Bug #54391 [Opn]: escapeshellarg strip non-ascii characters

Edit report at https://bugs.php.net/bug.php?id=54391&edit=1

 ID:                 54391
 Updated by:         [email protected]
 Reported by:        c dot madmax at gmail dot com
 Summary:            escapeshellarg strip non-ascii characters
 Status:             Open
 Type:               Bug
 Package:            Program Execution
 Operating System:   any
 PHP Version:        any
-Assigned To:        
+Assigned To:        bukka
 Block user comment: N
 Private report:     N

 New Comment:

I did a bit of digging and this was introduced in https://github.com/php/php-src/commit/9227974ddb44f367b2ed7b0885f3b39169597ca7 with follow up refining in https://github.com/php/php-src/commit/74b5cfdea54ccddf2db7daa2e6c83a26f06e1950 .

I'm a bit worried about security impact if disabled it as suddenly allowing incomplete multibyte characters could lead to some security issues in some cases.

What we could maybe do is to look into some reasonable locale defaults if there is none as stripping characters is not nice but it needs some considering if this would be safe. We should for sure improve the docs.


Previous Comments:
------------------------------------------------------------------------
[2017-02-07 11:06:17] netvicious at gmail dot com

This bug seems to be on the limbo so much time.

I get here looking for a solution but it only guided me to found my solution.

For me it worked with a setlocale(LC_ALL, 'es_ES@euro'), it didn't worked with setlocale(LC_ALL, 'es_ES@iso-8859-1') and others but I think it should be a problem with the locales on the linux configuration.

Run a locale-gen in your machine and look which locales do you have installed on your machine, and use one of they.

------------------------------------------------------------------------
[2015-02-03 07:01:59] [email protected]

Duplicate.
https://bugs.php.net/bug.php?id=45132
Keep this bug open.

------------------------------------------------------------------------
[2013-02-03 23:54:21] me at paulofreitas dot me

Test script:
---------------
<?php

$filename = 'résumé.pdf';

var_dump(escapeshellarg($filename));
setlocale(LC_CTYPE, 'en_US.utf8');
var_dump(escapeshellarg($filename));

?>

Test result when executed from CLI:
---------------
string(14) "'résumé.pdf'"
string(14) "'résumé.pdf'"

Test result when executed from Apache:
---------------
// Executed from Apache
string(10) "'rsum.pdf'"
string(14) "'résumé.pdf'"

Which locale to use? Will it works cross-platform? Yeah, that's a very annoying unexpected behavior.

------------------------------------------------------------------------
[2011-03-26 15:35:48] c dot madmax at gmail dot com

This is a different bug!

Bug 44945 is related to utf-8 strings, and the bug is fixed. escapeshellarg() don't remve valid utf-8 characters.

But escapeshellarg() remove ISO-8959-1 characters!

------------------------------------------------------------------------
[2011-03-26 15:18:54] [email protected]

Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php



------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=54391


--
Edit this bug report at https://bugs.php.net/bug.php?id=54391&edit=1