qbdsoft / owasp-esapi-php

Automatically exported from code.google.com/p/owasp-esapi-php
Other
0 stars 0 forks source link

Codec decode broken where encoded characters are longer than one character #25

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
Assuming one adds a check for null, the Codec decode function is broken for
the case where encoded characters are longer than one character; pushback
string or equivalent is needed.

Original issue reported on code.google.com by mike.bob...@gmail.com on 3 Nov 2009 at 9:40

GoogleCodeExporter commented 9 years ago

Original comment by mike.bob...@gmail.com on 5 Nov 2009 at 1:41

GoogleCodeExporter commented 9 years ago
This is fixed within the first proper multibyte implementation of Codec::decode 
and
HTMLEntityCodec::decodeCharacter, PercentCodec::decodeCharacter,
UnixCodec::decodeCharacter, and WindowsCodec::decodeCharacter methods.

PushbackString-esque functionality has been implemented, whereby decodeCharacter
methods (and their sub-methods) return an array containing both the 
decodedCharacter
and the encodedString that yeilded that decodedCharacter. This allows 
Codec::decode
to manage the "eating" of encodedString portions from the original input as per 
the
PushbackString class. Double-decoding has been partially implemented but not
committed at all at this stage.

Checking the input itself for null is not necessary in Codec::decode, if the 
input is
null then the output is null, as per the JAVA version. Checking each 
decodedCharacter
for null is necessary and occurs in the first proper multibyte PHP 
implementation of
decode (r176).

Original comment by coreform on 6 Nov 2009 at 5:42