Skip to content

ext/intl: apply open_basedir restriction to ResourceBundle bundle paths #23214

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LamentXU123 wants to merge 2 commits into
base: master
Choose a base branch
from
+64 −0
Open

ext/intl: apply open_basedir restriction to ResourceBundle bundle paths #23214

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
efddc8e
ext/intl: apply open_basedir restriction to ResourceBundle bundle paths
LamentXU123 Aug 11, 2026
c6c7c2a
Update NEWS
LamentXU123 Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions NEWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ PHP NEWS
after successful calls. (Weilin Du)
. Fixed IntlNumberRangeFormatter leaving stale global error state after
successful createFromSkeleton() and format() calls. (Weilin Du)
. Fixed ResourceBundle bundle paths to respect open_basedir. (Weilin Du)
. Implemented GH-20255 (Add a predefined calendar constant in
IntlDateFormatter for the proleptic gregorian calendar). (David Carlier)
. Added SpoofChecker::areBidiConfusable(). (David Carlier)
Expand Down
19 changes: 19 additions & 0 deletions ext/intl/resourcebundle/resourcebundle_class.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
extern "C" {
#include <zend.h>
#include <php.h>
#include "main/fopen_wrappers.h"
}

#include <Zend/zend_exceptions.h>
Expand All @@ -39,6 +40,16 @@ zend_class_entry *ResourceBundle_ce_ptr = NULL;

static zend_object_handlers ResourceBundle_object_handlers;

static zend_result resourcebundle_check_open_basedir(const char *bundlename, size_t bundlename_len)
{
if (bundlename != NULL && bundlename_len != 0 && php_check_open_basedir(bundlename)) {
intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR, "open_basedir restriction in effect");
return FAILURE;
}

return SUCCESS;
}

/* {{{ ResourceBundle_object_free */
static void ResourceBundle_object_free( zend_object *object )
{
Expand Down Expand Up @@ -113,6 +124,10 @@ static zend_result resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS)
return FAILURE;
}

if (resourcebundle_check_open_basedir(bundlename, bundlename_len) == FAILURE) {
return FAILURE;
}

if (fallback) {
rb->me = ures_open(bundlename, locale, &INTL_DATA_ERROR_CODE(rb));
} else {
Expand Down Expand Up @@ -357,6 +372,10 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(resourcebundle_locales)
bundlename = NULL;
}

if (resourcebundle_check_open_basedir(bundlename, bundlename_len) == FAILURE) {
RETURN_FALSE;
}

icuenum = ures_openAvailableLocales( bundlename, &icuerror );
INTL_CHECK_STATUS(icuerror, "Cannot fetch locales list");

Expand Down
44 changes: 44 additions & 0 deletions ext/intl/tests/resourcebundle_open_basedir.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
--TEST--
ResourceBundle bundle paths respect open_basedir
--EXTENSIONS--
intl
--INI--
open_basedir=.
display_errors=1
log_errors=0
--FILE--
<?php
chdir(__DIR__);
require_once "resourcebundle.inc";

var_dump(ResourceBundle::create('root', BUNDLE) instanceof ResourceBundle);
var_dump(ResourceBundle::getLocales(BUNDLE));

$outside = dirname(__DIR__);

try {
new ResourceBundle('root', $outside);
} catch (Throwable $e) {
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
}

var_dump(ResourceBundle::create('root', $outside));
var_dump(ResourceBundle::getLocales($outside));
?>
--EXPECTF--
bool(true)
array(2) {
[0]=>
string(2) "es"
[1]=>
string(4) "root"
}

Warning: ResourceBundle::__construct(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (.) in %s on line %d
IntlException: ResourceBundle::__construct(): open_basedir restriction in effect

Warning: ResourceBundle::create(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (.) in %s on line %d
NULL

Warning: ResourceBundle::getLocales(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (.) in %s on line %d
bool(false)
Loading