Unchecked input in HTMLPurifier_UnitConverter round() function about htmlpurifier HOT 3 OPEN

drat! send a PR?

from htmlpurifier.

I'm preparing it, but It's a bit wider than expected: I found another similar issue (Length.php line 119).
$log = (int)floor(log(abs($n), 10));

$n is by definition a STRING, because it's the return value of $length->getN(), that returns a string...

So, every time you use it with as a parameter of an arithmetic function, it must be checked and/or converted to a number before calling abs() or similar functions.

from htmlpurifier.

Sorry, I'm not very used to fixing code... I found that issue was already fixed in master: 43f49ac
But there are no releases with it.

from htmlpurifier.