archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix #76359: open_basedir bypass through adding ".."

Browse source 
We explicitly forbid adding paths with a leading `..` to `open_basedir`
at runtime.

Closes GH-7024.
This commit is contained in:
Christoph M. Becker 2021-05-21 15:00:41 +02:00
parent 99a208566a
commit ee9e07541f
No known key found for this signature in database
GPG key ID: D66C9593118BCCB6
3 changed files with 25 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -4,6 +4,7 @@ PHP NEWS
- Core:
. Fixed bug #81068 (Double free in realpath_cache_clean()). (Dimitry Andric)
. Fixed bug #76359 (open_basedir bypass through adding ".."). (cmb)
- Standard:
. Fixed bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion").

5
main/fopen_wrappers.c
View file

@ -110,6 +110,11 @@ PHPAPI ZEND_INI_MH(OnUpdateBaseDir)
*end = '\0';
end++;
}
if (ptr[0] == '.' && ptr[1] == '.' && (ptr[2] == '\0' || IS_SLASH(ptr[2]))) {
/* Don't allow paths with a leading .. path component to be set at runtime */
efree(pathbuf);
return FAILURE;
}
if (php_check_open_basedir_ex(ptr, 0) != 0) {
/* At least one portion of this open_basedir is less restrictive than the prior one, FAIL */
efree(pathbuf);

19
tests/security/bug76359.phpt Normal file
View file

@ -0,0 +1,19 @@
--TEST--
Bug #76359 (open_basedir bypass through adding "..")
--FILE--
<?php
ini_set('open_basedir', __DIR__);
mkdir(__DIR__ . "/bug76359");
chdir(__DIR__ . "/bug76359");
var_dump(ini_set('open_basedir', ini_get('open_basedir') . PATH_SEPARATOR . ".."));
chdir("..");
chdir("..");
?>
--EXPECTF--
bool(false)
Warning: chdir(): open_basedir restriction in effect. File(..) is not within the allowed path(s): (%s) in %s on line %d
--CLEAN--
<?php
@rmdir(__DIR__ . "/bug76359");
?>