Fix GH-16523: FILTER_FLAG_HOSTNAME accepts ending hyphen

Domain name labels must not end with a hyphen, and that is also true
for the last label. Apparently, this has been overlooked so

Fix GH-16523: FILTER_FLAG_HOSTNAME accepts ending hyphen

Domain name labels must not end with a hyphen, and that is also true
for the last label. Apparently, this has been overlooked so far.

Closes GH-16540.

show more ...

Fix GHSA-w8qr-v226-r27w

We should not early-out with success status if we found an ipv6
hostname, we should keep checking the rest of the conditions.
Because integrating the if-check

Fix GHSA-w8qr-v226-r27w

We should not early-out with success status if we found an ipv6
hostname, we should keep checking the rest of the conditions.
Because integrating the if-check of the ipv6 hostname in the
"Validate domain" if-check made the code hard to read, I extracted the
condition out to a separate function. This also required to make
a few pointers const in order to have some clean code.

show more ...

Add FILTER_FLAG_GLOBAL_RANGE to filter Global IPs as per RFC 6890

Don't try to access memory outside string

Fix signedness confusion in php_filter_validate_domain()

As is, there is the possibility that integer underflow occurs, making
`_php_filter_validate_domain()` succeed for very long domai

Fix signedness confusion in php_filter_validate_domain()

As is, there is the possibility that integer underflow occurs, making
`_php_filter_validate_domain()` succeed for very long domain names.

Cf. <https://pwning.systems/posts/php_filter_var_shenanigans/>.

show more ...

Fix #81708: UAF due to php_filter_float() failing for ints

We must only release the zval, if we actually assign a new zval.

Fix #81708: UAF due to php_filter_float() failing for ints

We must only release the zval, if we actually assign a new zval.

Fix FILTER_FLAG_NO_RES_RANGE flag

`2001:10::/28` is a reserved IPv6 range. But there's a typo in GH-7476,
which caused IPv6 address like `240b:0010::1` will be filtered by the
flag `

Fix FILTER_FLAG_NO_RES_RANGE flag

`2001:10::/28` is a reserved IPv6 range. But there's a typo in GH-7476,
which caused IPv6 address like `240b:0010::1` will be filtered by the
flag `FILTER_FLAG_NO_RES_RANGE`.

http://www.faqs.org/rfcs/rfc6890.html

Closes GH-7790.

show more ...

Fix #61700: FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing

It makes no sense to compare IPv6 address ranges as strings; there are
too many different representation possibilities.

Fix #61700: FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing

It makes no sense to compare IPv6 address ranges as strings; there are
too many different representation possibilities. Instead, we change
`_php_filter_validate_ipv6()` so that it can calculate the IP address
as integer array. We do not rely on `inet_pton()` which may not be
available everywhere, at least IPv6 support may not, but rather parse
the IP address manually. Finally, we compare the integers.

Note that this patch does not fix what we consider as reserved and
private, respectively, but merely tries to keep what we had so far.

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>

Closes GH-7476.

show more ...

Fixed some spaces used instead of tabs

Fix warning

(cherry picked from commit 190013787bbc424c240413d914e3a038f974ccef)

Fix warning

Fix #81122: SSRF bypass in FILTER_VALIDATE_URL

We need to ensure that the password detected by parse_url() is actually
a valid password; we can re-use is_userinfo_valid() for that.

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |

show more ...

Introduce pseudo-keyword ZEND_FALLTHROUGH

And use it instead of comments

Use zend_string_equals() API instead of strcmp() in Filter extension

Alternative fix for bug 77423

That bug report originally was about `parse_url()` misbehaving, but the
security aspect was actually only regarding `FILTER_VALIDATE_URL`.
Since the cha

Alternative fix for bug 77423

That bug report originally was about `parse_url()` misbehaving, but the
security aspect was actually only regarding `FILTER_VALIDATE_URL`.
Since the changes to `parse_url_ex()` apparently affect userland code
which is relying on the sloppy URL parsing[1], this alternative
restores the old parsing behavior, but ensures that the userinfo is
checked for correctness for `FILTER_VALIDATE_URL`.

[1] <https://github.com/php/php-src/commit/5174de7cd33c3d4fa591c9c93859ff9989b07e8c#commitcomment-45967652>

show more ...

Implement Explicit octal notation for integers RFC

RFC: https://wiki.php.net/rfc/explicit_octal_notation

Add an extensive test suits for other variants of integer literals

Implement Explicit octal notation for integers RFC

RFC: https://wiki.php.net/rfc/explicit_octal_notation

Add an extensive test suits for other variants of integer literals

Closes GH-6360

show more ...

Fix bug #80584: 0x and 0X are considered valid hex numbers by filter_var()

Closes GH-6573

Promote warnings to exceptions in ext/filter

Closes GH-5970

Fix [-Wundef] warning in Filter extension

Make error messages more consistent by fixing capitalization

Closes GH-5066 As a first step, let's capitalize their initial letter when it is applicable.

Remove mention of PHP major version in Copyright headers

Closes GH-4732.

Added range options to the float validation filter

php_filter_int (called via the constant FILTER_VALIDATE_INT) has the options min_range
and max_range. they allow the user to not only t

Added range options to the float validation filter

php_filter_int (called via the constant FILTER_VALIDATE_INT) has the options min_range
and max_range. they allow the user to not only test if a value is a double but also if
the value is inside a specific range. php_filter_float (called via the constant
FILTER_VALIDATE_FLOAT) didn't provide this yet, making validation of numeric but
not-only-int values more complicated for the user.
this commits implements the options min_range and max_range for the function
php_filter_float to fix this inconsistency.

show more ...

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly used by Vim and Emacs editors
yet with recent changes the once working definitions don't work
anymore in Vim without custom plugins or additional configuration.
Neither are these settings synced across the PHP code base.

A simpler and better approach is EditorConfig and fixing code
using some code style fixing tools in the future instead.

This patch also removes the so called modelines for Vim. Modelines
allow Vim editor specifically to set some editor configuration such as
syntax highlighting, indentation style and tab width to be set in the
first line or the last 5 lines per file basis. Since the php test
files have syntax highlighting already set in most editors properly and
EditorConfig takes care of the indentation settings, this patch removes
these as well for the Vim 6.0 and newer versions.

With the removal of local variables for certain editors such as
Emacs and Vim, the footer is also probably not needed anymore when
creating extensions using ext_skel.php script.

Additionally, Vim modelines for setting php syntax and some editor
settings has been removed from some *.phpt files. All these are
mostly not relevant for phpt files neither work properly in the
middle of the file.

show more ...