Bug #77074 [Opn]: XSS through error messages

Edit report at https://bugs.php.net/bug.php?id=77074&edit=1 ID: 77074 Updated by: requinix@php.net Reported by: david at grudl dot com Summary: XSS through error messages Status: Open Type: Bug Package: Output Control PHP Version: 7.1 Block user comment: N Private report: N New Comment: > why? I don't know. I'm not giving an explanation, just stating the current behavior. The change to give E_ERROR (E_PARSE was added later) special treatment dates back to 5.1.2. https://github.com/php/php-src/commit/2796160d15463a04acd7088fea379593d2c9caa0 Previous Comments: ------------------------------------------------------------------------ [2018-10-27 19:56:14] spam2 at rhsoft dot net > The escaping only happens for E_ERROR and E_PARSE why? also in cli-mode escape sequences should be filtered, we implemented a lot of sanitze stuff because we don't trust PHP in that context but different behavior depending on the error type is a no-go and explains some headache from the past ------------------------------------------------------------------------ [2018-10-27 19:31:53] david at grudl dot com Yes, html_errors is enabled. (Sorry for wrong description, autofilling in browser surprised me ;-) ------------------------------------------------------------------------ [2018-10-27 19:30:39] requinix@php.net The escaping only happens for E_ERROR and E_PARSE. https://github.com/php/php-src/blob/php-7.3.0RC4/main/main.c#L1336 ------------------------------------------------------------------------ [2018-10-27 19:20:46] nikic@php.net We're definitely applying htmlspecialchars to errors in html_errors mode. Can you please double check that it is really enabled (e.g. by printing the html_errors ini setting in the same script you are testing the error message)? ------------------------------------------------------------------------ [2018-10-27 19:08:57] david at grudl dot com Description: ------------ Displaying error messages is vulnerable to XSS, although the 'html_errors' is enabled. Solution is to convert especial charactes < & in error message (ie to use htmlspecialchars) Test script: --------------- <?php echo ${'<script>alert(123);</script>'}; Expected result: ---------------- In web browser it should not pop up the alert window, but it should report: "Notice: Undefined variable: <script>alert(123);</script> in test.php on line 3 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=77074&edit=1