cvs: php-src(PHP_5_2) / NEWS /ext/filter sanitizing_filters.c /ext/filter/tests 025.phpt 042.phpt 043.phpt /ext/standard string.c

iliaa Mon Dec 18 04:22:05 2006 UTC Added files: (Branch: PHP_5_2) /php-src/ext/filter/tests 042.phpt 043.phpt Modified files: /php-src/ext/filter sanitizing_filters.c /php-src/ext/filter/tests 025.phpt /php-src/ext/standard string.c /php-src NEWS Log: Filter fixes: Fixed possible double encoding problem with sanitizing filters Make use of space-strict strip_tags() function http://cvs.php.net/viewvc.cgi/php-src/ext/filter/sanitizing_filters.c?r1=1.11.2.5&r2=1.11.2.6&diff_format=u Index: php-src/ext/filter/sanitizing_filters.c diff -u php-src/ext/filter/sanitizing_filters.c:1.11.2.5 php-src/ext/filter/sanitizing_filters.c:1.11.2.6 --- php-src/ext/filter/sanitizing_filters.c:1.11.2.5 Tue Oct 3 11:42:23 2006 +++ php-src/ext/filter/sanitizing_filters.c Mon Dec 18 04:22:04 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: sanitizing_filters.c,v 1.11.2.5 2006/10/03 11:42:23 pajoye Exp $ */ +/* $Id: sanitizing_filters.c,v 1.11.2.6 2006/12/18 04:22:04 iliaa Exp $ */ #include "php_filter.h" #include "filter_private.h" @@ -27,52 +27,29 @@ /* }}} */ /* {{{ HELPER FUNCTIONS */ -static void php_filter_encode_html(zval *value, const char* chars, int encode_nul) +static void php_filter_encode_html(zval *value, const unsigned char *chars) { - register int x, y; smart_str str = {0}; int len = Z_STRLEN_P(value); - char *s = Z_STRVAL_P(value); + unsigned char *s = (unsigned char *)Z_STRVAL_P(value); + unsigned char *e = s + len; if (Z_STRLEN_P(value) == 0) { return; } - for (x = 0, y = 0; len--; x++, y++) { - if (strchr(chars, s[x]) || (encode_nul && s[x] == 0)) { + while (s < e) { + if (chars[*s]) { smart_str_appendl(&str, "&#", 2); - smart_str_append_long(&str, s[x]); + smart_str_append_unsigned(&str, (unsigned long)*s); smart_str_appendc(&str, ';'); } else { - smart_str_appendc(&str, s[x]); + /* XXX: this needs to be optimized to work with blocks of 'safe' chars */ + smart_str_appendc(&str, *s); } + s++; } - smart_str_0(&str); - efree(Z_STRVAL_P(value)); - Z_STRVAL_P(value) = str.c; - Z_STRLEN_P(value) = str.len; -} - -static void php_filter_encode_html_high_low(zval *value, long flags) -{ - register int x, y; - smart_str str = {0}; - int len = Z_STRLEN_P(value); - unsigned char *s = (unsigned char *)Z_STRVAL_P(value); - if (Z_STRLEN_P(value) == 0) { - return; - } - - for (x = 0, y = 0; len--; x++, y++) { - if (((flags & FILTER_FLAG_ENCODE_LOW) && (s[x] < 32)) || ((flags & FILTER_FLAG_ENCODE_HIGH) && (s[x] > 127))) { - smart_str_appendl(&str, "&#", 2); - smart_str_append_unsigned(&str, s[x]); - smart_str_appendc(&str, ';'); - } else { - smart_str_appendc(&str, s[x]); - } - } smart_str_0(&str); efree(Z_STRVAL_P(value)); Z_STRVAL_P(value) = str.c; @@ -181,9 +158,28 @@ void php_filter_string(PHP_INPUT_FILTER_PARAM_DECL) { size_t new_len; - + unsigned char enc[256] = {0}; + + /* strip high/strip low ( see flags )*/ + php_filter_strip(value, flags); + + if (!(flags & FILTER_FLAG_NO_ENCODE_QUOTES)) { + enc['\''] = enc['"'] = 1; + } + if (flags & FILTER_FLAG_ENCODE_AMP) { + enc['&'] = 1; + } + if (flags & FILTER_FLAG_ENCODE_LOW) { + memset(enc, 1, 32); + } + if (flags & FILTER_FLAG_ENCODE_HIGH) { + memset(enc + 127, 1, sizeof(enc) - 127); + } + + php_filter_encode_html(value, enc); + /* strip tags, implicitly also removes \0 chars */ - new_len = php_strip_tags(Z_STRVAL_P(value), Z_STRLEN_P(value), NULL, NULL, 0); + new_len = php_strip_tags(Z_STRVAL_P(value), Z_STRLEN_P(value), NULL, NULL, -1); Z_STRLEN_P(value) = new_len; if (new_len == 0) { @@ -191,21 +187,6 @@ ZVAL_EMPTY_STRING(value); return; } - - if (! (flags & FILTER_FLAG_NO_ENCODE_QUOTES)) { - /* encode ' and " to numerical entity */ - php_filter_encode_html(value, "'\"", 0); - } - /* strip high/strip low ( see flags )*/ - php_filter_strip(value, flags); - - /* encode