Skip to content

Commit 07925aa

Browse files
sad-spiritsad-spirit
committed
Encode all input, warn not to serve on public websites
1 parent 265e05f commit 07925aa

File tree

14 files changed

+68
-68
lines changed

14 files changed

+68
-68
lines changed

‎tests/_network/basicauth.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Helper files for HTTP_Request2 unit tests. Should be accessible via HTTP.
3+
* WARNING: This file is a part of test suite for PEAR/HTTP_Request2. It should NOT be served on public websites.
44
*
55
* PHP version 5
66
*
@@ -13,9 +13,9 @@
1313
* @category HTTP
1414
* @package HTTP_Request2
1515
* @author Alexey Borzov <[email protected]>
16-
* @copyright 2008-2023 Alexey Borzov <[email protected]>
17-
* @license http://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18-
* @link http://pear.php.net/package/HTTP_Request2
16+
* @copyright 2008-2025 Alexey Borzov <[email protected]>
17+
* @license https://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18+
* @link https://pear.php.net/package/HTTP_Request2
1919
*/
2020

2121
$user = isset($_SERVER['PHP_AUTH_USER']) ? $_SERVER['PHP_AUTH_USER'] : null;
@@ -27,7 +27,7 @@
2727
header('WWW-Authenticate: Basic realm="HTTP_Request2 tests"', true, 401);
2828
echo "Login required";
2929
} else {
30-
echo "Username={$user};Password={$pass}";
30+
echo htmlspecialchars("Username={$user};Password={$pass}", ENT_NOQUOTES, 'UTF-8');
3131
}
3232

3333
?>

‎tests/_network/bug19934.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Helper files for HTTP_Request2 unit tests. Should be accessible via HTTP.
3+
* WARNING: This file is a part of test suite for PEAR/HTTP_Request2. It should NOT be served on public websites.
44
*
55
* PHP version 5
66
*
@@ -13,9 +13,9 @@
1313
* @category HTTP
1414
* @package HTTP_Request2
1515
* @author Alexey Borzov <[email protected]>
16-
* @copyright 2008-2023 Alexey Borzov <[email protected]>
17-
* @license http://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18-
* @link http://pear.php.net/package/HTTP_Request2
16+
* @copyright 2008-2025 Alexey Borzov <[email protected]>
17+
* @license https://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18+
* @link https://pear.php.net/package/HTTP_Request2
1919
*/
2020

2121
for ($i = 0; $i < 20; $i++) {

‎tests/_network/bug20228.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Helper files for HTTP_Request2 unit tests. Should be accessible via HTTP.
3+
* WARNING: This file is a part of test suite for PEAR/HTTP_Request2. It should NOT be served on public websites.
44
*
55
* PHP version 5
66
*
@@ -13,9 +13,9 @@
1313
* @category HTTP
1414
* @package HTTP_Request2
1515
* @author Alexey Borzov <[email protected]>
16-
* @copyright 2008-2023 Alexey Borzov <[email protected]>
17-
* @license http://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18-
* @link http://pear.php.net/package/HTTP_Request2
16+
* @copyright 2008-2025 Alexey Borzov <[email protected]>
17+
* @license https://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18+
* @link https://pear.php.net/package/HTTP_Request2
1919
*/
2020

2121
header('Transfer-Encoding: chunked');

‎tests/_network/cookies.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Helper files for HTTP_Request2 unit tests. Should be accessible via HTTP.
3+
* WARNING: This file is a part of test suite for PEAR/HTTP_Request2. It should NOT be served on public websites.
44
*
55
* PHP version 5
66
*
@@ -13,12 +13,12 @@
1313
* @category HTTP
1414
* @package HTTP_Request2
1515
* @author Alexey Borzov <[email protected]>
16-
* @copyright 2008-2023 Alexey Borzov <[email protected]>
17-
* @license http://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18-
* @link http://pear.php.net/package/HTTP_Request2
16+
* @copyright 2008-2025 Alexey Borzov <[email protected]>
17+
* @license https://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18+
* @link https://pear.php.net/package/HTTP_Request2
1919
*/
2020

2121
ksort($_COOKIE);
22-
echo serialize($_COOKIE);
22+
echo htmlspecialchars(serialize($_COOKIE), ENT_NOQUOTES, 'UTF-8');
2323

2424
?>

‎tests/_network/digestauth.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Helper files for HTTP_Request2 unit tests. Should be accessible via HTTP.
3+
* WARNING: This file is a part of test suite for PEAR/HTTP_Request2. It should NOT be served on public websites.
44
*
55
* PHP version 5
66
*
@@ -13,15 +13,15 @@
1313
* @category HTTP
1414
* @package HTTP_Request2
1515
* @author Alexey Borzov <[email protected]>
16-
* @copyright 2008-2023 Alexey Borzov <[email protected]>
17-
* @license http://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18-
* @link http://pear.php.net/package/HTTP_Request2
16+
* @copyright 2008-2025 Alexey Borzov <[email protected]>
17+
* @license https://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18+
* @link https://pear.php.net/package/HTTP_Request2
1919
*/
2020

2121
/**
2222
* Mostly borrowed from PHP manual and Socket Adapter implementation
2323
*
24-
* @link http://php.net/manual/en/features.http-auth.php
24+
* @link https://php.net/manual/en/features.http-auth.php
2525
*/
2626

