Bug #67296 [NEW]: filter_input doesn't validate variables set by nginx/php-fpm
From: fleshgrinder at gmx dot at
Operating system: Debian Wheezy
PHP version: 5.6.0beta3
Package: Filter related
Bug Type: Bug
Bug description:filter_input doesn't validate variables set by nginx/php-fpm
Description:
------------
I'm running nginx which communicates via FastCGI to php-fpm. The
filter_input() function doesn't validate any of the variables which are
sent via FastCGI within the global $_SERVER array.
Test script:
---------------
<?php
foreach ($_SERVER as $variable_name => $value) {
var_dump($value);
var_dump(filter_input(INPUT_SERVER, $variable_name,
FILTER_UNSAFE_RAW));
}
?>
Expected result:
----------------
The filter_input() function should validate the variable within the
$_SERVER array. I know that filter_input() can't be used if you set
something in your code but in my opinion it should accept the data that
was sent via FastCGI. Otherwise the function is pretty useless for non
Apache users.
Actual result:
--------------
Always returns NULL.
--
Edit bug report at https://bugs.php.net/bug.php?id=67296&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=67296&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=67296&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=67296&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=67296&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=67296&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=67296&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=67296&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=67296&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=67296&r=support
Expected behavior: https://bugs.php.net/fix.php?id=67296&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=67296&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=67296&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=67296&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=67296&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=67296&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=67296&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=67296&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=67296&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=67296&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=67296&r=mysqlcfg
Thread (4 messages)
- fleshgrinder at gmx dot at