Some of the old PHP string functions for example
explode() are working with UTF-8 strings, but they don't work properly on malformed UTF-8 strings. Is this a security issue? Is it possible to avoid string validation with malformed UTF-8 strings somehow?
It is hard to make a list of this functions. I think every core PHP string function is affected somehow. For example strpos does not give the right position in a string, strlen, does not give the right length. So I guess htmlentities, htmlspecialchars, etc... are affected as well, but it is more complicated, because some of them has an UTF-8 flag, some of them is not UTF-8 compatible, like strpos, some of them does not work with malformed UTF-8, etc... I can do a search after I have a working example, so that's what I am looking for.
It is enough for me for instance something like:
- send 2 malformed string to the server, which in theory I cannot check with these functions
- concat them with implode, and get something malicious, for example XSS.
Is this possible? I don't understand fully how UTF-8 or how malformed UTF-8 works...