Category: bug

An interesting bug in ReflectionParameter object in PHP 5.2.1

·

I came across an interesting bug last night. I searched for the reference and found that Sebastian Bergman reported quite similar bug in 11 Jun 2005 (Bug # 33312) which is currently marked as closed. I tested that bug reported by Sebastian and well, its fixed.

But there is still the following bug alive in ReflectionParameter object, I tested it against the PHP version 5.2.1 . So what is this bug? The reflection parameter cannot retrieve the default value of a parameter if the next parameter has no default value. PHP simply omits all the variables before that variable and return only values after that variable (I am sorry for my poor english). To regenerate the bug, you can execute the following script

[sourcecode language=”php”]
<?
class TestClass
{
public function __construct($a , $b=6 , $c = "hh", $d, $e=76)
{

}
}

$class = new ReflectionClass("TestClass");
$method= $class-&gt;getMethod("__construct");
$parameter = $method-&gt;getParameters();

foreach ($parameter as $param)
{
if ($param-&gt;isDefaultValueAvailable())
{
if (is_null($param-&gt;getDefaultValue()))
echo $param-&gt;getName()." : null \n";
else
echo $param-&gt;getName()." : ".$param-&gt;getDefaultValue()."\n";
}
}
?>
[/sourcecode]

The above code returns only “e : 76” which is definitely not the expected value. And if you modify the TestClass like below

[sourcecode language=”php”]
class TestClass
{
public function __construct($a = "1", $b , $c = "string", $e=76)
{

}
}
[/sourcecode]

it will output
c : string
e : 76

Its a bug, right? I donno if already reported! And I didn’t test it in 5.2.2 but i guess it’s still there.

Vulnerable bug in CodeIgniter which took us hours to fix our corrupted database

·

We use codeigniter internally to develop our web solutions in somewhere in… net limited. Day before yesterday we suffered a terrible situation for an internal bug in code igniter which corrupted data inside some tables of our application database and then it tooks hours to find the origin of that bug, to fix it and to repair the corrupted data. Let me explain what happened.

Lets guess that we have one table named “users” with the following field

1. user_id
2. username
3. password
4. email

At some point, if you want to update the password field of this table, for a particular user, what will you write in your code?


$data = array("password"=>$new_password);
$this->db->where("user_id",$user_id);
$this->db->update("users", $data);

CodeIgniter’s ActiveRecord creates the query like the following

UPDATE users set password='{$new_password}’ where user_id='{$user_id}’;

Well, it’s ok and the quesry seems pretty fine. Now what should happen if you pass a valid user id to this code? Password of only that user will be updated. But what will happen when the passed $user_id is null?? Thats the most pathetic part that Codeigniter ActiveRecord plays. Instead of generating the following query,

UPDATE users set password='{$new_password}’ where user_id=”;

CodeIgniter’s ORM actually generates the following

UPDATE users set password='{$new_password}’ where user_id;

You find the difference of the above two queries right? one contains “where user_id=” ” and another contains just “where user_id” . Now if your backend database is MySQL and this query executes? You know what the hell will happen? It will replace all the user’s password with this new password instead of failing as MySQL count the “where user_id” part equals to false and returns all users. But If your Database is PostgreSQL, it fails, you are lucky.

So day before yesterday we suffered this problem against our commercial application which corrupts our user profile data. We immediate fixed the issue from our backup db (well, we lost 3 data) and then we started to find out what actually went wrong and found this vulnerable bug in CI.

So we suggest the CodeIgniter team to fix the issue immediately and change their ORM code so that it creates the query like the following if the value of passed argument is null. because it will fail to execute in all db. Otherwise the fellow user’s of code igniter, prepare for the dooms day.

UPDATE users set password='{$new_password}’ where user_id=”;