Unverified Commit 1a7b7f72 authored by Alex Pott's avatar Alex Pott
Browse files

Issue #3181275 by andypost, Pooja Ganjage, alexpott: Do not register Phar... 

Issue #3181275 by andypost, Pooja Ganjage, alexpott: Do not register Phar stream wrapper on PHP 8 because it is not vulnerable to unserialize bugs
parent 78b86c16

core/lib/Drupal/Core/DrupalKernel.php

+2 −1
Original line number Diff line number Diff line
@@ -479,7 +479,8 @@ public function boot() { 
      $this->classLoader->setApcuPrefix($prefix);

    }



    if (in_array('phar', stream_get_wrappers(), TRUE)) {

    // @todo clean-up for PHP 8.0+ https://www.drupal.org/node/3210486

    if (PHP_VERSION_ID < 80000 && in_array('phar', stream_get_wrappers(), TRUE)) {

      // Set up a stream wrapper to handle insecurities due to PHP's builtin

      // phar stream wrapper. This is not registered as a regular stream wrapper

      // to prevent \Drupal\Core\File\FileSystem::validScheme() treating "phar"

core/tests/Drupal/KernelTests/Core/File/PharWrapperTest.php

+11 −4
Original line number Diff line number Diff line
@@ -24,10 +24,17 @@ public function testPharFile() { 
    $expected_hash = 'c7e7904ea573c5ebea3ef00bb08c1f86af1a45961fbfbeb1892ff4a98fd73ad5';

    $this->assertSame($expected_hash, hash('sha256', $file_contents));



    // @todo clean-up for PHP 8.0+ https://www.drupal.org/node/3210486

    if (PHP_VERSION_ID < 80000) {

      // Ensure that file operations via the phar:// stream wrapper throw an

      // exception for files without the .phar extension.

      $this->expectException('TYPO3\PharStreamWrapper\Exception');

      file_exists("phar://$base/image-2.jpg/index.php");

    }

    else {

      // PHP 8 fixed via https://wiki.php.net/rfc/phar_stop_autoloading_metadata

      $this->assertFalse(file_exists("phar://$base/image-2.jpg/index.php"));

    }

  }



}