ext/phar: only .phar extensions in file names trigger automatic archive detection - #23260
Conversation
.phar suffix as phar files when including.phar in a directory name does not trigger automatic archive detection
.phar in a directory name does not trigger automatic archive detection.phar in a directory name should not trigger automatic archive detection
|
|
||
| zend_op_array *(*phar_orig_compile_file)(zend_file_handle *file_handle, int type); | ||
|
|
||
| static bool phar_has_marker_in_filename(const zend_string *filename) |
There was a problem hiding this comment.
I think to really properly fix it, we should check if the filename ends with .phar or .phar.zip or .phar.tar etc, one of those supported extensions. I believe somewhere in ext/phar the code already lists the possible extensions, but I may be wrong.
Now, with this code, something like quality.pharma.report.txt would still trigger ;)
There was a problem hiding this comment.
I believe somewhere in ext/phar the code already lists the possible extensions
Sadly there aren't :( and since the phar extension is very, very old. There are conventions in different code bases all over the world and I couldn't find a place where people finally reach an agreement on what suffix should a valid phar file have.
There are things like .phar.php .phar.zip.php or whatever.
Now, with this code, something like quality.pharma.report.txt would still trigger ;)
Clever catch ;)
There was a problem hiding this comment.
There are things like .phar.php .phar.zip.php or whatever.
😭
.phar in a directory name should not trigger automatic archive detection.phar extensions in file names trigger automatic archive detection
So we don't trigger the .phar unserialization process when include files like or .pharabcd/1.html. Only treat them as phar files when the
.pharis in the filename instead of path, so we can still supportinclude 1.phar.zipinclude 1.phar.gzbut not.pharabcd/1.htmlAlso, if the char after
.pharis not a.(which happens in e.g.quality.pharma.report.txt) they are not treated as phar files when included as well.