Bug #75663 [Opn->Nab]: file_get_contents() fatal error by php:// wrapper

Edit report at https://bugs.php.net/bug.php?id=75663&edit=1 ID: 75663 Updated by: requinix@php.net Reported by: debukuk154 at gmail dot com Summary: file_get_contents() fatal error by php:// wrapper -Status: Open +Status: Not a bug Type: Bug Package: Filesystem function related Operating System: Ubuntu PHP Version: 7.0.26 Block user comment: N Private report: N New Comment: And what do you expect PHP to do about it? You are the one who wrote incorrect and unsafe code. Don't do that. Previous Comments: ------------------------------------------------------------------------ [2017-12-10 16:44:44] debukuk154 at gmail dot com Description: ------------ Test script: When you trying to input like php:// wrapper, You can see it will error by php://filter/. I don't know why it's occur an error. so i just report this bug now. if it's input by user (i mean, file_get_contents() function), it can be connection by security vulnerability. in case, user are trying input to php://filter/ like that, the user are can make exploit to vuln maliciously. Test script: --------------- auth.php: <?php session_start(); // start session $_SESSION['auth'] = true; // set auth variable to true value file_get_contents("php://filter/"); // file_get_contents is have php://filter/ $_SESSION['auth'] = false; // set auth variable to false value ?> ---------------------------------------- auth_check.php: <?php session_start(); // start session echo $_SESSION['auth']; // print auth variable ?> Expected result: ---------------- It will stop by force. because file_get_contents("php://filter/") are occur an error. Actual result: -------------- This is occur an error and it can be break the code. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75663&edit=1