PaulB
Well-known member
- Affected version
- 2.2.5
In PHP, some comparisons with
Content tagging:
==
or in_array
may return true when the programmer expects them to return false. For example, "00" == "0000"
is true in PHP, as is in_array("00", ["0000"])
. XenForo 2 performs loose comparisons in some places that can potentially result in bugs:- XF\Criteria\User#_matchUsername: lax in_array usage will result in usernames like
010
matching usernames like10
and vice versa - XF\Db\Schema\Column#addValues: lax in_array usage will treat non-duplicate values as duplicates
- XF\Db\Schema\Column#removeValues: lax array_search usage can remove the wrong value
- XF\Db\Schema\Column#getDefinition:
$existing->values != $values
will return false for['00'] != ['000']
- XF\Mvc\Entity\ValueFormatter#applyValueConstraints, line 377: in_array check on
allowedValues
could result in invalid values passing the check - XF\Legacy\DataWriter#_applyFieldValueLimits: same as previous
- XFMG\Import\Importer#getMediaTypeAndFilePathFromExtension: in_array check on file extensions could result in a match for the wrong file extension (e.g.,
sample.10
would match for file extension010
) - XFMG\Repository\Media#getMediaTypeFromExtension: same as previous
- XF\Http\Upload#isValid: same as previous
- XF\Service\AbstractService\MirrorCreator#isMirrorable: in_array check on media type could result in a disallowed media type being allowed
- XFMG\XF\Entity\Attachment#validateXfmgMediaMirrorCategory: same as previous
- XFRM\Service\ResourceItem\Icon#validateImageAsIcon:same as previous
- (vendor-patch) Laminas\Mail\Headers#has: loose in_array check can result in has() returning true when it should return false (reported upstream: https://github.com/laminas/laminas-mail/issues/152)
- (vendor) Laminas\Validator\File\*: combination of == and in_array result in files treated as having the wrong extensions (reported upstream: https://github.com/laminas/laminas-validator/issues/98)
- (vendor) Symfony\Component\Console#find, line 666: correct use of ===, but missing strict check on in_array, so the wrong command could be treated as an exact match
- (vendor) Symfony\Component\Console\Input#hasParameterOption, #getParameterOption: I'm not too sure what the implications are here without digging deeper, but it looks like these need to be a strict in_array checks.
- XF\Entity\CaptchaQuestion#isCorrect: invalid answers can be treated as correct
- XF\Pub\Controller#canBypassPolicyAcceptance: non-whitelisted paths could be treated as whitelisted
- XF\Search\Source\AbstractSource#parseKeywords, line 128: non-stop words could be treated as stop words
- XF\Searcher\AbstractSearcher#validateCriteriaValue, lines 245, 247, and 267: unique values could be filtered out due to use of SORT_REGULAR (e.g.,
['10', '010']
becomes['10']
); invalid values could be treated as valid; there may be additional implications - XF\Validator\Url#isValid, line 63: forbidden schemas could be treated as allowed
Content tagging:
- Tag a thread with tag
000
. - Save the tags.
- Try to tag the same thread with tag
00
. - The tag addition will silently fail.
- Tag a thread with tag
0
. - Save the tags.
- Click the
0
tag to be brought to its canonical page (tags/0/
). - Rather than seeing the tag page for tag
0
, you'll see the response fortags/
.