Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-16 14:31:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

SEC: Possible RCE when php module json off. +Warning in security page.

Browse Source
This commit is contained in:
Laurent Destailleur
2024-07-12 01:43:53 +02:00
parent 263c1e5445
commit d3ebd3fbe7
3 changed files with 363 additions and 356 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/admin/system/security.php
View File

@@ -190,10 +190,10 @@ print '<br>';
print '<strong>JSON</strong>: ';
$loadedExtensions = array_map('strtolower', get_loaded_extensions(false));
$test = !in_array('json', $loadedExtensions);
if ($test) {
if ($test || function_exists('dol_json_decode')) {
print img_picto('', 'error').' '.$langs->trans("NotInstalled").' - '.$langs->trans("VulnerableToRCEAttack");
} else {
print img_picto('', 'tick').' '.$langs->trans("Available");
print img_picto('', 'tick').' '.$langs->trans("Available").' <span class="opacitymedium">(PHP native so not emulated, safe)</span>';
}
print '<br>';

113
htdocs/core/lib/json.lib.php
View File

@@ -25,21 +25,7 @@
* \ingroup core
*/
if (!function_exists('json_encode')) {
/**
* Implement json_encode for PHP that does not have module enabled.
*
* @param mixed $elements PHP Object to json encode
* @return string Json encoded string
* @phan-suppress PhanRedefineFunctionInternal
*/
function json_encode($elements)
{
return dol_json_encode($elements);
}
}
if (!function_exists('json_encode') || defined('PHPUNIT_MODE')) {
/**
* Implement json_encode for PHP that does not support it.
* Use json_encode and json_decode in your code !
@@ -228,21 +214,62 @@ function _val($val)
}
}
if (!function_exists('json_decode')) {
/**
* Implement json_decode for PHP that does not support it
* Convert a string from one UTF-8 char to one UTF-16 char
*
* @param string $json Json encoded to PHP Object or Array
* @param bool $assoc False return an object, true return an array
* @return mixed Object or Array
* @phan-suppress PhanRedefineFunctionInternal
* Normally should be handled by mb_convert_encoding, but
* provides a slower PHP-only method for installations
* that lack the multibyte string extension.
*
* @param string $utf8 UTF-8 character
* @return string UTF-16 character
*/
function json_decode($json, $assoc = false)
function utf82utf16($utf8)
{
return dol_json_decode($json, $assoc);
// oh please oh please oh please oh please oh please
if (function_exists('mb_convert_encoding')) {
return mb_convert_encoding($utf8, 'UTF-16', 'UTF-8');
}
switch (strlen($utf8)) {
case 1:
// this case should never be reached, because we are in ASCII range
// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
return $utf8;
case 2:
// return a UTF-16 character from a 2-byte UTF-8 char
// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
return chr(0x07 & (ord($utf8[0]) >> 2)).chr((0xC0 & (ord($utf8[0]) << 6)) | (0x3F & ord($utf8[1])));
case 3:
// return a UTF-16 character from a 3-byte UTF-8 char
// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
return chr((0xF0 & (ord($utf8[0]) << 4)) | (0x0F & (ord($utf8[1]) >> 2))).chr((0xC0 & (ord($utf8[1]) << 6)) | (0x7F & ord($utf8[2])));
}
// ignoring UTF-32 for now, sorry
return '';
}
}
if (!function_exists('json_encode')) {
/**
* Implement json_encode for PHP that does not have module enabled.
*
* @param mixed $elements PHP Object to json encode
* @return string Json encoded string
* @phan-suppress PhanRedefineFunctionInternal
*/
function json_encode($elements)
{
return dol_json_encode($elements);
}
}
if (!function_exists('json_decode') || defined('PHPUNIT_MODE')) {
/**
* Implement json_decode for PHP that does not support it
* Use json_encode and json_decode in your code !
@@ -385,41 +412,19 @@ function utf162utf8($utf16)
// ignoring UTF-32 for now, sorry
return '';
}
}
if (!function_exists('json_decode')) {
/**
* Convert a string from one UTF-8 char to one UTF-16 char
* Implement json_decode for PHP that does not support it
*
* Normally should be handled by mb_convert_encoding, but
* provides a slower PHP-only method for installations
* that lack the multibyte string extension.
*
* @param string $utf8 UTF-8 character
* @return string UTF-16 character
* @param string $json Json encoded to PHP Object or Array
* @param bool $assoc False return an object, true return an array
* @return mixed Object or Array
* @phan-suppress PhanRedefineFunctionInternal
*/
function utf82utf16($utf8)
function json_decode($json, $assoc = false)
{
// oh please oh please oh please oh please oh please
if (function_exists('mb_convert_encoding')) {
return mb_convert_encoding($utf8, 'UTF-16', 'UTF-8');
return dol_json_decode($json, $assoc);
}
switch (strlen($utf8)) {
case 1:
// this case should never be reached, because we are in ASCII range
// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
return $utf8;
case 2:
// return a UTF-16 character from a 2-byte UTF-8 char
// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
return chr(0x07 & (ord($utf8[0]) >> 2)).chr((0xC0 & (ord($utf8[0]) << 6)) | (0x3F & ord($utf8[1])));
case 3:
// return a UTF-16 character from a 3-byte UTF-8 char
// see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
return chr((0xF0 & (ord($utf8[0]) << 4)) | (0x0F & (ord($utf8[1]) >> 2))).chr((0xC0 & (ord($utf8[1]) << 6)) | (0x7F & ord($utf8[2])));
}
// ignoring UTF-32 for now, sorry
return '';
}

2
test/phpunit/JsonLibTest.php
View File

@@ -24,6 +24,8 @@
* \remarks To run this script as CLI: phpunit filename.php
*/
define('PHPUNIT_MODE', 1);
global $conf,$user,$langs,$db;
//define('TEST_DB_FORCE_TYPE','mysql'); // This is to force using mysql driver
//require_once 'PHPUnit/Autoload.php';