Stdlib: htmlspecialchars ENT_DISALLOWED replaces illegal scalars with U+FFFD (#32084)

[PurHur]

Summary

• php-src ext/standard/html.c unicode_cp_is_allowed() maps C0 controls, DEL, and HTML5 noncharacters to U+FFFD when ENT_DISALLOWED is set. VM/JIT copied those bytes through.
• Implement the same check in VmString::htmlspecialchars() / htmlentities() and the NestedJIT helpers (HtmlspecialcharsJitHelper, HtmlEntitiesJitHelper). No new runtime/*.c.
• Closes Stdlib: htmlspecialchars/htmlentities ENT_DISALLOWED leaves C0 controls — Zend replaces with U+FFFD (ext/standard/html.c) #32084

php-src reference: php/php-src ext/standard/html.c — php_escape_html_entities_ex / unicode_cp_is_allowed. PHP implementation: ext/standard/VmString.php.

Test plan

• Issue repro VM vs Zend
• Issue repro JIT vs Zend
• Targeted PHPUnit (HtmlspecialcharsEntDisallowed, helper shrink tests, ENT_IGNORE regression)

Verification

./script/docker-exec.sh -- bash -lc 'php test/repro/maintainer_gap_htmlspecialchars_ent_disallowed.php'

Zend:

string(6) "efbfbd"
string(6) "efbfbd"
string(18) "61efbfbd62efbfbd63"
string(2) "01"
tab=09
fdd0=efbfbd
xml_del=7f
ZEND_EXIT:0

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_htmlspecialchars_ent_disallowed.php'

string(6) "efbfbd"
string(6) "efbfbd"
string(18) "61efbfbd62efbfbd63"
string(2) "01"
tab=09
fdd0=efbfbd
xml_del=7f
VM_EXIT:0

./script/docker-exec.sh -- bash -lc 'php bin/jit.php test/repro/maintainer_gap_htmlspecialchars_ent_disallowed.php'

string(6) "efbfbd"
string(6) "efbfbd"
string(18) "61efbfbd62efbfbd63"
string(2) "01"
tab=09
fdd0=efbfbd
xml_del=7f
JIT_EXIT:0

./script/phpunit.sh --filter 'HtmlspecialcharsEntDisallowed|HtmlspecialcharsRuntimeShrinkTest|HtmlEntitiesJitRuntimeShrinkTest|HtmlspecialcharsEntIgnore'

OK (13 tests, 63 assertions)

Not covered: full make test-harness, ci-local.sh LLVM, north-star5-verify. check-generated-docs.sh is red on master (capability-matrix/syntax drift) independent of this diff.

Made with Cursor