{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/hhvm/issues/7410","repository_url":"https://api.github.com/repos/facebook/hhvm","labels_url":"https://api.github.com/repos/facebook/hhvm/issues/7410/labels{/name}","comments_url":"https://api.github.com/repos/facebook/hhvm/issues/7410/comments","events_url":"https://api.github.com/repos/facebook/hhvm/issues/7410/events","html_url":"https://github.com/facebook/hhvm/issues/7410","id":181805642,"number":7410,"title":"Hack uses PHP's broken rules for string comparison","user":{"login":"DemiMarie","id":6395399,"avatar_url":"https://avatars.githubusercontent.com/u/6395399?v=3","gravatar_id":"","url":"https://api.github.com/users/DemiMarie","html_url":"https://github.com/DemiMarie","followers_url":"https://api.github.com/users/DemiMarie/followers","following_url":"https://api.github.com/users/DemiMarie/following{/other_user}","gists_url":"https://api.github.com/users/DemiMarie/gists{/gist_id}","starred_url":"https://api.github.com/users/DemiMarie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DemiMarie/subscriptions","organizations_url":"https://api.github.com/users/DemiMarie/orgs","repos_url":"https://api.github.com/users/DemiMarie/repos","events_url":"https://api.github.com/users/DemiMarie/events{/privacy}","received_events_url":"https://api.github.com/users/DemiMarie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-10-08T05:21:47Z","updated_at":"2016-10-08T18:42:32Z","closed_at":null,"body":"### HHVM Version\r\n3.10.0 - 3.14.4\r\n### Standalone code, or other way to reproduce the problem\r\n```hack\r\n<?hh // STRICT\r\nfunction main() {\r\n   var_dump(\"123\" < \"0124\");\r\n}\r\nmain();\r\n```\r\n### Expected result\r\nHack, unlike PHP, compares strings correctly, so that the result is `bool(false)`.\r\n### Actual result\r\nHack uses PHP's [broken][1] rules for string comparisons, so the result is `bool(true)`.  This can [lead to vulnerabilities][2].\r\n\r\n[1]: https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/\r\n[2]: http://phpsadness.com/sad/47"},"comment":{"url":"https://api.github.com/repos/facebook/hhvm/issues/comments/252441137","html_url":"https://github.com/facebook/hhvm/issues/7410#issuecomment-252441137","issue_url":"https://api.github.com/repos/facebook/hhvm/issues/7410","id":252441137,"user":{"login":"photodude","id":10253980,"avatar_url":"https://avatars.githubusercontent.com/u/10253980?v=3","gravatar_id":"","url":"https://api.github.com/users/photodude","html_url":"https://github.com/photodude","followers_url":"https://api.github.com/users/photodude/followers","following_url":"https://api.github.com/users/photodude/following{/other_user}","gists_url":"https://api.github.com/users/photodude/gists{/gist_id}","starred_url":"https://api.github.com/users/photodude/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/photodude/subscriptions","organizations_url":"https://api.github.com/users/photodude/orgs","repos_url":"https://api.github.com/users/photodude/repos","events_url":"https://api.github.com/users/photodude/events{/privacy}","received_events_url":"https://api.github.com/users/photodude/received_events","type":"User","site_admin":false},"created_at":"2016-10-08T18:42:32Z","updated_at":"2016-10-08T18:42:32Z","body":"Is this really a thing??? The example in the [link claiming string comparison \"vulnerabilities\"](http://phpsadness.com/sad/47) may apply to really old php versions (versions before php 5.4) but definitely doesn't apply to php 5.4.4+ see live code example https://3v4l.org/rVWZq\r\n\r\nAs for the other [link from a 2012 article regarding all kinds of php issues relating to broken rules for string comparisons](https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/), almost everything is relating to stuff before php 5.4 and much was fixed in php 5.4 (also noted in the article that it was fixed). \r\n\r\nAs for the provided code example, this might be an edge case in both php and hack where expected is false (python returns false `print ('123' < '0123')` but c++ considers `\"123\" < \"0124\"` to be true ) but PHP and hack are returning true.  Since hack is, and I think php might be,  c++ based I'm not surprised that c++, php, and hack all consider `\"123\" < \"0124\"` to be true. "}}
{"actor":{"display_login":"photodude"}}