|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2007-09-20 16:54 UTC] arnaud dot lb at gmail dot com
Description:
------------
The "unsafe_raw" filter is not applied when configured as default
filter.
I found that the php_sapi_filter() internal function in
ext/filter/filter.c intentionally bypass this filter:
if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW)){
(apply default filter)
} else [...]
The unsafe_raw filter does nothing by default, but it
can "optionally strip or encode special characters", and it is the
only filter which is able to do that without doing any other
filtering.
Reproduce code:
---------------
- Prints filter.default and filter.default_flags values,
- Check if $_GET['a'] contains a null byte (null bytes may be filtered by FILTER_UNSAFE_RAW with the FILTER_FLAG_STRIP_LOW flag
- Check if $_GET['a'] though filter_input() with the same filter/flags contains a null byte.
<?php
echo "filter.default = " . ini_get('filter.default') . " <br />\n";
echo "filter.default_flags = " . ini_get('filter.default_flags') . " <br />\n";
echo "<br />";
echo "\$_GET['a'] contains \\0: " . (strpos($_GET['a'], "\0") !== false ? 'Yes' : 'No') . " <br />\n";
echo "<br />";
echo "\$_GET['a'] throught filter_var() contains \\0: " . (strpos(filter_var($_GET['a'], FILTER_UNSAFE_RAW, FILTER_FLAG_STRIP_LOW), "\0") !== false ? 'Yes' : 'No') . "<br />";
echo "<br />";
?>
Expected result:
----------------
filter.default: unsafe_raw
filter.default_flags: 4
$_GET['a'] contains \0: No
$_GET['a'] through filter_var() contains \0: No
Actual result:
--------------
filter.default: unsafe_raw
filter.default_flags: 4
$_GET['a'] contains \0: Yes
$_GET['a'] through filter_var() contains \0: No
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sun Oct 26 10:00:01 2025 UTC |
Thanks for your reply. I'm trying to strip low ascii characters from GET/POST/COOKIE using the filter extension, and the only way to do that is to use the unsafe_raw filter with the FILTER_FLAG_STRIP_LOW flag. The string filter can do that with the FILTER_FLAG_STRIP_LOW flag, but it strips HTML tags too, and I don't want to strip HTML tags. From the documentation, about the unsafe_raw filter: "Do nothing, optionally strip or encode special characters." It works as expected using filter_var() for example: filter_var("a <b> \000 c", FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW) => "a c" (the null char was striped, but the <b> tag too) filter_var("a <b> \000 c", FILTER_UNSAFE_RAW, FILTER_FLAG_STRIP_LOW) => "a <b> c" (only the null char was striped) But it does not work as a default filter. The bug42718.phpt testcase demonstrates that. According to the documentation, I think that the unsafe_raw filter may not be bypassed when default_flags are != 0. This is the only change my patch do: - if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW)) { + if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW) || IF_G(default_filter_flags) != 0) {