pFad - Phone/Frame/Anonymizer/Declutterfier! Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

URL: http://github.com/ndossche/php-src/commit/167e2fd78224887144496cdec2089cd5b2f3312d

link crossorigen="anonymous" media="all" rel="stylesheet" href="https://github.githubassets.com/assets/global-9c8f61f9f58ad7b2.css" /> fix bug #61367 - open_basedir bypass using libxml RSHUTDOWN · ndossche/php-src@167e2fd · GitHub
Skip to content

Commit 167e2fd

Browse files
smalyshevsmalyshev
committed
fix bug #61367 - open_basedir bypass using libxml RSHUTDOWN
1 parent 9007787 commit 167e2fd

4 files changed

Lines changed: 115 additions & 5 deletions

File tree

‎NEWS‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,10 @@ PHP NEWS
4242
- Firebird Database extension (ibase):
4343
. Fixed bug #60802 (ibase_trans() gives segfault when passing params).
4444

45+
- Libxml:
46+
. Fixed bug #61367 (open_basedir bypass using libxml RSHUTDOWN).
47+
(Tim Starling)
48+
4549
- mysqli
4650
. Fixed bug #61003 (mysql_stat() require a valid connection). (Johannes).
4751

‎ext/libxml/libxml.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,8 @@ ZEND_GET_MODULE(libxml)
8282
static PHP_MINIT_FUNCTION(libxml);
8383
static PHP_RINIT_FUNCTION(libxml);
8484
static PHP_MSHUTDOWN_FUNCTION(libxml);
85-
static PHP_RSHUTDOWN_FUNCTION(libxml);
8685
static PHP_MINFO_FUNCTION(libxml);
86+
static int php_libxml_post_deactivate();
8787

8888
/* }}} */
8989

@@ -129,13 +129,13 @@ zend_module_entry libxml_module_entry = {
129129
PHP_MINIT(libxml), /* extension-wide startup function */
130130
PHP_MSHUTDOWN(libxml), /* extension-wide shutdown function */
131131
PHP_RINIT(libxml), /* per-request startup function */
132-
PHP_RSHUTDOWN(libxml), /* per-request shutdown function */
132+
NULL, /* per-request shutdown function */
133133
PHP_MINFO(libxml), /* information function */
134134
NO_VERSION_YET,
135135
PHP_MODULE_GLOBALS(libxml), /* globals descriptor */
136136
PHP_GINIT(libxml), /* globals ctor */
137137
NULL, /* globals dtor */
138-
NULL, /* post deactivate */
138+
php_libxml_post_deactivate, /* post deactivate */
139139
STANDARD_MODULE_PROPERTIES_EX
140140
};
141141

@@ -655,9 +655,9 @@ static PHP_MSHUTDOWN_FUNCTION(libxml)
655655
return SUCCESS;
656656
}
657657

658-
659-
static PHP_RSHUTDOWN_FUNCTION(libxml)
658+
static int php_libxml_post_deactivate()
660659
{
660+
TSRMLS_FETCH();
661661
/* reset libxml generic error handling */
662662
xmlSetGenericErrorFunc(NULL, NULL);
663663
xmlSetStructuredErrorFunc(NULL, NULL);

‎ext/libxml/tests/bug61367-read.phpt‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
--TEST--
2+
Bug #61367: open_basedir bypass in libxml RSHUTDOWN: read test
3+
--SKIPIF--
4+
<?php if(!extension_loaded('dom')) echo 'skip'; ?>
5+
--INI--
6+
open_basedir=.
7+
; Suppress spurious "Trying to get property of non-object" notices
8+
error_reporting=E_ALL & ~E_NOTICE
9+
--FILE--
10+
<?php
11+
12+
class StreamExploiter {
13+
public function stream_close ( ) {
14+
$doc = new DOMDocument;
15+
$doc->resolveExternals = true;
16+
$doc->substituteEntities = true;
17+
$dir = htmlspecialchars(dirname(getcwd()));
18+
$doc->loadXML( <<<XML
19+
<!DOCTYPE doc [
20+
<!ENTITY file SYSTEM "file://github.com/$dir/bad">
21+
]>
22+
<doc>&file;</doc>
23+
XML
24+
);
25+
print $doc->documentElement->firstChild->nodeValue;
26+
}
27+
28+
public function stream_open ( $path , $mode , $options , &$opened_path ) {
29+
return true;
30+
}
31+
}
32+
33+
var_dump(mkdir('test_bug_61367'));
34+
var_dump(mkdir('test_bug_61367/base'));
35+
var_dump(file_put_contents('test_bug_61367/bad', 'blah'));
36+
var_dump(chdir('test_bug_61367/base'));
37+
38+
stream_wrapper_register( 'exploit', 'StreamExploiter' );
39+
$s = fopen( 'exploit://', 'r' );
40+
41+
?>
42+
--CLEAN--
43+
<?php
44+
unlink('test_bug_61367/bad');
45+
rmdir('test_bug_61367/base');
46+
rmdir('test_bug_61367');
47+
?>
48+
--EXPECTF--
49+
bool(true)
50+
bool(true)
51+
int(4)
52+
bool(true)
53+
54+
Warning: DOMDocument::loadXML(): I/O warning : failed to load external entity "file://github.com/%s/test_bug_61367/bad" in %s on line %d
55+
56+
Warning: DOMDocument::loadXML(): Failure to process entity file in Entity, line: 4 in %s on line %d
57+
58+
Warning: DOMDocument::loadXML(): Entity 'file' not defined in Entity, line: 4 in %s on line %d

‎ext/libxml/tests/bug61367-write.phpt‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
--TEST--
2+
Bug #61367: open_basedir bypass in libxml RSHUTDOWN: write test
3+
--SKIPIF--
4+
<?php if(!extension_loaded('dom')) echo 'skip'; ?>
5+
--INI--
6+
open_basedir=.
7+
; Suppress spurious "Trying to get property of non-object" notices
8+
error_reporting=E_ALL & ~E_NOTICE
9+
--FILE--
10+
<?php
11+
12+
class StreamExploiter {
13+
public function stream_close ( ) {
14+
$doc = new DOMDocument;
15+
$doc->appendChild($doc->createTextNode('hello'));
16+
var_dump($doc->save(dirname(getcwd()) . '/bad'));
17+
}
18+
19+
public function stream_open ( $path , $mode , $options , &$opened_path ) {
20+
return true;
21+
}
22+
}
23+
24+
var_dump(mkdir('test_bug_61367'));
25+
var_dump(mkdir('test_bug_61367/base'));
26+
var_dump(file_put_contents('test_bug_61367/bad', 'blah'));
27+
var_dump(chdir('test_bug_61367/base'));
28+
29+
stream_wrapper_register( 'exploit', 'StreamExploiter' );
30+
$s = fopen( 'exploit://', 'r' );
31+
32+
?>
33+
--CLEAN--
34+
<?php
35+
@unlink('test_bug_61367/bad');
36+
rmdir('test_bug_61367/base');
37+
rmdir('test_bug_61367');
38+
?>
39+
--EXPECTF--
40+
bool(true)
41+
bool(true)
42+
int(4)
43+
bool(true)
44+
45+
Warning: DOMDocument::save(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (.) in %s on line %d
46+
47+
Warning: DOMDocument::save(%s): failed to open stream: Operation not permitted in %s on line %d
48+
bool(false)

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad © 2024 Your Company Name. All rights reserved.




Check this box to remove all script contents from the fetched content.



Check this box to remove all images from the fetched content.


Check this box to remove all CSS styles from the fetched content.


Check this box to keep images inefficiently compressed and original size.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy