Sanitize control characters in strings

Author: arshidkv12

ext/standard/url.c

@@ -47,6 +47,20 @@ PHPAPI void php_url_free(php_url *theurl)
 }
 /* }}} */
 
+static void php_replace_controlchars(char *str, size_t len)
+{
+	unsigned char *s = (unsigned char *)str;
+	unsigned char *e = (unsigned char *)str + len;
+
+	ZEND_ASSERT(str != NULL);
+
+	while (s < e) {
+        if (*s <= 0x1F || *s == 0x7F) {   
+			*s = '_'; 
+		}
+        s++;
+    }
+}
 
 PHPAPI php_url *php_url_parse(char const *str)
 {
@@ -105,6 +119,7 @@ PHPAPI php_url *php_url_parse_ex2(char const *str, size_t length, bool *has_port
 
 		if (e + 1 == ue) { /* only scheme is available */
 			ret->scheme = zend_string_init(s, (e - s), 0);
+			php_replace_controlchars(ZSTR_VAL(ret->scheme), ZSTR_LEN(ret->scheme));
 			return ret;
 		}
 
@@ -126,11 +141,13 @@ PHPAPI php_url *php_url_parse_ex2(char const *str, size_t length, bool *has_port
 			}
 
 			ret->scheme = zend_string_init(s, (e-s), 0);
+			php_replace_controlchars(ZSTR_VAL(ret->scheme), ZSTR_LEN(ret->scheme));
 
 			s = e + 1;
 			goto just_path;
 		} else {
 			ret->scheme = zend_string_init(s, (e-s), 0);
+			php_replace_controlchars(ZSTR_VAL(ret->scheme), ZSTR_LEN(ret->scheme));
 
 			if (e + 2 < ue && *(e + 2) == '/') {
 				s = e + 3;
@@ -196,11 +213,14 @@ PHPAPI php_url *php_url_parse_ex2(char const *str, size_t length, bool *has_port
 	if ((p = zend_memrchr(s, '@', (e-s)))) {
 		if ((pp = memchr(s, ':', (p-s)))) {
 			ret->user = zend_string_init(s, (pp-s), 0);
+			php_replace_controlchars(ZSTR_VAL(ret->user), ZSTR_LEN(ret->user));
 
 			pp++;
 			ret->pass = zend_string_init(pp, (p-pp), 0);
+			php_replace_controlchars(ZSTR_VAL(ret->pass), ZSTR_LEN(ret->pass));
 		} else {
 			ret->user = zend_string_init(s, (p-s), 0);
+			php_replace_controlchars(ZSTR_VAL(ret->user), ZSTR_LEN(ret->user));
 		}
 
 		s = p + 1;
@@ -249,6 +269,7 @@ PHPAPI php_url *php_url_parse_ex2(char const *str, size_t length, bool *has_port
 	}
 
 	ret->host = zend_string_init(s, (p-s), 0);
+	php_replace_controlchars(ZSTR_VAL(ret->host), ZSTR_LEN(ret->host));
 
 	if (e == ue) {
 		return ret;
@@ -264,6 +285,7 @@ PHPAPI php_url *php_url_parse_ex2(char const *str, size_t length, bool *has_port
 		p++;
 		if (p < e) {
 			ret->fragment = zend_string_init(p, (e - p), 0);
+			php_replace_controlchars(ZSTR_VAL(ret->fragment), ZSTR_LEN(ret->fragment));
 		} else {
 			ret->fragment = ZSTR_EMPTY_ALLOC();
 		}
@@ -275,6 +297,7 @@ PHPAPI php_url *php_url_parse_ex2(char const *str, size_t length, bool *has_port
 		p++;
 		if (p < e) {
 			ret->query = zend_string_init(p, (e - p), 0);
+			php_replace_controlchars(ZSTR_VAL(ret->query), ZSTR_LEN(ret->query));
 		} else {
 			ret->query = ZSTR_EMPTY_ALLOC();
 		}
@@ -283,6 +306,7 @@ PHPAPI php_url *php_url_parse_ex2(char const *str, size_t length, bool *has_port
 
 	if (s < e || s == ue) {
 		ret->path = zend_string_init(s, (e - s), 0);
+		php_replace_controlchars(ZSTR_VAL(ret->path), ZSTR_LEN(ret->path));
 	}
 
 	return ret;