#48597 [Opn]: Unclosed array keys break space escaping in $_GET/POST/REQUEST

ID: 48597 Updated by: jani@php.net Reported By: crmalibu at gmail dot com Status: Open Bug Type: *General Issues Operating System: * PHP Version: 5.*, 6CVS (2009-07-01) New Comment: See also bug #49683 Previous Comments: ------------------------------------------------------------------------ [2009-07-04 22:22:55] jani@php.net See also bug #48794 ------------------------------------------------------------------------ [2009-06-18 16:17:41] crmalibu at gmail dot com Description: ------------ I marked the version as 5.2.9 but it looks like the relevant code is the same for 5.3 and php 6 as well. I don't know c, so I struggle to read the source code, but I think I found something unexpected. In main/php_variables.c in php_register_variable_ex I think the parsing behaves inconsistent. After reading the comments in the source code, I would think a gpc variable name should not make it through which has ' ' or '.' or '[' character in the name. But I've found a way to do it. It seems the routine for recognizing and parsing the array syntax is at fault. In particular, characters after the first occurrence of a '[' char will be left alone because it thinks it needs to parse it as the special array syntax. But while it does later recognize that it's not proper array syntax, it doesn't properly convert the remaining character to underscore. I don't know if this is a bug, or if it's serious or what. But the source code comment about removing those chars due to not being binary safe made me think someone needs to look at this. Reproduce code: --------------- <form action=> <input name="goodvar .["> <input name="goodarray[foo]"> <input name="badvar[ . ["> <input type=submit> </form> <?php print_r($_GET); ?> Expected result: ---------------- Array ( [goodvar___] => [goodarray] => Array ( [foo] => ) [badvar_____] => ) Actual result: -------------- Array ( [goodvar___] => [goodarray] => Array ( [foo] => ) [badvar_ . [] => ) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=48597&edit=1