Bug #54391 [Opn]: escapeshellarg strip non-ascii characters

From: Date: Sat, 26 Mar 2011 14:18:43 +0000
Subject: Bug #54391 [Opn]: escapeshellarg strip non-ascii characters
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-159794@lists.php.net to get a copy of this message 
Edit report at http://bugs.php.net/bug.php?id=54391&edit=1

 ID:                 54391
 Updated by:         felipe@php.net
 Reported by:        c dot madmax at gmail dot com
 Summary:            escapeshellarg strip non-ascii characters
 Status:             Open
 Type:               Bug
 Package:            Program Execution
 Operating System:   All Debian and Ubuntu Versions
 PHP Version:        5.3.6
 Block user comment: N
 Private report:     N

 New Comment:

See bug #44945


Previous Comments:
------------------------------------------------------------------------
[2011-03-26 15:12:53] c dot madmax at gmail dot com

Description:
------------
escapeshellarg() strip non-ascii characters if the LANG environment
variable is not set to somthing like LANG=*.ISO-8959-1 e.g.
LANG=en_US.ISO-8959-1

The job of escapeshellarg() is only to escape characters and NOT to
remove them!!! The manual say nothing about removing characters!!!

Removing characters can cause horrible results!!!

It should doesn't matter if a shell arg has a ISO-8959-1 charset or
UTF-8 charset or any other charset, because it is possible that a
filename has a ISO-8959-1 charset and a other filename has a UTF-8
charset!!!

escapeshellarg() should only look for quotes and escape them, and
nothing else!!!

PS:
setlocale(LC_ALL, 'en_US.ISO-8959-1') and/or
putenv('LANG=en_US.ISO-8959-1') dosn't fix this problem! And i think
even if this work it's not good a solution!

Test script:
---------------
<?php

$path = escapeshellarg('/home/www-data/äöüÄÖÜß'); // ISO-8959-1
characters =  "\xE4\xF6\xFC\xC4\xD6\xDC\xDF" in hex format

shell_exec(sprintf('rm -fr %s', $path));

echo sprintf('%s removed', $path);

?>

Expected result:
----------------
The test script should remove the folder /home/www-data/äöüÄÖÜß
and output:

'/home/www-data/äöüÄÖÜß' removed

Actual result:
--------------
The test script remove the folder /home/www-data/ and output

'/home/www-data/' removed


------------------------------------------------------------------------



-- 
Edit this bug report at http://bugs.php.net/bug.php?id=54391&edit=1

Thread (9 messages)

« previous php.bugs (#159794) next »