Skip to content

Make (DOM)XPath::quote only accept strings without NULL bytes #13960

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 14, 2024

Conversation

nielsdos
Copy link
Member

The reason is that libxml will cut off on a NULL byte, and so strings containing NULL bytes may not be necessarily safe even when coming out of quoting.

The reason is that libxml will cut off on a NULL byte, and so strings
containing NULL bytes may not be necessarily safe even when coming out
of quoting.
@divinity76
Copy link
Contributor

divinity76 commented Apr 14, 2024

dang you're right,

$ cat puck.php 
<?php
declare(strict_types=1);
$domd = new DOMDocument();
@$domd->loadHTML("<foo>tes\x00t</foo>");
$xp = new DOMXPath($domd);
var_dump(
    $xp->query("//foo[contains(text(), " . $xp->quote("tes\x00t") . ")]")
);
$ php puck.php 

Warning: DOMXPath::query(): Unfinished literal in /home/hans/projects/misc/puck.php on line 7
bool(false)

can you add a test in /ext/dom/tests/DOMXPath_quote.phpt ?

regardless, LGTM.

@nielsdos
Copy link
Member Author

@divinity76 Added it as a test and added you as co-author for that. Thanks.
As a side note, normally we don't add ZPP tests, but given the potential sensitive use of the function I think asserting the behaviour via a test is fine.

Co-authored-by: divinity76 <[email protected]>
@nielsdos nielsdos merged commit a136117 into php:master Apr 14, 2024
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants