Bug #69250 [NEW]: PHP FPM status report produces invalid JSON and XML

From: s dot greiner at cadenas dot de Operating system: any PHP version: 5.5.22 Package: FPM related Bug Type: Bug Bug description:PHP FPM status report produces invalid JSON and XML Description: ------------ Open the Status Page of FPM, for example: http://my.server.ip/status-php-fpm?json&full&testparam=\a\b\c Take the "json" output of it and validate it -> it will fail because any backslash is not escaped in the "request uri" property. According to http://json.org/string.gif every unicode character is allowed in a string but no " or \ or a control character. They have to be escaped. The same problem may occur with the "script" property. Regarding XML output: the text nodes of <request-uri> and <script> should be wrapped in CDATA sections. This erroneous behavior applies to every request not only the ones to the status page, for example a request to http://my.server.ip/mywebsite/something?path=foo\bar will make the status page to produce invalid output. Expected result: ---------------- "processes":[ { "pid":2432, "state":"Idle", "start time":1425579888, "start since":1039595, "requests":1523, "request duration":614, "request method":"GET", "request uri":"/php-status?json&full&testparam=\\a\\b\\c", "content length":0, "user":"-", "script":"-", "last request cpu":0.00, "last request memory":262144 }, ... Actual result: -------------- "processes":[ { "pid":2432, "state":"Idle", "start time":1425579888, "start since":1039595, "requests":1523, "request duration":614, "request method":"GET", "request uri":"/php-status?json&full&testparam=\a\b\c", "content length":0, "user":"-", "script":"-", "last request cpu":0.00, "last request memory":262144 }, ... -- Edit bug report at https://bugs.php.net/bug.php?id=69250&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69250&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69250&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69250&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69250&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69250&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69250&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69250&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69250&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69250&r=support Expected behavior: https://bugs.php.net/fix.php?id=69250&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69250&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69250&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69250&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69250&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69250&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69250&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69250&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69250&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69250&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69250&r=mysqlcfg