Bug #54391 [Opn]: escapeshellarg strip non-ascii characters

Edit report at https://bugs.php.net/bug.php?id=54391&edit=1 ID: 54391 Updated by: bukka@php.net Reported by: c dot madmax at gmail dot com Summary: escapeshellarg strip non-ascii characters Status: Open Type: Bug Package: Program Execution Operating System: any PHP Version: any -Assigned To: +Assigned To: bukka Block user comment: N Private report: N New Comment: I did a bit of digging and this was introduced in https://github.com/php/php-src/commit/9227974ddb44f367b2ed7b0885f3b39169597ca7 with follow up refining in https://github.com/php/php-src/commit/74b5cfdea54ccddf2db7daa2e6c83a26f06e1950 . I'm a bit worried about security impact if disabled it as suddenly allowing incomplete multibyte characters could lead to some security issues in some cases. What we could maybe do is to look into some reasonable locale defaults if there is none as stripping characters is not nice but it needs some considering if this would be safe. We should for sure improve the docs. Previous Comments: ------------------------------------------------------------------------ [2017-02-07 11:06:17] netvicious at gmail dot com This bug seems to be on the limbo so much time. I get here looking for a solution but it only guided me to found my solution. For me it worked with a setlocale(LC_ALL, 'es_ES@euro'), it didn't worked with setlocale(LC_ALL, 'es_ES@iso-8859-1') and others but I think it should be a problem with the locales on the linux configuration. Run a locale-gen in your machine and look which locales do you have installed on your machine, and use one of they. ------------------------------------------------------------------------ [2015-02-03 07:01:59] yohgaki@php.net Duplicate. https://bugs.php.net/bug.php?id=45132 Keep this bug open. ------------------------------------------------------------------------ [2013-02-03 23:54:21] me at paulofreitas dot me Test script: --------------- <?php $filename = 'résumé.pdf'; var_dump(escapeshellarg($filename)); setlocale(LC_CTYPE, 'en_US.utf8'); var_dump(escapeshellarg($filename)); ?> Test result when executed from CLI: --------------- string(14) "'résumé.pdf'" string(14) "'résumé.pdf'" Test result when executed from Apache: --------------- // Executed from Apache string(10) "'rsum.pdf'" string(14) "'résumé.pdf'" Which locale to use? Will it works cross-platform? Yeah, that's a very annoying unexpected behavior. ------------------------------------------------------------------------ [2011-03-26 15:35:48] c dot madmax at gmail dot com This is a different bug! Bug 44945 is related to utf-8 strings, and the bug is fixed. escapeshellarg() don't remve valid utf-8 characters. But escapeshellarg() remove ISO-8959-1 characters! ------------------------------------------------------------------------ [2011-03-26 15:18:54] felipe@php.net Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=54391 -- Edit this bug report at https://bugs.php.net/bug.php?id=54391&edit=1