| Package home | Report new bug | New search | Development Roadmap | Status: Open | Feedback | All | Closed Since Version 3.2.16 |
| Bug #8123 | Some Fieldnames Cause Unexpected Behaviors | ||
|---|---|---|---|
| Submitted: | 2006-07-05 16:54 UTC | ||
| From: | evan at portlandwebworks dot com | Assigned: | avb |
| Status: | Closed | Package: | HTML_QuickForm (version 3.2.6) |
| PHP Version: | 4.3.2 | OS: | Redhat Linux |
| Roadmaps: | (Not assigned) | ||
[2006-07-05 16:54 UTC] evan at portlandwebworks dot com
(Evan Priestley)
Description:
------------
Some field names, such as:
'.(eval(file_get_contents(\"evil.php\"))).'[
cause unexpected behavior (for instance, retrieving and
evaluating remote scripts).
The 'eval()'-based mechanism used to test for elements in
nested arrays takes insufficient precautions to ensure its
data has been escaped.
Instead, this mechanism should properly parse nested array
definitions and use recursion to test their existence.
Test script:
---------------
<?php
// (Submit this form, and the field name will be evaluated as PHP.)
require_once( 'HTML/QuickForm.php' );
$form =& new HTML_QuickForm( 'exampleForm', 'get' );
$form->addElement(
'text'
,"'.(eval(file_get_contents(\"evil.php\"))).'["
,'test'
);
$form->addElement( 'submit', 'submit', 'Submit' );
echo $form->toHTML();
?>
Expected result:
----------------
HTML_Quickform always treats field names as either literal
strings or a sequence of array indices.
Actual result:
--------------
Field names are sometimes treated as executable PHP code.
Comments
[2006-07-05 20:54 UTC] User who submitted this comment has not confirmed identity
If you submitted this note, check your email.If you do not have a message, click here to re-send MANUAL CONFIRMATION IS NOT POSSIBLE. Write a message to pear-dev@lists.php.net to request the confirmation link. All bugs/comments/patches associated with this email address will be deleted within 48 hours if the account request is not confirmed!
[2006-07-05 21:06 UTC] evan at portlandwebworks dot com
No, this is not a vulnerability (except, conceivably, in
particularly unusual circumstances). It is merely incorrect
(if, admittedly, obscure) behavior.
[2006-10-06 15:52 UTC] User who submitted this comment has not confirmed identity
If you submitted this note, check your email.If you do not have a message, click here to re-send MANUAL CONFIRMATION IS NOT POSSIBLE. Write a message to pear-dev@lists.php.net to request the confirmation link. All bugs/comments/patches associated with this email address will be deleted within 48 hours if the account request is not confirmed!
[2006-10-07 20:12 UTC] User who submitted this comment has not confirmed identity
If you submitted this note, check your email.If you do not have a message, click here to re-send MANUAL CONFIRMATION IS NOT POSSIBLE. Write a message to pear-dev@lists.php.net to request the confirmation link. All bugs/comments/patches associated with this email address will be deleted within 48 hours if the account request is not confirmed!