Escaping not handling utf8 chars when mbstring.func_overload activated

[semos]

In line 252 of file Zend/Escaper/Escaper.php, we have :

if (strlen($chr) > 1) {

But with mbstring.func_overload set to 2, 6 or 7, it must use mb_orig_strlen to know if it is a multi-bytes character or not.

If it doesn't, the hex and ord values are based on UTF-8 value, for example C3A9 for a "é" and gets converted to &#xC3A9 instead of &#xE9 :

if (strlen($chr) > 1) { //We never enter there
        $chr = $this->convertEncoding($chr, 'UTF-16BE', 'UTF-8');
}
$hex = bin2hex($chr);
$ord = hexdec($hex);

The problem is present with the mail() function too, and prevented us to send multi-part emails, I'm going to fill a report for this.

[Ocramius]

@semos you just filled a report on this, but can you eventually provide a patch?

[Ocramius]

@padraic can you check this one?

[semos]

@Ocramius, I'm not 100% sure not to introduce regressions with this patch, as it depends of server configuration.
I'll try to do it tomorrow.

[sasezaki]

@semos @Ocramius
We already discussed about mbstring.func_overload.
http://zend-framework-community.634137.n4.nabble.com/Environment-amp-StringUtils-td4559272.html#a4564914
And in conclusion, mbstring.func_overload = Off is a requirement for ZF2.

[Ocramius]

@sasezaki should we throw an exception in the escaper then?

[sasezaki]

@Ocramius You mean when mbstring.func_overload is not off ?

[Ocramius]

Correct. We should prevent misuse of the escaper if it doesn't support a particular environment.

[sasezaki]

mbstring.func_overload = on is indeed particular environment, but it's mostly near "register_globals".
So, I prefer checking environment when installing (if composer - pre-install-cmd etc)

[Ocramius]

@sasezaki just checked: we can't run install scripts except for in the root package... not viable.

[sasezaki]

@Ocramius okay, throwing an Exception is right.

[GeeH]

This issue has been closed as part of the bug migration program as outlined here - http://framework.zend.com/blog/2016-04-11-issue-closures.html