#42744 [NEW]: __autoload description does not state the class name can be any string

From: pstradomski at gmail dot com Operating system: PHP version: Irrelevant PHP Bug Type: Documentation problem Bug description: __autoload description does not state the class name can be any string Description: ------------ When a class is required because of a callback through call_user_func etc. no validation on the class name is performed. This can lead to a problem when the name is specially crafted. One could expect the code below to be quite safe - it checks for class existence and tests if the class is a subclass of expected base class - but nevertheless it leads to information leak. The documentation should state that the parameter of __autoload does not neccessarily conform to the grammar of the class name. Reproduce code: --------------- <?php /** * This is quite basic autoload function, similar to the one in documentation * at http://www.php.net/manual/en/language.oop5.autoload.php * * There is no mention there that it is possible for dangerous characters to * appear in the $class_name so it has to be handled with care. */ function __autoload($class_name) { echo "Autoloading $class_name\n"; if (file_exists("classes/$class_name.php")) { require_once "classes/$class_name.php"; } else { die("Autoloading $class_name failed\n"); } } // somewhere in main program $className = "../../../../../../../etc/passwd\0" . 'Controller'; $class = new ReflectionClass($className); if ($class->isSubclassOf('Controller')) { call_user_func(array($className, 'handleRequest')); } ?> -- Edit bug report at http://bugs.php.net/?id=42744&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=42744&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=42744&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=42744&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=42744&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=42744&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=42744&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=42744&r=needscript Try newer version: http://bugs.php.net/fix.php?id=42744&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=42744&r=support Expected behavior: http://bugs.php.net/fix.php?id=42744&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=42744&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=42744&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=42744&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=42744&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=42744&r=dst IIS Stability: http://bugs.php.net/fix.php?id=42744&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=42744&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=42744&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=42744&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=42744&r=mysqlcfg