Repository navigation
Make the putenv adapter null-byte safe - #603
Merged
Merged
Conversation
GrahamCampbell
force-pushed
the
fix/putenv-null-byte-safety
branch
from
August 24, 2026 01:01
1c34d13 to
488f91e
Compare
GrahamCampbell
force-pushed
the
fix/utf8-name-validation-modifier
branch
from
August 24, 2026 10:42
b3d755d to
cc880ae
Compare
GrahamCampbell
force-pushed
the
fix/putenv-null-byte-safety
branch
2 times, most recently
from
August 24, 2026 13:22
d0a2385 to
8fdf977
Compare
GrahamCampbell
force-pushed
the
fix/utf8-name-validation-modifier
branch
from
August 24, 2026 17:28
558a54a to
5249b62
Compare
GrahamCampbell
force-pushed
the
fix/putenv-null-byte-safety
branch
from
August 24, 2026 17:28
8fdf977 to
979a77d
Compare
GrahamCampbell
force-pushed
the
fix/utf8-name-validation-modifier
branch
from
August 24, 2026 17:43
5249b62 to
1c2769e
Compare
GrahamCampbell
force-pushed
the
fix/putenv-null-byte-safety
branch
from
August 24, 2026 17:43
979a77d to
63d1654
Compare
GrahamCampbell
force-pushed
the
fix/putenv-null-byte-safety
branch
from
August 24, 2026 17:46
63d1654 to
6f2f014
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On PHP 8.6 putenv and getenv throw a ValueError when a name or value contains a null byte, and because the parser preserves null bytes and the repository name guard only rejects the empty string, such a byte reaches the putenv-backed adapter through a loaded file value or a direct set, get or clear call and crashes, uncaught, with safeLoad unable to suppress it. On earlier versions the same input is silently truncated at the null byte, which can quietly unset an unrelated variable. Guarding all three adapter methods against null bytes in the name, and the write against a null byte in the value, makes the operation simply fail, consistently across versions, matching the adapter's existing may-fail contract. This is stacked on #602 and is intended to land before v5.7.0 is tagged.