Re: Major Security Issue: Code in bug report even kills the bug reporting page

Directly from the manual at http://www.php.net/manual/en/language.basic-syntax.comments.php "The one-line comment styles actually only comment to the end of the line or the current block of PHP code, whichever comes first. This means that HTML code after // ?> WILL be printed: ?> skips out of the PHP mode and returns to HTML mode, and // cannot influence that." On Thu, 26 Jun 2003, Beren Walters wrote: > Webmasters, > > I really must draw your attention to what appears to be a major flaw in > PHP. > > The issue seems so prevalent that it even causes your bug reporting page > to abort PHP parsing and very nicely print the PHP source for your page > to my browser. I would call this a major security flaw. > > Following is the content of my attempted bug report. > > =================================================================== > > beren@datacodex.net > > 4.3.1 > > Scripting Engine parsing > > Redhat 7.3 - kernel 4.18-3 > > Short tags in comments stop execution. > > Password: fingle > > Description: > ============ > PHP short tags enabled in .ini > > Standard rpm, self-compiled - all work the same. > > PHP short tags in a string literal are fine until they are commented > out. > > Once commented the scripting engine seems to no longer recognise the > string literal quotes, but does parse the PHP short close tag. > > Surely it should not be honouring PHP open/close tags in comments?? If > it should honour such tags, should it not then also honour the string > delimiters?? > > I am aware that the short tags are not "XML compatible" but this is an > example only. > > Code: > ===== > <? > > $xmlstring = '<?xml version="1.0" encoding="UTF-8"?>'; > echo $xmlstring; > > // $xmlstring = '<?xml version="1.0" encoding="UTF-8"?>'; > // echo $xmlstring; > > ?> > > Expected Result: > ================ > <?xml version="1.0" encoding="UTF-8"?> > > > Actual Result: > ============== > <?xml version="1.0" encoding="UTF-8"?>'; > // echo $xmlstring; > > ?> > > > =================================================================== > > Please don't hesitate to contact me if you would like any further > information. > > Cheers, > Beren Walters > Datacodex. > +61 7 3844 9199 >