php-src/sapi
Niels Dossche 88315f263d
Fix GHSA-3qgc-jrrr-25jv
The original code is error-prone due to the "best fit mapping" that
happens with the argument parsing but not with the query string.
When we get a non-ASCII character, try to remap it and see if it becomes
a hyphen.

An alternative approach is to create a custom main `wmain` receiving
wide-character variations that does the ANSI transformation with the
best-fit mapping, but that's more error-prone and could cause unexpected
breakage.

Another alternative was just don't doing this check altogether and
always check for `cgi || fastcgi` instead, but that breaks real-world
use-cases.
2024-06-04 08:58:51 -04:00
..
apache2handler Merge branch 'PHP-8.1' into PHP-8.2 2022-12-13 15:24:07 +01:00
cgi Fix GHSA-3qgc-jrrr-25jv 2024-06-04 08:58:51 -04:00
cli Fix GH-14189: PHP Interactive shell input state incorrectly handles quoted heredoc literals. 2024-05-10 16:48:26 +02:00
embed Refacto php_module_startup() (#8303) 2022-04-27 23:07:11 +01:00
fpm Fix GH-14175: Use two digit float specifier for FPM systemd format req rate 2024-05-12 13:30:29 +01:00
fuzzer Fix GH-13978: Fuzzer readme still mentions obsolete --enable-json flag (#13983) 2024-04-16 22:16:51 +02:00
litespeed Set libtool tag per command instead of global one 2024-01-10 09:09:45 +01:00
phpdbg Fix GH-13931: Applying zero offset to null pointer in Zend/zend_opcode.c 2024-04-15 19:39:05 +02:00