Skip to content

ext/standard warning to error promotions #5814

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 15 commits into from

Conversation

Girgias
Copy link
Member

@Girgias Girgias commented Jul 6, 2020

Does should be rather uncontroversial I think

HashTable *ht;

ZEND_PARSE_PARAMETERS_START(2, 2)
Z_PARAM_ZVAL(key)
Z_PARAM_STR_OR_LONG(string_key, int_key)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

array_key_exists() is not a good target for this. Please see Nikita's comment here: #4887

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isset does a usual int silent type cast, string array keys are the only weird thing where "03" will remain "03" but "3" would become the integer index 3 thus I think the behaviour would be consistent but can double check

@Girgias Girgias force-pushed the standard-warning-to-error branch 2 times, most recently from 599506c to 2ead2f6 Compare July 7, 2020 18:26
/* name too long, protect from CVE-2015-0235 */
php_error_docref(NULL, E_WARNING, "Host name is too long, the limit is %d characters", MAXFQDNLEN);
RETURN_STRINGL(hostname, hostname_len);
zend_argument_value_error(1, "must be less than %d characters", MAXFQDNLEN);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what about cannot be longer than %d characters? As far as I see the condition, less than MAXFQDNLEN isn't true, because being equal is also okay.

php_error_docref(NULL, E_WARNING,
"Numeric DNS record type must be between 1 and 65535, '" ZEND_LONG_FMT "' given", type_param);
RETURN_FALSE;
zend_argument_value_error(2, "must be between 1 and 65535 when Argument #5 ($raw) is true");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
zend_argument_value_error(2, "must be between 1 and 65535 when Argument #5 ($raw) is true");
zend_argument_value_error(2, "must be between 1 and 65535 when argument #5 ($raw) is true");

@Girgias Girgias force-pushed the standard-warning-to-error branch from 2ead2f6 to f9bd96a Compare August 1, 2020 23:09
@Girgias
Copy link
Member Author

Girgias commented Aug 1, 2020

I dropped the array_key_exist one while addressing the reviews

php_error_docref(NULL, E_WARNING, "Type '%s' not supported", rectype);
RETURN_FALSE;
zend_argument_value_error(2, "must be one of \"A\", \"NS\", \"MX\", \"PTR\", \"ANY\", \"SAO\", \"CAA\", "
"\"TXT\", \"CNAME\", \"AAAA\", \"SRV\", \"NAPTR\", or \"A6\"");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we should list all possibilities here, as this may get extended and depends on environment (e.g. I don't think CAA works on Windows). Just say valid DNS record type or something like that.

php_error_docref(NULL, E_WARNING, "Type '" ZEND_LONG_FMT "' not supported", type_param);
RETURN_FALSE;
zend_argument_value_error(2, "must be one of DNS_A, DNS_CNAME, DNS_HINFO, DNS_CAA, DNS_MX, "
"DNS_NS, DNS_PTR, DNS_SOA, DNS_TXT, DNS_AAAA, DNS_SRV, DNS_NAPTR, DNS_A6, DNS_ALL, or DNS_ANY");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd only mention DNS_* here (we do this in a few places).

@@ -193,8 +193,8 @@ PHP_FUNCTION(iptcembed)
}

if (iptcdata_len >= SIZE_MAX - sizeof(psheader) - 1025) {
php_error_docref(NULL, E_WARNING, "IPTC data too large");
RETURN_FALSE;
zend_argument_value_error(1, "must be less than %d characters", SIZE_MAX - sizeof(psheader) - 1025);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd go for is too large here, the exact value doesn't add value as it's impossible to reach with sensible code.

?>
--EXPECT--
gethostbyname(): Argument #1 ($hostname) cannot be longer than 255 characters
gethostbynamel(): Argument #1 ($hostname) cannot be longer than 255 characters
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These should be %d. Though I'm not really sure if we actually want to promote these. The number differs by platform and is something one could hit with reasonable code. As gethostbyname() is already fallible, it would currently be a necessary false check.

"Err, filter \"%s\" is not in the user-filter map, but somehow the user-filter-factory was invoked for it!?", filtername);
zend_throw_error(NULL, "Filter \"%s\" is not in the user-filter map, "
"but user-filter-factory was invoked for it."
"This is a bug, please report it at https://bugs.php.net", filtername);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should just ZEND_ASSERT(fdat) here.

Comment on lines 215 to 216
php_error_docref(NULL, E_WARNING, "Host name is too long, the limit is %d characters", MAXFQDNLEN);
RETURN_STRINGL(hostname, hostname_len);
zend_argument_value_error(1, "cannot be longer than %d characters", MAXFQDNLEN);
RETURN_THROWS();
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So compared to gethostbynamel(), gethostbyname() does not return false should I change this to return false if I revert the ValueError to warning?

@Girgias Girgias force-pushed the standard-warning-to-error branch from e477a5d to c0aea24 Compare September 2, 2020 15:39
@php-pulls php-pulls closed this in 4a438b4 Sep 3, 2020
@Girgias Girgias deleted the standard-warning-to-error branch September 3, 2020 15:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants