Edit report at https://pear.php.net/bugs/bug.php?id=20385&edit=1
ID: 20385
Updated by: [email protected]
Reported By: jan dot prachar at gmail dot com
Summary: Incorrect normalization of userinfo
-Status: Assigned
+Status: Closed
Type: Bug
Package: Net_URL2
Package Version: SVN
PHP Version: 5.5.9
Assigned To: tkli
Roadmap Versions:
New Comment:
-Status: Assigned
+Status: Closed
Thank you for your bug report. This issue has been fixed
in the latest released version of the package, which you can download at
http://pear.php.net/get/
Previous Comments:
------------------------------------------------------------------------
[2014-09-06 11:16:38] tkli
-Status: Open
+Status: Assigned
-Assigned To:
+Assigned To: tkli
------------------------------------------------------------------------
[2014-09-06 11:16:17] tkli
Thanks for reporting and providing a patch. As per #20013 the userinfo
can be an empty string which must not mean it is not set. Within URL
normalization this is normally not a problem, but as your report shows,
the _userinfo field just should not be normalized in normalize() as
otherwise FALSE would be turned into a zero-length string.
I now fixed this by not normalizing the private field _userinfo in case
it is FALSE. This fixes the flaw you reported as the internal state is
kept untainted.
It also does not introduce a new issue (that would be in your suggested
patch), that a zero-length userinfo string would be turned into FALSE
(inversion of your report).
I published the changes now here:
https://github.com/ktomk/Net_URL2/tree/patch-20385
Thanks to your report it also came to my attention that the handling in
setUserinfo() is tainted, too. I will add tests and fixes for that, too
and then create a new release.
------------------------------------------------------------------------
[2014-09-04 14:02:09] pracj3am
Added #patch
bug:20385;patch:Fixed-Userinfo-isn-t-false-after-normali;revision:1409835729;.
------------------------------------------------------------------------
[2014-09-04 14:00:59] pracj3am
Description:
------------
See test case in the patch
------------------------------------------------------------------------
--
Edit this bug report at https://pear.php.net/bugs/bug.php?id=20385&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.