|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #36170 parse_ini_file control over constants' substitution
Submitted: 2006-01-26 18:01 UTC Modified: 2021-07-26 18:45 UTC
From: spam01 at pornel dot net Assigned: cmb (profile)
Status: Wont fix Package: Filesystem function related
PHP Version: 5.1.2 OS: *
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: spam01 at pornel dot net
New email:
PHP Version: OS:


 [2006-01-26 18:01 UTC] spam01 at pornel dot net
I don't agree with bug Bug #34949 being bogus. 

It was rejected stating it's programmers' responsibility to check if data can be trusted. However this function doesn't offer such possibility - there is no way to check what data has been substituted. Thus this function is not safe for reading untrusted files. 

It's not unusual to read and display data structure from untrusted source. You can do that with text files, XML, why not with ini?

Instead of originally sugested flag for disabling substitution I suggest adding optional callback function which could be used as security check/filter or provider of custom source of ini constants.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2015-01-09 00:06 UTC]
-Package: Feature/Change Request +Package: Filesystem function related
 [2021-07-26 18:45 UTC]
-Status: Open +Status: Wont fix -Assigned To: +Assigned To: cmb
 [2021-07-26 18:45 UTC]
parse_ini_file() supports the INI_SCANNER_RAW mode for a very long
time, and I deem that sufficient for the hopefully rare case where
you need to parse user supplied INI files.
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Jul 17 23:01:28 2024 UTC