2727
/**
@@ -78,6 +78,6 @@ function http_digest_parse($txt)
7878
'",qop="auth",nonce="' . uniqid() . '"', true, 401);
7979
echo "Login required";
8080
} else {
81-
echo "Username={$data['username']}";
81+
echo htmlspecialchars("Username={$data['username']}", ENT_NOQUOTES, 'UTF-8');
8282
}
8383
?>

‎tests/_network/download.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Helper files for HTTP_Request2 unit tests. Should be accessible via HTTP.
3+
* WARNING: This file is a part of test suite for PEAR/HTTP_Request2. It should NOT be served on public websites.
44
*
55
* PHP version 5
66
*
@@ -13,9 +13,9 @@
1313
* @category HTTP
1414
* @package HTTP_Request2
1515
* @author Alexey Borzov <[email protected]>
16-
* @copyright 2008-2023 Alexey Borzov <[email protected]>
17-
* @license http://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18-
* @link http://pear.php.net/package/HTTP_Request2
16+
* @copyright 2008-2025 Alexey Borzov <[email protected]>
17+
* @license https://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18+
* @link https://pear.php.net/package/HTTP_Request2
1919
*/
2020

2121
$payload = str_repeat('0123456789abcdef', 128);

‎tests/_network/getparameters.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Helper files for HTTP_Request2 unit tests. Should be accessible via HTTP.
3+
* WARNING: This file is a part of test suite for PEAR/HTTP_Request2. It should NOT be served on public websites.
44
*
55
* PHP version 5
66
*
@@ -13,12 +13,12 @@
1313
* @category HTTP
1414
* @package HTTP_Request2
1515
* @author Alexey Borzov <[email protected]>
16-
* @copyright 2008-2023 Alexey Borzov <[email protected]>
17-
* @license http://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18-
* @link http://pear.php.net/package/HTTP_Request2
16+
* @copyright 2008-2025 Alexey Borzov <[email protected]>
17+
* @license https://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18+
* @link https://pear.php.net/package/HTTP_Request2
1919
*/
2020

2121
ksort($_GET);
22-
echo serialize($_GET);
22+
echo htmlspecialchars(serialize($_GET), ENT_NOQUOTES, 'UTF-8');
2323

2424
?>

‎tests/_network/incompletebody.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Helper files for HTTP_Request2 unit tests. Should be accessible via HTTP.
3+
* WARNING: This file is a part of test suite for PEAR/HTTP_Request2. It should NOT be served on public websites.
44
*
55
* PHP version 5
66
*
@@ -13,9 +13,9 @@
1313
* @category HTTP
1414
* @package HTTP_Request2
1515
* @author Alexey Borzov <[email protected]>
16-
* @copyright 2008-2023 Alexey Borzov <[email protected]>
17-
* @license http://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18-
* @link http://pear.php.net/package/HTTP_Request2
16+
* @copyright 2008-2025 Alexey Borzov <[email protected]>
17+
* @license https://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18+
* @link https://pear.php.net/package/HTTP_Request2
1919
*/
2020

2121
header('Connection: close');

‎tests/_network/postparameters.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Helper files for HTTP_Request2 unit tests. Should be accessible via HTTP.
3+
* WARNING: This file is a part of test suite for PEAR/HTTP_Request2. It should NOT be served on public websites.
44
*
55
* PHP version 5
66
*
@@ -13,12 +13,12 @@
1313
* @category HTTP
1414
* @package HTTP_Request2
1515
* @author Alexey Borzov <[email protected]>
16-
* @copyright 2008-2023 Alexey Borzov <[email protected]>
17-
* @license http://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18-
* @link http://pear.php.net/package/HTTP_Request2
16+
* @copyright 2008-2025 Alexey Borzov <[email protected]>
17+
* @license https://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18+
* @link https://pear.php.net/package/HTTP_Request2
1919
*/
2020

2121
ksort($_POST);
22-
echo serialize($_POST);
22+
echo htmlspecialchars(serialize($_POST), ENT_NOQUOTES, 'UTF-8');
2323

2424
?>

‎tests/_network/rawpostdata.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Helper files for HTTP_Request2 unit tests. Should be accessible via HTTP.
3+
* WARNING: This file is a part of test suite for PEAR/HTTP_Request2. It should NOT be served on public websites.
44
*
55
* PHP version 5
66
*
@@ -13,10 +13,10 @@
1313
* @category HTTP
1414
* @package HTTP_Request2
1515
* @author Alexey Borzov <[email protected]>
16-
* @copyright 2008-2023 Alexey Borzov <[email protected]>
17-
* @license http://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18-
* @link http://pear.php.net/package/HTTP_Request2
16+
* @copyright 2008-2025 Alexey Borzov <[email protected]>
17+
* @license https://opensource.org/licenses/BSD-3-Clause BSD 3-Clause License
18+
* @link https://pear.php.net/package/HTTP_Request2
1919
*/
2020

21-
readfile('php://input');
21+
echo htmlspecialchars(file_get_contents('php://input'), ENT_NOQUOTES, 'UTF-8');
2222
?>

0 commit comments

Comments
 (0)