{"action":"reopened","number":193,"pull_request":{"url":"https://api.github.com/repos/zendframework/zend-form/pulls/193","id":164875331,"html_url":"https://github.com/zendframework/zend-form/pull/193","diff_url":"https://github.com/zendframework/zend-form/pull/193.diff","patch_url":"https://github.com/zendframework/zend-form/pull/193.patch","issue_url":"https://api.github.com/repos/zendframework/zend-form/issues/193","number":193,"state":"open","locked":false,"title":"Prevent AbstractHelper from attempting to output malformed user input","user":{"login":"Saeven","id":887224,"avatar_url":"https://avatars0.githubusercontent.com/u/887224?v=4","gravatar_id":"","url":"https://api.github.com/users/Saeven","html_url":"https://github.com/Saeven","followers_url":"https://api.github.com/users/Saeven/followers","following_url":"https://api.github.com/users/Saeven/following{/other_user}","gists_url":"https://api.github.com/users/Saeven/gists{/gist_id}","starred_url":"https://api.github.com/users/Saeven/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Saeven/subscriptions","organizations_url":"https://api.github.com/users/Saeven/orgs","repos_url":"https://api.github.com/users/Saeven/repos","events_url":"https://api.github.com/users/Saeven/events{/privacy}","received_events_url":"https://api.github.com/users/Saeven/received_events","type":"User","site_admin":false},"body":"Before this PR, malformed UTF8 submitted to a Zend Form causes the form helper to throw a 500 post-submission.  This PR and its test eliminates these errors, by silently removing attack input during the print cycle.\r\n\r\nTest added to demonstrate how a simple invalid 2 octet sequence can cause an exception (which then causes your server to 500).\r\n\r\nNote that under current behavior, the helper will still throw the error despite all Filter and Validator implementations.  A full test case that demonstrates this is available here:  https://github.com/Saeven/zendframework-form-failure\r\n\r\nA change is necessary to prevent routine penetration tests, or user-land attacks from causing critical exceptions.  Users shouldn't be able to craft malicious input that causes 500s.\r\n\r\nThank you for considering this PR.","created_at":"2018-01-24T15:13:35Z","updated_at":"2018-02-01T17:02:30Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d1b7d7bc1eef7fb996deafb8a9ebb6fe51b25e02","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"milestone":null,"commits_url":"https://api.github.com/repos/zendframework/zend-form/pulls/193/commits","review_comments_url":"https://api.github.com/repos/zendframework/zend-form/pulls/193/comments","review_comment_url":"https://api.github.com/repos/zendframework/zend-form/pulls/comments{/number}","comments_url":"https://api.github.com/repos/zendframework/zend-form/issues/193/comments","statuses_url":"https://api.github.com/repos/zendframework/zend-form/statuses/d0378a356c52d83d107e3ff24dd6b4dd73dc0303","head":{"label":"Saeven:master","ref":"master","sha":"d0378a356c52d83d107e3ff24dd6b4dd73dc0303","user":{"login":"Saeven","id":887224,"avatar_url":"https://avatars0.githubusercontent.com/u/887224?v=4","gravatar_id":"","url":"https://api.github.com/users/Saeven","html_url":"https://github.com/Saeven","followers_url":"https://api.github.com/users/Saeven/followers","following_url":"https://api.github.com/users/Saeven/following{/other_user}","gists_url":"https://api.github.com/users/Saeven/gists{/gist_id}","starred_url":"https://api.github.com/users/Saeven/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Saeven/subscriptions","organizations_url":"https://api.github.com/users/Saeven/orgs","repos_url":"https://api.github.com/users/Saeven/repos","events_url":"https://api.github.com/users/Saeven/events{/privacy}","received_events_url":"https://api.github.com/users/Saeven/received_events","type":"User","site_admin":false},"repo":{"id":118776443,"name":"zend-form","full_name":"Saeven/zend-form","owner":{"login":"Saeven","id":887224,"avatar_url":"https://avatars0.githubusercontent.com/u/887224?v=4","gravatar_id":"","url":"https://api.github.com/users/Saeven","html_url":"https://github.com/Saeven","followers_url":"https://api.github.com/users/Saeven/followers","following_url":"https://api.github.com/users/Saeven/following{/other_user}","gists_url":"https://api.github.com/users/Saeven/gists{/gist_id}","starred_url":"https://api.github.com/users/Saeven/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Saeven/subscriptions","organizations_url":"https://api.github.com/users/Saeven/orgs","repos_url":"https://api.github.com/users/Saeven/repos","events_url":"https://api.github.com/users/Saeven/events{/privacy}","received_events_url":"https://api.github.com/users/Saeven/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/Saeven/zend-form","description":"Form component from Zend