Summary
A query parameter written as info_hash[]=x is parsed by PHP into an array. The announce handler passes $_GET["info_hash"] straight to bin2hex(), which requires a string:
":hash" => htmlentities(bin2hex($_GET["info_hash"]), ENT_QUOTES),
On PHP 8 this is an uncaught TypeError (a fatal error; the absolute script path is disclosed when display_errors is on). On PHP 7 it is a warning and bin2hex() returns null. Any client can send the request.
Reproduce
curl -s "http://localhost/?info_hash[]=x"
Observed on PHP 8.4:
Fatal error: Uncaught TypeError: bin2hex(): Argument #1 ($string) must be of type string, array given in /var/www/html/index.php:39
On PHP 7.4: Warning: bin2hex() expects parameter 1 to be string, array given.
Fix
A PR follows that guards the parameter with is_string() and returns a bencoded Invalid request reply for non-string input, before it reaches bin2hex().
Found during a review of the codebase; part of the same review as #20.
Summary
A query parameter written as
info_hash[]=xis parsed by PHP into an array. The announce handler passes$_GET["info_hash"]straight tobin2hex(), which requires a string:On PHP 8 this is an uncaught
TypeError(a fatal error; the absolute script path is disclosed whendisplay_errorsis on). On PHP 7 it is a warning andbin2hex()returns null. Any client can send the request.Reproduce
curl -s "http://localhost/?info_hash[]=x"Observed on PHP 8.4:
On PHP 7.4:
Warning: bin2hex() expects parameter 1 to be string, array given.Fix
A PR follows that guards the parameter with
is_string()and returns a bencodedInvalid requestreply for non-string input, before it reachesbin2hex().Found during a review of the codebase; part of the same review as #20.