matomo-org / matomo-org/component-ini
[FREQ] decoding integer values doesn't allow for integer prefixes such as "0x"
- Dominant language
- PHP
- Stars
- 51
- Forks
- 24
- PR merge metrics
- No merged PRs in 30d
Description
The IniReader checks whether an integer will overflow by using:
```
return (string) ($value + 0) === $value;
```
However, that will not work when the value has leading zeroes or a leading plus sign or any other characters that would be silently ignored by PHP.
In addition, the `decode()` method converts from string to int by simply adding zero to the string. This is effectively equivalent to using an (int) cast, which doesn't account for a leading radix indicator, such as `0t`, `0x`, `0b`, and `0o` (or just a leading `0`).
Lastly, the methods that accomplish the above are all `private` which makes them impossible to override in PHP. I had to modify the private methods to be protected, so that a derived class could fix this deficiency.
I'm happy to package up my changes as a PR, if you wish.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the IniReader class and its integer overflow check and decode() method. Trace how strings with leading zeroes, signs, ignored characters, and radix indicators are handled, then inspect the private methods involved. Done means integer prefixes are decoded correctly, overflow validation rejects inappropriate input, and the relevant methods can be overridden by derived PHP classes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100