Edit report at https://bugs.php.net/bug.php?id=61700&edit=1
ID: 61700
Comment by: eric at ericstern dot com
Reported by: nanocaiordo at gmail dot com
Summary: FILTER_FLAG_IPV6, FILTER_FLAG_NO_PRIV_RANGE,
FILTER_FLAG_NO_RES_RANGE failing
Status: Open
Type: Bug
Package: Filter related
PHP Version: 5.3.10
Block user comment: N
Private report: N
New Comment:
Any chance we can look into this further? It's been open and verified for over six years (I
encountered it on 7.2.8), and has the potential to lead to security issues if code is relying on the
accuracy of this filter to e.g. prevent malicious redirects to localhost. There are a _lot_ of ways
to write an IPv6 address that equates to ::1, and this filter only appears to catch one of them.
Previous Comments:
------------------------------------------------------------------------
[2014-04-12 12:41:34] klunejko at gmail dot com
FILTER_FLAG_NO_RES_RANGE also has some false positives, it sees 128.0.96.0/21 as a reserved, when
it's not. This is happening in PHP 5.5
------------------------------------------------------------------------
[2013-03-11 18:25:21] bugreport at zippymail dot info
Hellon
The problem is still present, even on newer version.
Can you fix please ?
Thanks.
------------------------------------------------------------------------
[2012-05-18 10:25:54] bramklg at gmail dot com
The FILTER_FLAG_NO_RES_RANGE flag only works in a couple of cases (verified
against ext\filter\logical_filters.c from the php 5.3 snapshot of 2012-05-18).
Its missing almost all of the ranges described in
http://en.wikipedia.org/wiki/Reserved_IP_addresses
and
http://tools.ietf.org/html/rfc5156.
This is also discussed in the following bugreport: https://bugs.php.net/bug.php?
id=47435 but nothing is done with it?
------------------------------------------------------------------------
[2012-04-12 13:14:11] nanocaiordo at gmail dot com
Description:
------------
FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE failing in some circumstances
Test script:
---------------
var_dump(filter_var('::ffff:192.168.1.1', FILTER_VALIDATE_IP, FILTER_FLAG_IPV4));
var_dump(filter_var('::ffff:192.168.1.1', FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE));
var_dump(filter_var('0:0:0:0:0:0:0:1', FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE));
Expected result:
----------------
bool(true) ?
bool(false)
bool(false) as ::1 does?
Actual result:
--------------
bool(false)
string(18) "::ffff:192.168.1.1"
string(15) "0:0:0:0:0:0:0:1"
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=61700&edit=1