103E6g@mail.gmail.com>
 <CAGa2bXYBR-=rrifyhWSwB7M1u5J5EL_0o0DcUuFZ9DEuMCrjjQ@mail.gmail.com> <CAL+t6cGUJmfhVdSCf3XNn4Mri_fvq-Fuad40yrrKOd8c1uwxXw@mail.gmail.com>
Date: Thu, 27 Jun 2013 12:05:09 +0900
Message-ID: <CAGa2bXb=mRv2PY880THX_Zd6V8p6pMEWe_+KJ0e1WsKCHskDYA@mail.gmail.com>
To: Sherif Ramadan <theanomaly.is@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=e89a8f8388cf1a1d0504e01a0adf
Subject: Re: [PHP-DEV] Re: hex2bin: E_WARNING is too much for odd string?
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--e89a8f8388cf1a1d0504e01a0adf
Content-Type: text/plain; charset=ISO-8859-1

Hi Sherif,

I would like to have consistent behavior at least within a function.

2013/6/27 Sherif Ramadan <theanomaly.is@gmail.com>

> I thought you wanted to add an extra error for malformed hex, which I
> would have been fine with, but removing the error entirely? The error is
> useful. It informs the user that they may have buggy code since the
> function is clearly documented to expect even length hex encoded strings.


It is good to have additional errors for invalid inputs. It would be
beneficial for many users.
I've checked some conversion(decoder) functions quickly.

Functions raise E_WARNING / E_NOTICE for invalid inputs
  unserialize()
  convert_uudecode()
  xmlreader module

Functions simply return FALSE for invalid inputs
  base64_decode()
  pg_unescape_bytea()
  mb_decode_mimiheader()
  mb_decode_numericentity()
  mb_convert_kana()
  mb_convert_encoding()
  mb_convert_variables()
    Note: mbstring functions raise errors for invalid encoding, otherwise
simply return FALSE.

Functions do not check validity
  quoted_printable_decode()
  xml_utf8_decode() - replaces bad chars to '?'

Functions have separate error message function
  json_decode() - returns FALSE, but can get errors via json_last_error()

Decoding errors are usually a bug or some kind of attack, so I agree to add
E_NOTICEs. Exception is decoders that supposed to accept external inputs.
e.g. base64_decode() and mbstring functions.

I think pg_unescape_bytea() should raise E_WARNING, so I'll add it later.
Adding E_WARNING to it will never be BC issue. It's obvious bug.

hex2bin() will not be used for handling external inputs almost always, so
raising E_WARNING make sense.

I've updated pull request. (Added E_WARNING for bad hex)

https://github.com/php/php-src/pull/369

Everyone is OK with this?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--e89a8f8388cf1a1d0504e01a0adf--