#943722: forcefully remove invalid UTF-8 from input.

From: Damien Tournoud <damien@commerceguys.com>


---
 bootstrap.inc |   25 +++++++++++++++++++++++++
 1 files changed, 25 insertions(+), 0 deletions(-)

diff --git includes/bootstrap.inc includes/bootstrap.inc
index d979820..87510c9 100644
--- includes/bootstrap.inc
+++ includes/bootstrap.inc
@@ -499,6 +499,12 @@ function drupal_environment_initialize() {
     $_SERVER['HTTP_HOST'] = '';
   }
 
+  // Remove invalid UTF-8 from input.
+  drupal_sanitize_array($_GET);
+  drupal_sanitize_array($_POST);
+  drupal_sanitize_array($_COOKIE);
+  $_REQUEST = $_POST + $_GET + $_COOKIE;
+
   // When clean URLs are enabled, emulate ?q=foo/bar using REQUEST_URI. It is
   // not possible to append the query string using mod_rewrite without the B
   // flag (this was added in Apache 2.2.8), because mod_rewrite unescapes the
@@ -543,6 +549,25 @@ function drupal_valid_http_host($host) {
 }
 
 /**
+ * Clean-up an user-input array by removing invalid UTF-8 values.
+ */
+function drupal_sanitize_array(&$array) {
+  foreach ($array as $key => &$value) {
+    if (!drupal_validate_utf8($key)) {
+      unset($array[$key]);
+    }
+    else {
+      if (is_array($value)) {
+        drupal_sanitize_array($value);
+      }
+      elseif (!drupal_validate_utf8($key)) {
+        unset($array[$key]);
+      }
+    }
+  }
+}
+
+/**
  * Loads the configuration and sets the base URL, cookie domain, and
  * session name correctly.
  */