Framework","fork":true,"url":"https://api.github.com/repos/Saeven/zend-form","forks_url":"https://api.github.com/repos/Saeven/zend-form/forks","keys_url":"https://api.github.com/repos/Saeven/zend-form/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Saeven/zend-form/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Saeven/zend-form/teams","hooks_url":"https://api.github.com/repos/Saeven/zend-form/hooks","issue_events_url":"https://api.github.com/repos/Saeven/zend-form/issues/events{/number}","events_url":"https://api.github.com/repos/Saeven/zend-form/events","assignees_url":"https://api.github.com/repos/Saeven/zend-form/assignees{/user}","branches_url":"https://api.github.com/repos/Saeven/zend-form/branches{/branch}","tags_url":"https://api.github.com/repos/Saeven/zend-form/tags","blobs_url":"https://api.github.com/repos/Saeven/zend-form/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Saeven/zend-form/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Saeven/zend-form/git/refs{/sha}","trees_url":"https://api.github.com/repos/Saeven/zend-form/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Saeven/zend-form/statuses/{sha}","languages_url":"https://api.github.com/repos/Saeven/zend-form/languages","stargazers_url":"https://api.github.com/repos/Saeven/zend-form/stargazers","contributors_url":"https://api.github.com/repos/Saeven/zend-form/contributors","subscribers_url":"https://api.github.com/repos/Saeven/zend-form/subscribers","subscription_url":"https://api.github.com/repos/Saeven/zend-form/subscription","commits_url":"https://api.github.com/repos/Saeven/zend-form/commits{/sha}","git_commits_url":"https://api.github.com/repos/Saeven/zend-form/git/commits{/sha}","comments_url":"https://api.github.com/repos/Saeven/zend-form/comments{/number}","issue_comment_url":"https://api.github.com/repos/Saeven/zend-form/issues/comments{/number}","contents_url":"https://api.github.com/repos/Saeven/zend-form/contents/{+path}","compare_url":"https://api.github.com/repos/Saeven/zend-form/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Saeven/zend-form/merges","archive_url":"https://api.github.com/repos/Saeven/zend-form/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Saeven/zend-form/downloads","issues_url":"https://api.github.com/repos/Saeven/zend-form/issues{/number}","pulls_url":"https://api.github.com/repos/Saeven/zend-form/pulls{/number}","milestones_url":"https://api.github.com/repos/Saeven/zend-form/milestones{/number}","notifications_url":"https://api.github.com/repos/Saeven/zend-form/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Saeven/zend-form/labels{/name}","releases_url":"https://api.github.com/repos/Saeven/zend-form/releases{/id}","deployments_url":"https://api.github.com/repos/Saeven/zend-form/deployments","created_at":"2018-01-24T14:30:39Z","updated_at":"2018-01-24T14:30:41Z","pushed_at":"2018-01-24T15:25:16Z","git_url":"git://github.com/Saeven/zend-form.git","ssh_url":"git@github.com:Saeven/zend-form.git","clone_url":"https://github.com/Saeven/zend-form.git","svn_url":"https://github.com/Saeven/zend-form","homepage":"https://docs.zendframework.com/zend-form/","size":6610,"stargazers_count":0,"watchers_count":0,"language":"PHP","has_issues":false,"has_projects":true,"has_downloads":false,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"zendframework:master","ref":"master","sha":"48b028418ae413d44cf14d3d8b74a33b2c82a437","user":{"login":"zendframework","id":296074,"avatar_url":"https://avatars2.githubusercontent.com/u/296074?v=4","gravatar_id":"","url":"https://api.github.com/users/zendframework","html_url":"https://github.com/zendframework","followers_url":"https://api.github.com/users/zendframework/followers","following_url":"https://api.github.com/users/zendframework/following{/other_user}","gists_url":"https://api.github.com/users/zendframework/gists{/gist_id}","starred_url":"https://api.github.com/users/zendframework/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zendframework/subscriptions","organizations_url":"https://api.github.com/users/zendframework/orgs","repos_url":"https://api.github.com/users/zendframework/repos","events_url":"https://api.github.com/users/zendframework/events{/privacy}","received_events_url":"https://api.github.com/users/zendframework/received_events","type":"Organization","site_admin":false},"repo":{"id":35280804,"name":"zend-form","full_name":"zendframework/zend-form","owner":{"login":"zendframework","id":296074,"avatar_url":"https://avatars2.githubusercontent.com/u/296074?v=4","gravatar_id":"","url":"https://api.github.com/users/zendframework","html_url":"https://github.com/zendframework","followers_url":"https://api.github.com/users/zendframework/followers","following_url":"https://api.github.com/users/zendframework/following{/other_user}","gists_url":"https://api.github.com/users/zendframework/gists{/gist_id}","starred_url":"https://api.github.com/users/zendframework/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zendframework/subscriptions","organizations_url":"https://api.github.com/users/zendframework/orgs","repos_url":"https://api.github.com/users/zendframework/repos","events_url":"https://api.github.com/users/zendframework/events{/privacy}","received_events_url":"https://api.github.com/users/zendframework/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/zendframework/zend-form","description":"Form