Enable protection against long lines about csv HOT 6 CLOSED

It's not exactly clear how to do this, without needing to be able to rewind the stream 1 byte. We'd have to know if the last character was a newline, to determine if parsing was aborted mid-line.

from csv.

Hmmm, even that is actually incorrect. Consider the following file with an fget length set to 6:

foo,"
bar"

We would incorrectly thing we are done processing the line. 😭

from csv.

Oh, man. fgetcsv actually keeps going and reads more than 6 bytes, because "the split would occur inside an enclosure".

https://3v4l.org/kfrkI

from csv.

I do not believe that length argument behave as you think.
The example below uses fgets but it is the same argument/behaviour as with fgetcsv.
The corresponding method on SplFileObject is https://www.php.net/manual/en/splfileobject.setmaxlinelen.php

$text = <<<TXT
Lorem ipsum dolor sit amet, consectetur adipiscing elit.
Duis nec sapien felis, ac sodales nisl.
Nulla vitae magna vitae purus aliquet consequat.
TXT;

$stream = tmpfile();
fwrite($stream, $text);
rewind($stream);
while (($buffer = fgets($stream, 20)) !== false) {
    echo $buffer, PHP_EOL;
}
if (!feof($stream)) {
    echo "Error: unexpected fgets() fail\n";
}
fclose($stream);

will produce

Lorem ipsum dolor s
it amet, consectetu
r adipiscing elit.

Duis nec sapien fel
is, ac sodales nisl
.

Nulla vitae magna v
itae purus aliquet 
consequat.

It will only split/ read the line in chunk size, it will not force ending reading the line.

from csv.

TL;DR: I do not think setting this value to anything other than 0 will help prevent DDOS attack. IMHO it should be left to the current value for maximum compatibility and to avoid enclosure issue.

from csv.

I will close this issue as a won't fix because of the argument I put forward.

from csv.