[php-src] Issue #11464: FPM: Consider escaping script in status
| From: | bukka | Date: | Fri, 16 Jun 2023 17:57:57 +0000 |
| Subject: | [php-src] Issue #11464: FPM: Consider escaping script in status | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-244712@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/11464
Author: bukka
### Description
Currently the
script field in status is not escaped for neither JSON, HTML nor XML. It
should be investigated if any of the characters requiring escape can get to the script filename.
This is very unlikely issue in practice but potentially theoretical possible so it might be a good
idea to address it.
The thing to try would be to have a script whose path needs to be escaped. The server might be able
to access with URL escape that is eventually transformed to the path with a character requiring an
escape. This needs some testing if it's even possible.
### PHP Version
Any with FPM
### Operating System
Linux