mirror of
https://github.com/PrivateBin/PrivateBin.git
synced 2026-07-19 09:25:08 +00:00
Under strict_types on PHP 8, malformed JSON API v2 payloads triggered
uncaught TypeErrors (HTTP 500) instead of the standard JSON error
response {"status":1,"message":"Invalid data."}:
- a non-numeric `v` reached `$data['v'] + 0` in Request::getData()
- a scalar `meta` reached `count($message['meta'])` in FormatV2::isValid()
- non-array adata[0] / non-string ct fields reached base64_decode(),
strlen() and count() with the wrong types
Validate the types before the numeric coercion and before the
string/count operations, so all such inputs are rejected cleanly with
"Invalid data." instead of a fatal error. Both crashes are remotely
triggerable without authentication (availability only, no data exposure).
Adds FormatV2Test coverage for the malformed-type inputs.
Fixes #1883
|
||
|---|---|---|
| .. | ||
| Data | ||
| Exception | ||
| Model | ||
| Persistence | ||
| Proxy | ||
| .htaccess | ||
| Configuration.php | ||
| Controller.php | ||
| Filter.php | ||
| FormatV2.php | ||
| I18n.php | ||
| Json.php | ||
| Model.php | ||
| Request.php | ||
| TemplateSwitcher.php | ||
| View.php | ||
| Vizhash16x16.php | ||