php-src/sapi
Niels Dossche b6d1d3980a
Fix GHSA-3qgc-jrrr-25jv
The original code is error-prone due to the "best fit mapping" that
happens with the argument parsing but not with the query string.
When we get a non-ASCII character, try to remap it and see if it becomes
a hyphen.

An alternative approach is to create a custom main `wmain` receiving
wide-character variations that does the ANSI transformation with the
best-fit mapping, but that's more error-prone and could cause unexpected
breakage.

Another alternative was just don't doing this check altogether and
always check for `cgi || fastcgi` instead, but that breaks real-world
use-cases.
2024-06-04 07:39:11 -07:00
..
apache2handler Implement GH-10854: TSRM should set a smarter value for expected_threads (#10867) 2023-03-17 17:08:47 +01:00
cgi Fix GHSA-3qgc-jrrr-25jv 2024-06-04 07:39:11 -07:00
cli Merge branch 'PHP-8.2' into PHP-8.3 2024-05-10 16:48:59 +02:00
embed main/SAPI: make "ini_entries" a const string 2023-01-04 12:49:48 +00:00
fpm Merge branch 'PHP-8.2' into PHP-8.3 2024-05-12 13:32:56 +01:00
fuzzer Merge branch 'PHP-8.2' into PHP-8.3 2024-04-16 22:17:42 +02:00
litespeed Merge branch 'PHP-8.2' into PHP-8.3 2024-01-10 09:13:39 +01:00
phpdbg Merge branch 'PHP-8.2' into PHP-8.3 2024-04-15 19:39:59 +02:00