Doc #60985 [Opn->Ver]: filesystem functions null-byte safe now

Edit report at https://bugs.php.net/bug.php?id=60985&edit=1 ID: 60985 Updated by: cmb@php.net Reported by: tyrael@php.net Summary: filesystem functions null-byte safe now -Status: Open +Status: Verified Type: Documentation Problem Package: Filesystem function related Operating System: irrevelant PHP Version: Irrelevant Block user comment: N Private report: N New Comment: Yes, that include/require have been also fixed back then; they just don't report anything about an invalid path. Previous Comments: ------------------------------------------------------------------------ [2018-12-30 15:58:57] girgias@php.net Has it been completely fixed? There is a note saying this bug still exists with the include and require functions. https://php.net/manual/en/security.filesystem.nullbytes.php#116069 ------------------------------------------------------------------------ [2012-02-06 10:04:01] tyrael@php.net Description: ------------ https://bugs.php.net/bug.php?id=39863 got fixed so since php 5.3.4, the file system functions seems to be immune to the null byte poisioning. which means the the http://php.net/manual/en/security.filesystem.nullbytes.php page needs a little bit refactoring (or maybe a complete removal) as the example there isn't vulnerable anymore. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=60985&edit=1