I ran into an issue with RodsWiki (depends on PRODS) where getting the children of a collection containing a collection with invalid UTF-8 in its name results in an unhandled exception.
It seems that someone somehow got a 0byte collection with invalid characters in its name into our iRODS collection. The relevant part of the call stack provided by XDebug is
Warning: SimpleXMLElement::__construct(): Entity: line 9: parser error : Input is not proper UTF-8, indicate encoding ! Bytes: 0x92 0x39 0x01 0x3C in C:\xampp\htdocs\mediawiki\extensions\RodsWiki\irods\RODSMessage.class.php on line 140
| # |
function |
location |
| 08. |
ProdsDir->getChildDirs( ???, ???, ???, ??? ) |
..\SpecialIrodsCollectionBrowser.php:43 |
| 09. |
ProdsDir->findDirs( array(2), long, long, long, array(0) ) |
..\ProdsDir.class.php:182 |
| 10. |
RODSConn->query( object(RODSGenQueSelFlds)[110], object(RODSGenQueConds)[108], long, long ) |
..\ProdsDir.class.php:708 |
| 11. |
RODSMessage->unpack( resource(144, stream), ??? ) |
..\RODSConn.class.php:1579 |
| 12. |
RODSMessage->parseBodyXML( string(4770) ) |
..\RODSMessage.class.php:97 |
| 13. |
__construct ( string(4770) ) |
..\RODSMessage.class.php:140 |
"string(4770)" refers to a string of length 4770. I have confirmed that It contains invalid UTF-8 characters.
While the invalid character issue is merely an annoyance, I'm concerned that this represents a possible vector for XSS attacks. I'm not sure where the burden of sanitization should go, but sanitizing it in irods-php when data is retrieved from an iRODS server seems like good practice to me. I'm not yet familiar enough with irods-php to implement that myself, though.
I ran into an issue with RodsWiki (depends on PRODS) where getting the children of a collection containing a collection with invalid UTF-8 in its name results in an unhandled exception.
It seems that someone somehow got a 0byte collection with invalid characters in its name into our iRODS collection. The relevant part of the call stack provided by XDebug is
"string(4770)" refers to a string of length 4770. I have confirmed that It contains invalid UTF-8 characters.
While the invalid character issue is merely an annoyance, I'm concerned that this represents a possible vector for XSS attacks. I'm not sure where the burden of sanitization should go, but sanitizing it in irods-php when data is retrieved from an iRODS server seems like good practice to me. I'm not yet familiar enough with irods-php to implement that myself, though.