Stdlib: filter_input() request-input snapshot vs live $_GET (#19640)

ext/filter/VmFilter.php

@@ -1519,24 +1519,23 @@ private static function isEmailDomainChar(string $ch): bool
             || '.' === $ch || '-' === $ch;
     }
 
-    /** filter_has_var() — key present in INPUT_* superglobal (php-src ext/filter/filter.c; #3294). */
+    /** filter_has_var() — key present in request-input snapshot (php-src IF_G; #3294, #19640). */
     public static function hasInputVar(Context $ctx, int $type, string $key): bool
     {
-        $sgName = self::inputSuperglobalName($type);
-        $sg = $ctx->getSuperglobal($sgName);
-        if (null === $sg || Variable::TYPE_ARRAY !== $sg->type) {
+        $ht = self::requestInputTable($ctx, $type);
+        if (null === $ht) {
             return false;
         }
         $keyVar = new Variable();
         $keyVar->string($key);
 
-        return $sg->toArray()->offsetIsSet($keyVar);
+        return $ht->offsetIsSet($keyVar);
     }
 
     /**
-     * filter_input_array() — batch filter from superglobal (#3294).
+     * filter_input_array() — batch filter from request-input snapshot (#3294, #19640).
      *
-     * @return HashTable|null null when the input superglobal is missing or not an array
+     * @return HashTable|null null when the input snapshot is missing
      */
     public static function filterInputArray(
         Context $ctx,
@@ -1545,13 +1544,42 @@ public static function filterInputArray(
         int $addEmpty,
         Frame $frame
     ): ?HashTable {
-        $sgName = self::inputSuperglobalName($type);
-        $sg = $ctx->getSuperglobal($sgName);
-        if (null === $sg || Variable::TYPE_ARRAY !== $sg->type) {
+        $ht = self::requestInputTable($ctx, $type);
+        if (null === $ht) {
             return null;
         }
 
-        return self::filterVarArray($sg->toArray(), $definition, $addEmpty, $frame);
+        return self::filterVarArray($ht, $definition, $addEmpty, $frame);
+    }
+
+    /**
+     * Original request INPUT_* table (not live $_GET/$_POST) (#19640).
+     */
+    public static function requestInputTable(Context $ctx, int $type): ?HashTable
+    {
+        return $ctx->getFilterInputSnapshot(self::inputSuperglobalName($type));
+    }
+
+    /**
+     * filter_input() value lookup from request-input snapshot (#19640).
+     */
+    public static function requestInputValue(Context $ctx, int $type, string $key): ?Variable
+    {
+        $ht = self::requestInputTable($ctx, $type);
+        if (null === $ht) {
+            return null;
+        }
+        $keyVar = new Variable();
+        $keyVar->string($key);
+        if (!$ht->offsetIsSet($keyVar)) {
+            return null;
+        }
+        $stored = $ht->find($key);
+        if (null === $stored) {
+            return null;
+        }
+
+        return $stored->resolveIndirect();
     }
 
     /**

ext/filter/filter_input.php

@@ -56,28 +56,12 @@ public function execute(Frame $frame): void
         if (null === $ctx) {
             throw new \LogicException('filter_input() requires VM context in this compiler build');
         }
-        $sgName = VmFilter::inputSuperglobalName($typeInt);
-        $sg = $ctx->getSuperglobal($sgName);
-        if (null === $sg || Variable::TYPE_ARRAY !== $sg->type) {
+        $value = VmFilter::requestInputValue($ctx, $typeInt, $keyStr);
+        if (null === $value) {
             $frame->returnVar->null();
 
             return;
         }
-        $keyVar = new Variable();
-        $keyVar->string($keyStr);
-        $ht = $sg->toArray();
-        if (!$ht->offsetIsSet($keyVar)) {
-            $frame->returnVar->null();
-
-            return;
-        }
-        $stored = $ht->find($keyStr);
-        if (null === $stored) {
-            $frame->returnVar->null();
-
-            return;
-        }
-        $value = $stored->resolveIndirect();
         if (!VmFilter::isSupportedFilter($filterId)) {
             filter_var::triggerUnknownFilterWarning($frame, $filterId);
         }

lib/VM/Context.php

@@ -44,6 +44,15 @@ class Context {
     /** @var array<string, Variable> */
     private array $superglobalVars = [];
 
+    /**
+     * filter_input() / filter_has_var() request-input snapshots (php-src IF_G arrays, #19640).
+     * Keyed by superglobal name (_GET, _POST, …). Captured when CGI/web populates request
+     * tables — not updated by later $_GET[...] = writes.
+     *
+     * @var array<string, HashTable>
+     */
+    private array $filterInputSnapshots = [];
+
     /** @var array<string, Variable> */
     private array $globalVars = [];
 
