SEC: Possible RCE when php module json off. +Warning in security page.

htdocs/admin/system/security.php

@@ -190,10 +190,10 @@ print '<br>';
 print '<strong>JSON</strong>: ';
 $loadedExtensions    = array_map('strtolower', get_loaded_extensions(false));
 $test = !in_array('json', $loadedExtensions);
-if ($test) {
+if ($test || function_exists('dol_json_decode')) {
 	print img_picto('', 'error').' '.$langs->trans("NotInstalled").' - '.$langs->trans("VulnerableToRCEAttack");
 } else {
-	print img_picto('', 'tick').' '.$langs->trans("Available");
+	print img_picto('', 'tick').' '.$langs->trans("Available").' <span class="opacitymedium">(PHP native so not emulated, safe)</span>';
 }
 print '<br>';
 

htdocs/core/lib/json.lib.php

@@ -25,21 +25,7 @@
  * 		\ingroup	core
  */
 
-if (!function_exists('json_encode')) {
+if (!function_exists('json_encode') || defined('PHPUNIT_MODE')) {
-	/**
-	 * Implement json_encode for PHP that does not have module enabled.
-	 *
-	 * @param	mixed	$elements		PHP Object to json encode
-	 * @return 	string					Json encoded string
-	 * @phan-suppress PhanRedefineFunctionInternal
-	 */
-	function json_encode($elements)
-	{
-		return dol_json_encode($elements);
-	}
-}
-
-
 	/**
 	 * Implement json_encode for PHP that does not support it.
 	 * Use json_encode and json_decode in your code !
@@ -228,21 +214,62 @@ function _val($val)
 		}
 	}
 
-if (!function_exists('json_decode')) {
+
 	/**
-	 * Implement json_decode for PHP that does not support it
+	 * Convert a string from one UTF-8 char to one UTF-16 char
 	 *
-	 * @param	string	$json		Json encoded to PHP Object or Array
+	 * Normally should be handled by mb_convert_encoding, but
-	 * @param	bool	$assoc		False return an object, true return an array
+	 * provides a slower PHP-only method for installations
-	 * @return 	mixed				Object or Array
+	 * that lack the multibyte string extension.
-	 * @phan-suppress PhanRedefineFunctionInternal
+	 *
+	 * @param    string  $utf8		UTF-8 character
+	 * @return   string  			UTF-16 character
 	 */
-	function json_decode($json, $assoc = false)
+	function utf82utf16($utf8)
 	{
-		return dol_json_decode($json, $assoc);
+		// oh please oh please oh please oh please oh please
+		if (function_exists('mb_convert_encoding')) {
+			return mb_convert_encoding($utf8, 'UTF-16', 'UTF-8');
+		}
+
+		switch (strlen($utf8)) {
+			case 1:
+				// this case should never be reached, because we are in ASCII range
+				// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
+				return $utf8;
+
+			case 2:
+				// return a UTF-16 character from a 2-byte UTF-8 char
+				// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
+				return chr(0x07 & (ord($utf8[0]) >> 2)).chr((0xC0 & (ord($utf8[0]) << 6)) | (0x3F & ord($utf8[1])));
+
+			case 3:
+				// return a UTF-16 character from a 3-byte UTF-8 char
+				// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
+				return chr((0xF0 & (ord($utf8[0]) << 4)) | (0x0F & (ord($utf8[1]) >> 2))).chr((0xC0 & (ord($utf8[1]) << 6)) | (0x7F & ord($utf8[2])));
+		}
+
+		// ignoring UTF-32 for now, sorry
+		return '';
 	}
 }
 
+if (!function_exists('json_encode')) {
+	/**
+	 * Implement json_encode for PHP that does not have module enabled.
+	 *
+	 * @param	mixed	$elements		PHP Object to json encode
+	 * @return 	string					Json encoded string
+	 * @phan-suppress PhanRedefineFunctionInternal
+	 */
+	function json_encode($elements)
+	{
+		return dol_json_encode($elements);
+	}
+}
+
+
+if (!function_exists('json_decode') || defined('PHPUNIT_MODE')) {
 	/**
 	 * Implement json_decode for PHP that does not support it
 	 * Use json_encode and json_decode in your code !
@@ -385,41 +412,19 @@ function utf162utf8($utf16)
 		// ignoring UTF-32 for now, sorry
 		return '';
 	}
+}
 
+if (!function_exists('json_decode')) {
 	/**
- * Convert a string from one UTF-8 char to one UTF-16 char
+	 * Implement json_decode for PHP that does not support it
 	 *
- * Normally should be handled by mb_convert_encoding, but
+	 * @param	string	$json		Json encoded to PHP Object or Array
- * provides a slower PHP-only method for installations
+	 * @param	bool	$assoc		False return an object, true return an array
- * that lack the multibyte string extension.
+	 * @return 	mixed				Object or Array
- *
+	 * @phan-suppress PhanRedefineFunctionInternal
- * @param    string  $utf8		UTF-8 character
- * @return   string  			UTF-16 character
 	 */
-function utf82utf16($utf8)
+	function json_decode($json, $assoc = false)
 	{
-	// oh please oh please oh please oh please oh please
+		return dol_json_decode($json, $assoc);
-	if (function_exists('mb_convert_encoding')) {
-		return mb_convert_encoding($utf8, 'UTF-16', 'UTF-8');
 	}
-
-	switch (strlen($utf8)) {
-		case 1:
-			// this case should never be reached, because we are in ASCII range
-			// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
-			return $utf8;
-
-		case 2:
-			// return a UTF-16 character from a 2-byte UTF-8 char
-			// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
-			return chr(0x07 & (ord($utf8[0]) >> 2)).chr((0xC0 & (ord($utf8[0]) << 6)) | (0x3F & ord($utf8[1])));
-
-		case 3:
-			// return a UTF-16 character from a 3-byte UTF-8 char
-			// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
-			return chr((0xF0 & (ord($utf8[0]) << 4)) | (0x0F & (ord($utf8[1]) >> 2))).chr((0xC0 & (ord($utf8[1]) << 6)) | (0x7F & ord($utf8[2])));
-	}
-
-	// ignoring UTF-32 for now, sorry
-	return '';
 }

test/phpunit/JsonLibTest.php

@@ -24,6 +24,8 @@
  *      \remarks    To run this script as CLI:  phpunit filename.php
  */
 
+define('PHPUNIT_MODE', 1);
+
 global $conf,$user,$langs,$db;
 //define('TEST_DB_FORCE_TYPE','mysql');	// This is to force using mysql driver
 //require_once 'PHPUnit/Autoload.php';