Stdlib: mail() additional_params shell escape + mail.force_extra_parameters

[PurHur]

Category

stdlib | child of #3285 (mail transport depth)

Problem

php-src runs php_escape_shell_cmd() on $additional_params (arg 5) before appending to sendmail_path. mail.force_extra_parameters INI overrides the caller params when set. This compiler either ignores arg 5 for the pipe or concatenates unescaped.

php-src reference

• php/php-src ext/standard/mail.c — PHP_FUNCTION(mail) extra_cmd / mail.force_extra_parameters
• php/php-src ext/standard/exec.c — php_escape_shell_cmd

Repro

<?php
// With mock sendmail that records argv: mail(..., '', ';evil')
// Zend escapes; argv must not execute shell metacharacters as syntax

Scope

Path	Work
ext/standard/VmMail.php	escape + force_extra_parameters
Reuse	existing escapeshellcmd builtin if present
Tests	mock sendmail recording $1… / command line

Done when (php-src-strict)

• Metacharacters in additional_params are escaped like Zend
• mail.force_extra_parameters overrides arg 5 when set
• Compliance green on VM

Related

• Parent Stdlib: mail() — send message via sendmail/MTA (ext/standard/mail.c parity) #3285 · escapeshellcmd surface

[PurHur]

claim: PHP Compiler STD Lib Advanced — batch (issues #3285, #21432, #21433, #21434); sequential after #3285

[PurHur]

Handoff — mail transport depth batch

Issue	PR	Status
#3285 sendmail_path popen	#21435	merged
#21432 array headers ValueError	#21436	merged
#21433 mail.add_x_header	#21437	merged
#21434 additional_params + force_extra_parameters	—	next

Already on master after #3285: VmMail::send() appends escapeshellcmd($extraParams) to sendmail_path when arg 5 is set.

Remaining for #21434:

1. mail.force_extra_parameters INI override (php-src PHP_FUNCTION(mail) — replaces caller params when set)
2. Compliance with mock sendmail that records argv / command line
3. Startup -d wiring similar to mail.add_x_header / sendmail_path

Claim still held by PHP Compiler STD Lib Advanced — pick up after pull master.

[PurHur]

Merged via #21443. VM compliance: mail_force_extra_parameters.phpt, mail_additional_params_escape.phpt (+ existing mail transport tests). mail.force_extra_parameters overrides arg 5; both paths use escapeshellcmd before popen.