PHPC-721: Do not allow null bytes in Javascript code

Even though "code" is not a cstring in the BSON spec, libbson does not support null bytes. Throw early to avoid unexpected truncation during BSON encoding.

Author: jmikola

src/BSON/Javascript.c

@@ -55,6 +55,11 @@ static bool php_phongo_javascript_init(php_phongo_javascript_t *intern, const ch
 		return false;
 	}
 
+	if (strlen(code) != code_len) {
+		phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT TSRMLS_CC, "Code cannot contain null bytes");
+		return false;
+	}
+
 	intern->code = estrndup(code, code_len);
 	intern->code_len = code_len;
 

tests/bson/bson-javascript-serialization_error-003.phpt

@@ -0,0 +1,19 @@
+--TEST--
+MongoDB\BSON\Javascript unserialization does not allow code to contain null bytes
+--SKIPIF--
+<?php require __DIR__ . "/../utils/basic-skipif.inc"?>
+--FILE--
+<?php
+require_once __DIR__ . "/../utils/basic.inc";
+
+echo throws(function() {
+    unserialize('O:23:"MongoDB\BSON\Javascript":1:{s:4:"code";s:30:"function foo() { return ' . "'\0'" . '; }";}');
+}, 'MongoDB\Driver\Exception\InvalidArgumentException'), "\n";
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECT--
+OK: Got MongoDB\Driver\Exception\InvalidArgumentException
+Code cannot contain null bytes
+===DONE===

tests/bson/bson-javascript-set_state_error-003.phpt

@@ -0,0 +1,19 @@
+--TEST--
+MongoDB\BSON\Javascript::__set_state() does not allow code to contain null bytes
+--SKIPIF--
+<?php require __DIR__ . "/../utils/basic-skipif.inc"?>
+--FILE--
+<?php
+require_once __DIR__ . "/../utils/basic.inc";
+
+echo throws(function() {
+    MongoDB\BSON\Javascript::__set_state(['code' => "function foo() { return '\0'; }"]);
+}, 'MongoDB\Driver\Exception\InvalidArgumentException'), "\n";
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECT--
+OK: Got MongoDB\Driver\Exception\InvalidArgumentException
+Code cannot contain null bytes
+===DONE===

tests/bson/bson-javascript_error-003.phpt

@@ -0,0 +1,19 @@
+--TEST--
+MongoDB\BSON\Javascript::__construct() does not allow code to contain null bytes
+--SKIPIF--
+<?php require __DIR__ . "/../utils/basic-skipif.inc"?>
+--FILE--
+<?php
+require_once __DIR__ . "/../utils/basic.inc";
+
+echo throws(function() {
+    new MongoDB\BSON\Javascript("function foo() { return '\0'; }");
+}, 'MongoDB\Driver\Exception\InvalidArgumentException'), "\n";
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECT--
+OK: Got MongoDB\Driver\Exception\InvalidArgumentException
+Code cannot contain null bytes
+===DONE===