php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #74066 Expanding list of functions that spread the tainted mark
Submitted: 2017-02-09 16:34 UTC Modified: 2021-09-27 15:57 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: craig at craigfrancis dot co dot uk Assigned:
Status: Closed Package: taint (PECL)
PHP Version: 7.0.15 OS:
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: craig at craigfrancis dot co dot uk
New email:
PHP Version: OS:

 

 [2017-02-09 16:34 UTC] craig at craigfrancis dot co dot uk
Description:
------------
I've only just stated using the extension, but I'd have thought that the following would have raised warnings.

Test script:
---------------
<?php

    $tainted = '1-Evil';
    taint($tainted);
    
    preg_match('/^1-(.*)/', $tainted, $matches);
    
    echo $matches[1] . "\n";
    echo str_ireplace('1-', '2-', $tainted) . "\n";
    echo preg_replace('/^1-/', '2-', $tainted) . "\n";

?>

Expected result:
----------------
Evil
2-Evil
2-Evil

Actual result:
--------------
<br />
<b>Warning</b>:  main() [echo]: Attempt to echo a string that might be tainted in <b>./index.php</b> on line <b>8</b><br />
1-Evil
<br />
<b>Warning</b>:  main() [echo]: Attempt to echo a string that might be tainted in <b>./index.php</b> on line <b>9</b><br />
2-Evil
<br />
<b>Warning</b>:  main() [echo]: Attempt to echo a string that might be tainted in <b>./index.php</b> on line <b>10</b><br />
2-Evil

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-02-09 16:50 UTC] craig at craigfrancis dot co dot uk
Correction... Expected result <> Actual result
 [2021-09-27 15:36 UTC] cmb@php.net
Consider to suggest this on GH:
<https://github.com/laruence/taint/issues>
 [2021-09-27 15:57 UTC] craig at craigfrancis dot co dot uk
-Status: Open +Status: Closed
 [2021-09-27 15:57 UTC] craig at craigfrancis dot co dot uk
I forgot about this ticket... now closed.

Anyone else who finds this, Taint checking is a bit flawed, and the only safe approach is to look for programmer defined strings:

https://wiki.php.net/rfc/is_literal
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Dec 26 23:01:28 2024 UTC