Doc #71686 [Com]: parse_str() should have a warning about using it with untrusted data
Edit report at https://bugs.php.net/bug.php?id=71686&edit=1
ID: 71686
Comment by: bshafs at gmail dot com
Reported by: aaronw at catalyst dot net dot nz
Summary: parse_str() should have a warning about using it
with untrusted data
Status: Open
Type: Documentation Problem
Package: Documentation problem
PHP Version: 5.5.32
Block user comment: N
Private report: N
New Comment:
This is a good start. I would also love to have a way (in php.ini) to turn off the ability for this
function to write variables in the current scope, as this behavior makes the function insecure.
Previous Comments:
------------------------------------------------------------------------
[2016-02-29 01:41:13] aaronw at catalyst dot net dot nz
Description:
------------
The one-parameter version of parse_str() populates variables in the current scope, the same as
register_globals or extract(). So like those, if it's used with user-supplied data then it is
prone to bugs and security vulnerabilities where users can override global variables and other
uninitialized variables.
But unlike register_globals and extract(), there is no warning on the parse_str() manual page about
using it with untrusted/user-supplied data. Quite the opposite, there's a note telling you how
to use it with $_SERVER['QUERY_STRING'].
So it would be better for new developers if there were a big pink "Warning" note on the
page, much like the ones on the extract() page. It should advise users to instead use the
two-parameter version, which extracts the values into an array instead of into variables.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71686&edit=1
Thread (3 messages)