component from Zend Framework","fork":false,"url":"https://api.github.com/repos/zendframework/zend-form","forks_url":"https://api.github.com/repos/zendframework/zend-form/forks","keys_url":"https://api.github.com/repos/zendframework/zend-form/keys{/key_id}","collaborators_url":"https://api.github.com/repos/zendframework/zend-form/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/zendframework/zend-form/teams","hooks_url":"https://api.github.com/repos/zendframework/zend-form/hooks","issue_events_url":"https://api.github.com/repos/zendframework/zend-form/issues/events{/number}","events_url":"https://api.github.com/repos/zendframework/zend-form/events","assignees_url":"https://api.github.com/repos/zendframework/zend-form/assignees{/user}","branches_url":"https://api.github.com/repos/zendframework/zend-form/branches{/branch}","tags_url":"https://api.github.com/repos/zendframework/zend-form/tags","blobs_url":"https://api.github.com/repos/zendframework/zend-form/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/zendframework/zend-form/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/zendframework/zend-form/git/refs{/sha}","trees_url":"https://api.github.com/repos/zendframework/zend-form/git/trees{/sha}","statuses_url":"https://api.github.com/repos/zendframework/zend-form/statuses/{sha}","languages_url":"https://api.github.com/repos/zendframework/zend-form/languages","stargazers_url":"https://api.github.com/repos/zendframework/zend-form/stargazers","contributors_url":"https://api.github.com/repos/zendframework/zend-form/contributors","subscribers_url":"https://api.github.com/repos/zendframework/zend-form/subscribers","subscription_url":"https://api.github.com/repos/zendframework/zend-form/subscription","commits_url":"https://api.github.com/repos/zendframework/zend-form/commits{/sha}","git_commits_url":"https://api.github.com/repos/zendframework/zend-form/git/commits{/sha}","comments_url":"https://api.github.com/repos/zendframework/zend-form/comments{/number}","issue_comment_url":"https://api.github.com/repos/zendframework/zend-form/issues/comments{/number}","contents_url":"https://api.github.com/repos/zendframework/zend-form/contents/{+path}","compare_url":"https://api.github.com/repos/zendframework/zend-form/compare/{base}...{head}","merges_url":"https://api.github.com/repos/zendframework/zend-form/merges","archive_url":"https://api.github.com/repos/zendframework/zend-form/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/zendframework/zend-form/downloads","issues_url":"https://api.github.com/repos/zendframework/zend-form/issues{/number}","pulls_url":"https://api.github.com/repos/zendframework/zend-form/pulls{/number}","milestones_url":"https://api.github.com/repos/zendframework/zend-form/milestones{/number}","notifications_url":"https://api.github.com/repos/zendframework/zend-form/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/zendframework/zend-form/labels{/name}","releases_url":"https://api.github.com/repos/zendframework/zend-form/releases{/id}","deployments_url":"https://api.github.com/repos/zendframework/zend-form/deployments","created_at":"2015-05-08T13:27:59Z","updated_at":"2018-01-15T15:24:12Z","pushed_at":"2018-01-24T15:25:17Z","git_url":"git://github.com/zendframework/zend-form.git","ssh_url":"git@github.com:zendframework/zend-form.git","clone_url":"https://github.com/zendframework/zend-form.git","svn_url":"https://github.com/zendframework/zend-form","homepage":"https://docs.zendframework.com/zend-form/","size":6756,"stargazers_count":40,"watchers_count":40,"language":"PHP","has_issues":true,"has_projects":true,"has_downloads":false,"has_wiki":false,"has_pages":true,"forks_count":74,"mirror_url":null,"archived":false,"open_issues_count":54,"license":{"key":"other","name":"Other","spdx_id":null,"url":null},"forks":74,"open_issues":54,"watchers":40,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/zendframework/zend-form/pulls/193"},"html":{"href":"https://github.com/zendframework/zend-form/pull/193"},"issue":{"href":"https://api.github.com/repos/zendframework/zend-form/issues/193"},"comments":{"href":"https://api.github.com/repos/zendframework/zend-form/issues/193/comments"},"review_comments":{"href":"https://api.github.com/repos/zendframework/zend-form/pulls/193/comments"},"review_comment":{"href":"https://api.github.com/repos/zendframework/zend-form/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/zendframework/zend-form/pulls/193/commits"},"statuses":{"href":"https://api.github.com/repos/zendframework/zend-form/statuses/d0378a356c52d83d107e3ff24dd6b4dd73dc0303"}},"author_association":"NONE","merged":false,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":null,"comments":4,"review_comments":0,"maintainer_can_modify":true,"commits":3,"additions":14,"deletions":1,"changed_files":2}}
{"actor":{"display_login":"Ocramius"}}