com php-src: Fix #76688: Disallow excessive parameters after options array: NEWS ext/session/session.c ext/session/tests/session_set_co
okie_params_variation7.phpt ext/standard/head.c e xt/standard/tests/network/setcookie_error.phpt

Commit: a16aee6cee77571e3af604117bdc48b75d8a3315 Author: Pedro Magalhães <mail@pmmaga.net> Wed, 1 Aug 2018 22:28:09 +0200 Committer: Christoph M. Becker <cmbecker69@gmx.de> Sun, 12 Aug 2018 15:49:13 +0200 Parents: 326d3d480c8187545f3e794c68c1fde09206fad9 Branches: PHP-7.3 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=a16aee6cee77571e3af604117bdc48b75d8a3315 Log: Fix #76688: Disallow excessive parameters after options array Bugs: https://bugs.php.net/76688 Changed paths: M NEWS M ext/session/session..c M ext/session/tests/session_set_cookie_params_variation7.phpt M ext/standard/head.c M ext/standard/tests/network/setcookie_error.phpt Diff: diff --git a/NEWS b/NEWS index d53d90e..23bea37 100644 --- a/NEWS +++ b/NEWS @@ -18,6 +18,8 @@ PHP NEWS (Kevin Abel) - Standard: + . Fixed bug #76688 (Disallow excessive parameters after options array). + (pmmaga) . Fixed bug #76713 (Segmentation fault caused by property corruption). (Laruence) diff --git a/ext/session/session.c b/ext/session/session.c index c7d54b0..c46af0d 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -1704,6 +1704,15 @@ static PHP_FUNCTION(session_set_cookie_params) zend_string *key; zval *value; + if (path) { + path = NULL; + domain = NULL; + secure_null = 1; + httponly_null = 1; + php_error_docref(NULL, E_WARNING, "Cannot pass arguments after the options array"); + RETURN_FALSE; + } + ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(lifetime_or_options), key, value) { if (key) { ZVAL_DEREF(value); diff --git a/ext/session/tests/session_set_cookie_params_variation7.phpt b/ext/session/tests/session_set_cookie_params_variation7.phpt index ebd9b71..9d1f870 100644 --- a/ext/session/tests/session_set_cookie_params_variation7.phpt +++ b/ext/session/tests/session_set_cookie_params_variation7.phpt @@ -36,6 +36,10 @@ var_dump(ini_get("session.cookie_lifetime")); var_dump(session_set_cookie_params(["lifetime" => 42])); var_dump(ini_get("session.cookie_lifetime")); +var_dump(ini_get("session..cookie_path")); +var_dump(session_set_cookie_params(["path" => "newpath/"], "arg after options array")); +var_dump(ini_get("session.cookie_path")); + echo "Done"; ob_end_flush(); ?> @@ -57,4 +61,9 @@ string(6) "please" string(1) "0" bool(true) string(2) "42" +string(1) "/" + +Warning: session_set_cookie_params(): Cannot pass arguments after the options array in %s +bool(false) +string(1) "/" Done diff --git a/ext/standard/head.c b/ext/standard/head.c index 5a9f09b..5e75384 100644 --- a/ext/standard/head.c +++ b/ext/standard/head.c @@ -211,6 +211,15 @@ static int php_head_parse_cookie_options_array(zval *options, zend_long *expires zend_string *key; zval *value; + if (*path) { + *path = NULL; + *domain = NULL; + *secure = 0; + *httponly = 0; + php_error_docref(NULL, E_WARNING, "Cannot pass arguments after the options array"); + return 0; + } + ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(options), key, value) { if (key) { ZVAL_DEREF(value); @@ -243,7 +252,6 @@ static int php_head_parse_cookie_options_array(zval *options, zend_long *expires /* Array is not empty but no valid keys were found */ if (found == 0 && zend_hash_num_elements(Z_ARRVAL_P(options)) > 0) { php_error_docref(NULL, E_WARNING, "No valid options were found in the given array"); - return 0; } return 1; diff --git a/ext/standard/tests/network/setcookie_error.phpt b/ext/standard/tests/network/setcookie_error.phpt index 1cbdf9e..d9241d3 100644 --- a/ext/standard/tests/network/setcookie_error.phpt +++ b/ext/standard/tests/network/setcookie_error.phpt @@ -10,9 +10,15 @@ ob_start(); // Unrecognized key and no valid keys setcookie('name', 'value', ['unknown_key' => 'only']); // Numeric key and no valid keys -setcookie('name', 'value', [0 => 'numeric_key']); +setcookie('name2', 'value2', [0 => 'numeric_key']); // Unrecognized key -setcookie('name', 'value', ['path' => '/path/', 'foo' => 'bar']); +setcookie('name3', 'value3', ['path' => '/path/', 'foo' => 'bar']); +// Arguments after options array (will not be set) +setcookie('name4', 'value4', [], "path", "domain.tld", true, true); + +var_dump(headers_list()); + +--EXPECTHEADERS-- --EXPECTF-- Warning: setcookie(): Unrecognized key 'unknown_key' found in the options array in %s @@ -24,3 +30,15 @@ Warning: setcookie(): Numeric key found in the options array in %s Warning: setcookie(): No valid options were found in the given array in %s Warning: setcookie(): Unrecognized key 'foo' found in the options array in %s + +Warning: setcookie(): Cannot pass arguments after the options array in %s +array(4) { + [0]=> + string(%d) "X-Powered-By: PHP/%s" + [1]=> + string(22) "Set-Cookie: name=value" + [2]=> + string(24) "Set-Cookie: name2=value2" + [3]=> + string(37) "Set-Cookie: name3=value3; path=/path/" +}