laruence / taint

Taint is a PHP extension, used for detecting XSS codes
Other
611 stars 128 forks source link

String slashes bug #28

Closed pizzeys closed 8 years ago

pizzeys commented 8 years ago

Hi, I've only just started playing with this extension and I'm not familiar enough with how it works yet to properly triage this so apologies for being kind of vague!

I have enabled the extension on PHP 7 on Ubuntu 14.10 with 'pecl install taint-beta'.

When it's enabled, it seems to be doing something strange to strings containing slashes. For example if I run Wordpress, I get errors such as the following:

[Fri Jan 29 13:00:54.852696 2016] [:error] [pid 20226] [client :3850] PHP Warning: require(var/www/html/wp/wp-content/plugins/bbpress/includes/core/sub-actions.php)

There should be a leading '/' on this path, but it has disappeared. Also, sometimes I get redirected to paths which should contain slashes and don't, for example it will sometimes redirect me to '/wp-adminsomepage' instead of 'wp-admin/somepage'.

However, if I disable taint in php.ini, these problems immediately disappear and everything is fine.

Does this ring any bells for anyone more familiar with the codebase as to anything taint may be doing to cause this?

laruence commented 8 years ago

hey, you could try latest snapshot here: https://github.com/laruence/taint/tree/php7

I fixed a trim bug recently , it probably is the cause of these problems...

laruence commented 8 years ago

long time no feed back, close for now