Env vars with non-ASCII values are mangled when read from $_SERVER on Windows

Description

The following code:

<?php
var_dump(
    $_SERVER['FOO'] ?? 'unset', 
    $_ENV['FOO'] ?? 'unset', 
    getenv('FOO')
);

When run with variables_order = "EGPCS" and FOO=GüИter传 set in the environment variables in Windows (or using $env:FOO = 'GüИter传' in PowerShell before executing the test file above).

Resulted in this output:

string(7) "G?ter?"
string(7) "G?ter?"
string(11) "GüИter传"

But I expected this output instead:

string(11) "GüИter传"
string(11) "GüИter传"
string(11) "GüИter传"

Doing the same in WSL/Ubuntu seems to yield the correct result, so I assume it's Windows specific.

Regarding PHP version, it appears all versions <7.2 fail completely, with even getenv() returning string(7) "G?ter?" or string(7) "Gⁿ?ter?" for 5.x. From PHP 7.2 onwards I get the behavior described above.

PHP Version

8.0.13

Operating System

Windows 10

From PHP 7.2 onwards I get the behavior described above.

This is likely due to fixing https://bugs.php.net/75574, so should be fixed as of PHP 7.1.13 and 7.2.1, respectively. That fix only affected getenv(), though, but not _php_import_environment_variables (and possibly other places).

Thanks, do you see any way to mitigate/detect this in userland?

I see that doing this when starting up to ensure $_SERVER is in a good state appears to work.. not sure if there's a better way:

foreach ($_SERVER as $var => $val) {
    if (($val = getenv($var)) !== false) {
        $_SERVER[$var] = $val;
    }
}

Once fixed in a release I'll at least be able to exclude this hackery from newer PHP versions.

Nope, no better idea per se, but note that this wouldn't help with env var names containing non-ASCII characters (e.g. FÖÖ=bar). If that's important, you could traverse getenv() instead (that's likely a bit faster anyway).

Ok yes using getenv() once makes more sense, although we're really only interested in ascii vars in the context of Composer.

Workaround PHP bug with env vars not being read correctly on Windows, f…

@cmb69

@cmb69 it's been brought to my attention that calling getenv() also still suffers from the same issue and mangles unicode values. Only getenv('FOO') appears to work correctly.

So here's a working workaround: https://github.com/composer/composer/blob/d9619985dbabb58255fb27cf78fe702345d31793/bin/composer#L68-L76

Argh! getenv() without parameter also calls php_import_environment_variables(), and I tested with an already patched version.

Fix phpGH-7896: Environment vars may be mangled on Windows

Fix GH-7896: Environment vars may be mangled on Windows

Merge branch 'PHP-8.0' into PHP-8.1

Merge branch 'PHP-8.1'

@cmb69

Thanks @cmb69 !

Navigation Menu

Repository navigation

Env vars with non-ASCII values are mangled when read from $_SERVER on Windows #7896

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Env vars with non-ASCII values are mangled when read from $_SERVER on Windows #7896

Description

Description

PHP Version

Operating System

Activity

cmb69 commented on Jan 6, 2022

Seldaek commented on Jan 6, 2022

cmb69 commented on Jan 6, 2022

Seldaek commented on Jan 6, 2022

Seldaek commented on Jan 7, 2022

cmb69 commented on Jan 7, 2022

Seldaek commented on Jan 21, 2022

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions