diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2007-05-03 23:38:27 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2007-05-03 23:38:27 +0000 |
| commit | cd32cab680679f4bd75f4f43630fc925da7d52d0 (patch) | |
| tree | dd7280ac023ebf71e10e1b813dcec60b40ecd5ab /ext/filter | |
| parent | f50ec4ea53e6f628c5f37bf71a18a103fa52ce14 (diff) | |
| download | php-git-cd32cab680679f4bd75f4f43630fc925da7d52d0.tar.gz | |
Fixed ext/filter Email Validation Vulnerability
(MOPB-24 by Stefan Esser)
Diffstat (limited to 'ext/filter')
| -rw-r--r-- | ext/filter/logical_filters.c | 2 | ||||
| -rw-r--r-- | ext/filter/tests/PMOPB45.phpt | 11 |
2 files changed, 12 insertions, 1 deletions
diff --git a/ext/filter/logical_filters.c b/ext/filter/logical_filters.c index 67e6d8de36..f54a83389d 100644 --- a/ext/filter/logical_filters.c +++ b/ext/filter/logical_filters.c @@ -469,7 +469,7 @@ void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */ void php_filter_validate_email(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */ { /* From http://cvs.php.net/co.php/pear/HTML_QuickForm/QuickForm/Rule/Email.php?r=1.4 */ - const char regexp[] = "/^((\\\"[^\\\"\\f\\n\\r\\t\\b]+\\\")|([\\w\\!\\#\\$\\%\\&\\'\\*\\+\\-\\~\\/\\^\\`\\|\\{\\}]+(\\.[\\w\\!\\#\\$\\%\\&\\'\\*\\+\\-\\~\\/\\^\\`\\|\\{\\}]+)*))@((\\[(((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9])))\\])|(((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9])))|((([A-Za-z0-9\\-])+\\.)+[A-Za-z\\-]+))$/"; + const char regexp[] = "/^((\\\"[^\\\"\\f\\n\\r\\t\\b]+\\\")|([\\w\\!\\#\\$\\%\\&\\'\\*\\+\\-\\~\\/\\^\\`\\|\\{\\}]+(\\.[\\w\\!\\#\\$\\%\\&\\'\\*\\+\\-\\~\\/\\^\\`\\|\\{\\}]+)*))@((\\[(((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9])))\\])|(((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9]))\\.((25[0-5])|(2[0-4][0-9])|([0-1]?[0-9]?[0-9])))|((([A-Za-z0-9\\-])+\\.)+[A-Za-z\\-]+))$/D"; pcre *re = NULL; pcre_extra *pcre_extra = NULL; diff --git a/ext/filter/tests/PMOPB45.phpt b/ext/filter/tests/PMOPB45.phpt new file mode 100644 index 0000000000..532eb219d3 --- /dev/null +++ b/ext/filter/tests/PMOPB45.phpt @@ -0,0 +1,11 @@ +--TEST-- +PMOPB-45-2007:PHP ext/filter Email Validation Vulnerability +--SKIPIF-- +<?php if (!extension_loaded("filter")) die("skip"); ?> +--FILE-- +<?php + $var = "test@example.com\n"; + var_dump(filter_var($var, FILTER_VALIDATE_EMAIL)); +?> +--EXPECT-- +bool(false) |