low/encode high flags */ - php_filter_encode_html_high_low(value, flags); - - /* also all the flags - & encode as %xx */ - if (flags & FILTER_FLAG_ENCODE_AMP) { - php_filter_encode_html(value, "&", 0); - } } /* }}} */ @@ -222,11 +203,21 @@ /* {{{ php_filter_special_chars */ void php_filter_special_chars(PHP_INPUT_FILTER_PARAM_DECL) { + unsigned char enc[256] = {0}; + + php_filter_strip(value, flags); + /* encodes ' " < > & \0 to numerical entities */ - php_filter_encode_html(value, "'\"<>&", 1); + enc['\''] = enc['"'] = enc['<'] = enc['>'] = enc['&'] = enc[0] = 1; + /* if strip low is not set, then we encode them as &#xx; */ - php_filter_strip(value, flags); - php_filter_encode_html_high_low(value, FILTER_FLAG_ENCODE_LOW | flags); + memset(enc, 1, 32); + + if (flags & FILTER_FLAG_ENCODE_HIGH) { + memset(enc + 127, 1, sizeof(enc) - 127); + } + + php_filter_encode_html(value, enc); } /* }}} */ @@ -235,11 +226,21 @@ { /* Only if no flags are set (optimization) */ if (flags != 0 && Z_STRLEN_P(value) > 0) { + unsigned char enc[256] = {0}; + php_filter_strip(value, flags); + if (flags & FILTER_FLAG_ENCODE_AMP) { - php_filter_encode_html(value, "&", 0); + enc['&'] = 1; } - php_filter_encode_html_high_low(value, flags); + if (flags & FILTER_FLAG_ENCODE_LOW) { + memset(enc, 1, 32); + } + if (flags & FILTER_FLAG_ENCODE_HIGH) { + memset(enc + 127, 1, sizeof(enc) - 127); + } + + php_filter_encode_html(value, enc); } } /* }}} */ http://cvs.php.net/viewvc.cgi/php-src/ext/filter/tests/025.phpt?r1=1.4.2.1&r2=1.4.2.2&diff_format=u Index: php-src/ext/filter/tests/025.phpt diff -u php-src/ext/filter/tests/025.phpt:1.4.2.1 php-src/ext/filter/tests/025.phpt:1.4.2.2 --- php-src/ext/filter/tests/025.phpt:1.4.2.1 Tue Oct 3 02:16:52 2006 +++ php-src/ext/filter/tests/025.phpt Mon Dec 18 04:22:04 2006 @@ -17,7 +17,7 @@ string(0) "" string(0) "" string(12) "!@#$%^&*()'"" -string(32) "!@#$%^&#38;*()&#38;#39;&#38;#34;" +string(24) "!@#$%^&#38;*()&#39;&#34;" string(11) "`1234567890" string(5) "123" string(1) "." http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.31&r2=1.445.2.14.2.32&diff_format=u Index: php-src/ext/standard/string.c diff -u php-src/ext/standard/string.c:1.445.2.14.2.31 php-src/ext/standard/string.c:1.445.2.14.2.32 --- php-src/ext/standard/string.c:1.445.2.14.2.31 Wed Dec 13 15:39:12 2006 +++ php-src/ext/standard/string.c Mon Dec 18 04:22:04 2006 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: string.c,v 1.445.2.14.2.31 2006/12/13 15:39:12 iliaa Exp $ */ +/* $Id: string.c,v 1.445.2.14.2.32 2006/12/18 04:22:04 iliaa Exp $ */ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */ @@ -4143,7 +4143,7 @@ case '\0': break; case '<': - if (isspace(*(p + 1))) { + if (isspace(*(p + 1)) && allow_len >=- 0) { goto reg_char; } if (state == 0) { http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.433&r2=1.2027.2.547.2.434&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.547.2.433 php-src/NEWS:1.2027.2.547.2.434 --- php-src/NEWS:1.2027.2.547.2.433 Sun Dec 17 18:22:53 2006 +++ php-src/NEWS Mon Dec 18 04:22:05 2006 @@ -51,6 +51,8 @@ . Added "default" option that allows a default value to be set for an invalid or missing value. . Invalid filters fails instead of returning unsafe value + . Fixed possible double encoding problem with sanitizing filters + . Make use of space-strict strip_tags() function - Fixed FastCGI impersonation for persistent connections on Windows. (Dmitry) - Fixed wrong signature initialization in imagepng (Takeshi Abe) - Added optimization for imageline with horizontal and vertial lines (Pierre) http://cvs.php.net/viewvc.cgi/php-src/ext/filter/tests/042.phpt?view=markup&rev=1.1 Index: php-src/ext/filter/tests/042.phpt +++ php-src/ext/filter/tests/042.phpt http://cvs.php.net/viewvc.cgi/php-src/ext/filter/tests/043.phpt?view=markup&rev=1.1 Index: php-src/ext/filter/tests/043.phpt +++ php-src/ext/filter/tests/043.phpt