laruence / taint

Taint is a PHP extension, used for detecting XSS codes
Other
611 stars 128 forks source link

PHP 7.3.0 + Taint 2.0.5 + Arrays #70

Open craigfrancis opened 5 years ago

craigfrancis commented 5 years ago

Something isn't right with arrays:

<?php

$t = [];
$t['html'] = '
    <ul>';

foreach (['a', 'b', 'c'] as $area) {
    $t['html'] .= '
        <li>' . htmlentities($area) . '</li>';
}

$t['html'] .= '
    </ul>';

echo $t['html'];

?>

Produces the following output:

    <ul>
        <li>a</li>
        <li>b</li>
        <li>c</li>
        <li>

I'm not sure where the extra <li> comes from.

And while most of the time is produces the above, sometimes (often the first time the script is run after saving) it produces:

    <ul>
        <li>a</li>
        <li>b</li>
        <li>c</li></li>

I've not had it return the </ul>.