matomo-org / matomo-org/component-ini

[FREQ] decoding integer values doesn't allow for integer prefixes such as "0x"

Open
#29 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
51
Forks
24
PR merge metrics
No merged PRs in 30d

Description

The IniReader checks whether an integer will overflow by using:
```
return (string) ($value + 0) === $value;
```
However, that will not work when the value has leading zeroes or a leading plus sign or any other characters that would be silently ignored by PHP.

In addition, the `decode()` method converts from string to int by simply adding zero to the string. This is effectively equivalent to using an (int) cast, which doesn't account for a leading radix indicator, such as `0t`, `0x`, `0b`, and `0o` (or just a leading `0`).

Lastly, the methods that accomplish the above are all `private` which makes them impossible to override in PHP. I had to modify the private methods to be protected, so that a derived class could fix this deficiency.

I'm happy to package up my changes as a PR, if you wish.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the IniReader class and its integer overflow check and decode() method. Trace how strings with leading zeroes, signs, ignored characters, and radix indicators are handled, then inspect the private methods involved. Done means integer prefixes are decoded correctly, overflow validation rejects inappropriate input, and the relevant methods can be overridden by derived PHP classes.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.