Bug #66119 [Com]: FPM full status produces invalid JSON with double quotes in query string

From: Date: Sat, 29 May 2021 11:22:51 +0000
Subject: Bug #66119 [Com]: FPM full status produces invalid JSON with double quotes in query string
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-234086@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=66119&edit=1

 ID:                 66119
 Comment by:         michiel at hazelhof dot nl
 Reported by:        andy at propcom dot co dot uk
 Summary:            FPM full status produces invalid JSON with double
                     quotes in query string
 Status:             Open
 Type:               Bug
 Package:            FPM related
 Operating System:   CentOS
 PHP Version:        5.4.22
 Block user comment: N
 Private report:     N

 New Comment:

Seems to be a duplicate of #64539


Previous Comments:
------------------------------------------------------------------------
[2013-11-19 16:51:36] andy at propcom dot co dot uk

Description:
------------
The query string of an FPM request is copied unescaped into the JSON output. If the query string
contains an unescaped double quote, this causes invalid JSON to be output.

The query string is correctly escaped when output as HTML or XML, this needs extending to JSON:

https://github.com/php/php-src/blob/PHP-5.4.22/sapi/fpm/fpm/fpm_status.c#L421

Test script:
---------------
Note that most browsers will urlencode double quotes automatically so CURL (or equivalent) should be
used to test.

curl 'http://localhost/sleep.php?test"foo'
&

curl 'http://localhost/fpmstatus.php?json&full'


Expected result:
----------------
..."request uri":"/sleep.php?test\"foo"...

Actual result:
--------------
..."request uri":"/sleep.php?test"foo"...


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=66119&edit=1

Thread (3 messages)

« previous php.bugs (#234086) next »