# [PATCH] Bug#42718 (FILTER_UNSAFE_RAW not applied when configured as default filter, even with flags)

- Thread: https://externals.io/message/32496
- Original archive: https://news-web.php.net/php.internals/32496
- Started by Arnaud.lb on 2007-09-29T14:54:26+00:00
- Messages: 2
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #32496 — Arnaud.lb — 2007-09-29T14:54:26+00:00

URL: https://externals.io/message/32496#32496

Hi,

Here is a patch to fix bug #42718:

http://bugs.php.net/?id=42718&edit=1

The "unsafe_raw" filter is not applied when configured as default 
filter.

I found that the php_sapi_filter() internal function in 
ext/filter/filter.c intentionally bypass this filter:

if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW)){
 (apply default filter)
} else [...]

The unsafe_raw filter does nothing by default, but it 
can "optionally strip or encode special characters", and it is the 
only filter which is able to do that without doing any other 
filtering.

I suggest to not bypass the unsafe_raw filter when default_filter_flags is 
different than 0 (bug42718.patch attached).

I also wrote a testcase for this bug: bug42718.phpt.

And an other testcase (052.phpt) to check if the patch does not modify the 
behavior of the php_sapi_filter() function:

- Apply filter, only if filter will do something (unsafe_raw with no 
flags do nothing)
- Else, fallback to magic_quotes_gpc if enabled

Regards

---

## #32503 — Pierre — 2007-09-29T20:16:03+00:00

URL: https://externals.io/message/32496#32503 · In reply to: #32496

Hi Arnaud,

I replied in the bug report, please check it again :)

Thanks for your feedbacks,
--Pierre


> Hi,
>
> Here is a patch to fix bug #42718:
>
> http://bugs.php.net/?id=42718&edit=1
>
> The "unsafe_raw" filter is not applied when configured as default
> filter.
>
> I found that the php_sapi_filter() internal function in
> ext/filter/filter.c intentionally bypass this filter:
>
> if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW)){
>  (apply default filter)
> } else [...]
>
> The unsafe_raw filter does nothing by default, but it
> can "optionally strip or encode special characters", and it is the
> only filter which is able to do that without doing any other
> filtering.
>
> I suggest to not bypass the unsafe_raw filter when default_filter_flags is
> different than 0 (bug42718.patch attached).
>
> I also wrote a testcase for this bug: bug42718.phpt.
>
> And an other testcase (052.phpt) to check if the patch does not modify the
> behavior of the php_sapi_filter() function:
>
> - Apply filter, only if filter will do something (unsafe_raw with no
> flags do nothing)
> - Else, fallback to magic_quotes_gpc if enabled
>
> Regards
>
> --TEST--
> Bug #42718 (unsafe_raw filter not applied when configured as default filter)
> --SKIPIF--
> <?php if (!extension_loaded("filter")) die("skip"); ?>
> --INI--
> magic_quotes_gpc=0
> filter.default=unsafe_raw
> filter.default_flags=4
> --GET--
> a=1%00
> --FILE--
> <?php
> echo ini_get('filter.default') . "\n";
> echo ini_get('filter.default_flags') . "\n";
> echo addcslashes($_GET['a'],"\0") . "\n";
> ?>
> --EXPECT--
> unsafe_raw
> 4
> 1
>
> --TEST--
> fallback to magic_quotes when no filter is to be applied
> --SKIPIF--
> <?php if (!extension_loaded("filter")) die("skip"); ?>
> --INI--
> magic_quotes_gpc=1
> filter.default=unsafe_raw
> filter.default_flags=
> --GET--
> a=1%00
> --FILE--
> <?php
> echo ini_get('filter.default') . "\n";
> echo ini_get('filter.default_flags') . "\n";
> echo addcslashes($_GET['a'],"\0") . "\n";
> ?>
> --EXPECT--
> unsafe_raw
>
> 1\0