8000 Throw TransformationFailedException when there is a null bytes injection by sormes · Pull Request #54306 · symfony/symfony · GitHub
[go: up one dir, main page]
Skip to content

Throw TransformationFailedException when there is a null bytes injection #54306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 3 commits into from
Closed

Throw TransformationFailedException when there is a null bytes injection #54306

wants to merge 3 commits into from

Conversation

sormes
Copy link
Contributor
@sormes sormes commented Mar 15, 2024
Q A
Branch? 5.4
Bug fix? yes
New feature? no
Deprecations? no
Issues -
License MIT

On one hand, in PHP 7, DateTime::createFromFormat allows null byte injection, and on the other hand, in PHP 8, it throws a ValueError that is not caught. This PR prevents injection when using version 5.4 under PHP 7 and onwards, throwing a TransformationFailedException.

@carsonbot carsonbot added this to the 5.4 milestone Mar 15, 2024
@sormes sormes changed the title Throw TransformationFailedException when there is a null bytes injection [Form] Throw TransformationFailedException when there is a null bytes injection Mar 16, 2024
@sormes sormes requested a review from derrabus March 16, 2024 04:45
@carsonbot carsonbot changed the title [Form] Throw TransformationFailedException when there is a null bytes injection Throw TransformationFailedException when there is a null bytes injection Mar 17, 2024
@fabpot
Copy link
Member
fabpot commented Mar 17, 2024

Thank you @sormes.

fabpot added a commit that referenced this pull request Mar 17, 2024
@fabpot
bug #54306 Throw TransformationFailedException when there is a null b…
c7ca33a 
…ytes injection (sormes)

This PR was squashed before being merged into the 5.4 branch.

Discussion
----------

Throw TransformationFailedException when there is a null bytes injection

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | yes
| New feature?  | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Issues        | -  <!-- prefix each issue number with "Fix #", no need to create an issue if none exists, explain below instead -->
| License       | MIT

On one hand, in PHP 7, DateTime::createFromFormat allows null byte injection, and on the other hand, in PHP 8, it throws a ValueError that is not caught. This PR prevents injection when using version 5.4 under PHP 7 and onwards, throwing a TransformationFailedException.

Commits
-------

dd3c254 Throw TransformationFailedException when there is a null bytes injection
@fabpot fabpot closed this Mar 17, 2024
This was referenced Apr 2, 2024
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@smnandre smnandre smnandre left review comments

@fabpot fabpot fabpot approved these changes

@xabbuh xabbuh Awaiting requested review from xabbuh xabbuh is a code owner

@yceruto yceruto Awaiting requested review from yceruto yceruto is a code owner

@derrabus derrabus Awaiting requested review from derrabus

Assignees
No one assigned
Labels
Bug Status: Reviewed
Projects
None yet
Milestone
5.4
Development

Successfully merging this pull request may close these issues.
5 participants
@sormes @fabpot @smnandre @derrabus @carsonbot
0