Fix convert.quoted-printable-decode of lowercase hex digits

[iliaal]

The convert.quoted-printable-decode stream filter accepts lowercase hex digits (isxdigit() passes a-f) but its nibble math only handles uppercase, so a hex escape with a lowercase digit decodes to the wrong byte. quoted_printable_decode() decodes lowercase correctly, so the filter and the function disagree.

$fp = fopen('php://temp', 'r+');
fwrite($fp, '=cd'); rewind($fp);
stream_filter_append($fp, 'convert.quoted-printable-decode', STREAM_FILTER_READ);
var_dump(bin2hex(stream_get_contents($fp))); // "ed", should be "cd"

[arnaud-lb]

The filter documentation refers to quoted_printable_decode(), which says that it follows RFC 2045. The RFC explicitly disallows lowercase letters:

The digits of the hexadecimal alphabet, for this purpose, are "0123456789ABCDEF". Uppercase letters must be used; lowercase letters are not allowed.
https://datatracker.ietf.org/doc/html/rfc2045#section-6.7

Since decoding lowercase digits has never worked properly, and since fixing invalid inputs often lead to bugs or security issues, I would be in favor of changing quoted_printable_decode() and the filter so that they fail when the input uses lowercase letters.

Edit: I see now that only the filter doesn't decode lowercase hex letter properly. In that case I would suggestion to only change the filter, and to propose a deprecation of this behavior for the function (unless https://github.com/php/policies/pull/27/changes applies, but I'm not sure. cc @Girgias @TimWolla)

[alecpl]

The RFC also says: "An "=" followed by two hexadecimal digits, one or both of which are lowercase letters in "abcdef", is formally illegal. A robust implementation might choose to recognize them as the corresponding uppercase letters."

base64_decode() has a $strict argument, maybe that's the direction.

[iliaal]

On the strict direction: I'd keep that off this fix. It's an 8.4 bug fix, and the filter today doesn't reject lowercase, it silently decodes it to the wrong byte (=cd gives 0xED). Fixing that to the correct byte matches what quoted_printable_decode() has done for years and is what the RFC's "a robust implementation might choose to recognize them as the corresponding uppercase" line (alecpl's quote) allows, so it's a safe backportable fix. Rejecting lowercase instead turns input that currently produces output into an error, which isn't something I'd put on a stable branch.

The strict form (deprecate the leniency in both, or a $strict flag like base64_decode()) is worth doing, but as a separate master-side change, which lines up with your edit.