php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-28 18:53:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.3' into PHP-7.4

Browse Source 
* PHP-7.3:
  Update NEWS
  Fix #81211: Symlinks are followed when creating PHAR archive
This commit is contained in:
Stanislav Malyshev
2021-08-23 23:29:01 -07:00
parent 9494b1cdc4 b2008ab97d
commit 40db8947e2
2 changed files with 47 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ext/phar/phar_object.c
+2 -1
View File
@@ -1418,6 +1418,7 @@ static int phar_build(zend_object_iterator *iter, void *puser) /* {{{ */
zend_class_entry *ce = p_obj->c;
phar_archive_object *phar_obj = p_obj->p;
php_stream_statbuf ssb;
char ch;
value = iter->funcs->get_current_data(iter);
@@ -1541,7 +1542,7 @@ phar_spl_fileinfo:
base = temp;
base_len = strlen(base);
if (strstr(fname, base)) {
if (fname_len >= base_len && strncmp(fname, base, base_len) == 0 && ((ch = fname[base_len - IS_SLASH(base[base_len - 1])]) == '\0' || IS_SLASH(ch))) {
str_key_len = fname_len - base_len;
if (str_key_len <= 0) {
ext/phar/tests/bug81211.phpt
+45
View File
@@ -0,0 +1,45 @@
--TEST--
Bug #81211 (Symlinks are followed when creating PHAR archive)
--SKIPIF--
<?php
if (!extension_loaded('phar')) die('skip phar extension is not available');
if (PHP_OS_FAMILY === 'Windows') {
if (false === include __DIR__ . '/../../standard/tests/file/windows_links/common.inc') {
die('skip windows_links/common.inc is not available');
}
skipIfSeCreateSymbolicLinkPrivilegeIsDisabled(__FILE__);
}
?>
--FILE--
<?php
mkdir(__DIR__ . '/bug81211');
mkdir(__DIR__ . '/bug81211/foobar');
mkdir(__DIR__ . '/bug81211/foo');
file_put_contents(__DIR__ . '/bug81211/foobar/file', 'this file should NOT be included in the archive!');
symlink(__DIR__ . '/bug81211/foobar/file', __DIR__ . '/bug81211/foo/symlink');
$archive = new PharData(__DIR__ . '/bug81211/archive.tar');
try {
$archive->buildFromDirectory(__DIR__ . '/bug81211/foo');
} catch (UnexpectedValueException $ex) {
echo $ex->getMessage(), PHP_EOL;
}
try {
$archive->buildFromIterator(new RecursiveDirectoryIterator(__DIR__ . '/bug81211/foo', FilesystemIterator::SKIP_DOTS), __DIR__ . '/bug81211/foo');
} catch (UnexpectedValueException $ex) {
echo $ex->getMessage(), PHP_EOL;
}
?>
--CLEAN--
<?php
@unlink(__DIR__ . '/bug81211/archive.tar');
@unlink(__DIR__ . '/bug81211/foo/symlink');
@unlink(__DIR__ . '/bug81211/foobar/file');
@rmdir(__DIR__ . '/bug81211/foo');
@rmdir(__DIR__ . '/bug81211/foobar');
@rmdir(__DIR__ . '/bug81211');
?>
--EXPECTF--
Iterator RecursiveIteratorIterator returned a path "%s%ebug81211\foobar\file" that is not in the base directory "%s%ebug81211\foo"
Iterator RecursiveDirectoryIterator returned a path "%s%ebug81211\foobar\file" that is not in the base directory "%s%ebug81211\foo"