@@ -725,6 +734,19 @@ public function getSuperglobal(string $name): ?Variable
         return $this->superglobalVars[$name] ?? null;
     }
 
+    /**
+     * Capture a deep copy of a request-input table for filter_input() (#19640).
+     */
+    public function captureFilterInputSnapshot(string $sgName, HashTable $table): void
+    {
+        $this->filterInputSnapshots[$sgName] = $table->duplicate();
+    }
+
+    public function getFilterInputSnapshot(string $sgName): ?HashTable
+    {
+        return $this->filterInputSnapshots[$sgName] ?? null;
+    }
+
     public function ensureGlobal(string $name): Variable
     {
         if (!isset($this->globalVars[$name])) {

lib/Web/Superglobals.php

@@ -199,6 +199,7 @@ public static function populateCookie(Context $context, string $cookieHeader): v
     {
         $cookie = $context->ensureSuperglobal('_COOKIE');
         self::populateCookieHeader($cookie->toArray(), $cookieHeader);
+        $context->captureFilterInputSnapshot('_COOKIE', $cookie->toArray());
     }
 
     /**
@@ -387,6 +388,7 @@ private static function populateGet(Context $context, string $queryString): void
     {
         $get = $context->ensureSuperglobal('_GET');
         self::populateFormEncoded($get->toArray(), $queryString);
+        $context->captureFilterInputSnapshot('_GET', $get->toArray());
     }
 
     /** JIT/AOT standalone refresh — $_GET table (#9907). */
@@ -595,6 +597,7 @@ private static function populatePost(Context $context, string $postBody): void
         $post = $context->ensureSuperglobal('_POST');
         $files = $context->ensureSuperglobal('_FILES');
         self::populatePostIntoTables($post->toArray(), $files->toArray(), $postBody);
+        $context->captureFilterInputSnapshot('_POST', $post->toArray());
     }
 
     /** JIT/AOT standalone refresh — $_POST table (#9907). */

test/compliance/JITTest.php

@@ -1285,6 +1285,11 @@ public static function providePHPTests(): \Generator
             if (str_contains($name, 'filter_null_on_failure')) {
                 continue;
             }
+            // filter_input() request-input snapshot (#19640): VM captures IF_G tables; MCJIT still reads live sg_*.
+            if (str_contains($name, 'filter_input_request_snapshot')
+                || str_contains($name, 'filter_input_cgi_snapshot_immutable')) {
+                continue;
+            }
             // filter_var() FILTER_VALIDATE_REGEXP array options: VM + AOT (#5020); MCJIT defers array options.
             if (str_contains($name, 'filter_validate_regexp')) {
                 continue;

test/compliance/cases/stdlib/filter_input_cgi_snapshot_immutable.phpt

@@ -0,0 +1,17 @@
+--TEST--
+stdlib filter_input() CGI query snapshot ignores later $_GET mutation (#19640)
+--GET--
+x=42
+--FILE--
+<?php
+var_export(filter_input(INPUT_GET, 'x', FILTER_VALIDATE_INT));
+echo "\n";
+$_GET['x'] = '99';
+var_export(filter_input(INPUT_GET, 'x', FILTER_VALIDATE_INT));
+echo "\n";
+var_export($_GET['x']);
+echo "\n";
+--EXPECT--
+42
+42
+'99'

test/compliance/cases/stdlib/filter_input_request_snapshot.phpt

@@ -0,0 +1,16 @@
+--TEST--
+stdlib filter_input() uses request-input snapshot not live $_GET (#19640)
+--FILE--
+<?php
+$_GET['x'] = '1';
+var_export(filter_input(INPUT_GET, 'x', FILTER_VALIDATE_INT));
+echo "\n";
+$_GET['x'] = '99';
+var_export(filter_input(INPUT_GET, 'x', FILTER_VALIDATE_INT));
+echo "\n";
+var_export(filter_has_var(INPUT_GET, 'x'));
+echo "\n";
+--EXPECT--
+NULL
+NULL
+false

test/repro/issue_19640_filter_input_cli_snapshot.php

@@ -0,0 +1,10 @@
+<?php
+// filter_input() must not follow live $_GET writes (#19640)
+$_GET['x'] = '1';
+var_export(filter_input(INPUT_GET, 'x', FILTER_VALIDATE_INT));
+echo "\n";
+$_GET['x'] = '99';
+var_export(filter_input(INPUT_GET, 'x', FILTER_VALIDATE_INT));
+echo "\n";
+var_export(filter_has_var(INPUT_GET, 'x'));
+echo "\n";