Skip to content

Commit

Permalink
fixed bug with mixed case boundaries
Browse files Browse the repository at this point in the history
  • Loading branch information
m6w6 committed Apr 24, 2015
1 parent 6e8088d commit 0a7cc72
Show file tree
Hide file tree
Showing 4 changed files with 118 additions and 12 deletions.
7 changes: 4 additions & 3 deletions package.xml
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ This extension does not provide any INI entries, constants, functions or classes
<email>[email protected]</email>
<active>yes</active>
</lead>
<date>2015-03-18</date>
<date>2015-04-24</date>
<version>
<release>1.0.0</release>
<release>1.0.1</release>
<api>1.0.0</api>
</version>
<stability>
Expand All @@ -35,7 +35,7 @@ This extension does not provide any INI entries, constants, functions or classes
</stability>
<license>BSD, revised</license>
<notes><![CDATA[
* Split off pecl_http
* Fix bug where non-POST payloads with mixed case boundaries would not be parsed
]]></notes>
<contents>
<dir name="/">
Expand All @@ -50,6 +50,7 @@ This extension does not provide any INI entries, constants, functions or classes
<dir name="tests">
<file role="test" name="001.phpt"/>
<file role="test" name="002.phpt"/>
<file role="test" name="003.phpt"/>
</dir>
</dir>
</contents>
Expand Down
13 changes: 5 additions & 8 deletions php_apfd.c
Original file line number Diff line number Diff line change
Expand Up @@ -77,20 +77,16 @@ PHP_RINIT_FUNCTION(apfd)
{
/* populate form data on non-POST requests */
if (SG(request_info).request_method && strcasecmp(SG(request_info).request_method, "POST") && SG(request_info).content_type && *SG(request_info).content_type) {
char *ct_str = zend_str_tolower_dup(SG(request_info).content_type, strlen(SG(request_info).content_type));
size_t ct_end = strcspn(ct_str, ";, ");
char *ct_str, *ct_dup = estrdup(SG(request_info).content_type);
size_t ct_end = strcspn(ct_dup, ";, ");
sapi_post_entry *post_entry = NULL;
char delim;

SG(request_info).content_type_dup = ct_str;
SG(request_info).content_type_dup = ct_dup;

delim = ct_str[ct_end];
ct_str[ct_end] = '\0';
ct_str = zend_str_tolower_dup(ct_dup, ct_end);
if ((post_entry = apfd_get_post_entry(ct_str, ct_end TSRMLS_CC))) {
zval *files = apfd_backup_files(TSRMLS_C);

ct_str[ct_end] = delim;

if (post_entry) {
SG(request_info).post_entry = post_entry;

Expand All @@ -110,6 +106,7 @@ PHP_RINIT_FUNCTION(apfd)
*/
apfd_update_files(files TSRMLS_CC);
}
efree(ct_str);

if (SG(request_info).content_type_dup) {
efree(SG(request_info).content_type_dup);
Expand Down
2 changes: 1 addition & 1 deletion php_apfd.h
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
extern zend_module_entry apfd_module_entry;
#define phpext_apfd_ptr &apfd_module_entry

#define PHP_APFD_VERSION "1.0.0"
#define PHP_APFD_VERSION "1.0.1"

#ifdef PHP_WIN32
# define PHP_APFD_API __declspec(dllexport)
Expand Down
108 changes: 108 additions & 0 deletions tests/003.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,108 @@
--TEST--
apfd - mixed case boundary
--SKIPIF--
<?php
extension_loaded("apfd") or die("skip need apfd support\n");
?>
--PUT--
Content-Type: multipart/form-data; boundary=----------------------------abcDEFG123
------------------------------abcDEFG123
Content-Disposition: form-data; name="LICENSE"; filename="LICENSE"
Content-Type: application/octet-stream

Copyright (c) 2011-2012, Michael Wallner <[email protected]>.
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

* Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.


------------------------------abcDEFG123
Content-Disposition: form-data; name="composer"; filename="composer.json"
Content-Type: application/octet-stream

{
"name": "m6w6/autocracy",
"type": "library",
"description": "http\\Controller preserves your autocracy",
"keywords": ["http", "controller", "pecl", "pecl_http"],
"homepage": "http://github.com/m6w6/autocracy",
"license": "BSD-2",
"authors": [
{
"name": "Michael Wallner",
"email": "[email protected]"
}
],
"require": {
"php": ">=5.4.0",
"pecl/pecl_http": "2.*"
},
"autoload": {
"psr-0": {
"http\\Controller": "lib"
}
}
}

------------------------------abcDEFG123
Content-Disposition: form-data; name="user"

mike
------------------------------abcDEFG123--
--FILE--
<?php

var_dump($_POST, $_FILES);

?>
--EXPECTF--
array(1) {
["user"]=>
string(4) "mike"
}
array(2) {
["LICENSE"]=>
array(5) {
["name"]=>
string(7) "LICENSE"
["type"]=>
string(24) "application/octet-stream"
["tmp_name"]=>
string(%d) "%sphp%s"
["error"]=>
int(0)
["size"]=>
int(1340)
}
["composer"]=>
array(5) {
["name"]=>
string(13) "composer.json"
["type"]=>
string(24) "application/octet-stream"
["tmp_name"]=>
string(%d) "%sphp%s"
["error"]=>
int(0)
["size"]=>
int(550)
}
}

0 comments on commit 0a7cc72

Please sign in to comment.