Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[11.x] Fix PHP_MAXPATHLEN check for strings slightly smaller then PHP_MAXPATHLEN #51850

Merged
merged 2 commits into from
Jun 20, 2024

Conversation

joshuaruesweg
Copy link
Contributor

@joshuaruesweg joshuaruesweg commented Jun 20, 2024

In #50962 we fixed a bug that was supposed to fix the PHP_MAXLENGHT problem with the OpenBasedir configuration. This fix was wrong, because the PHP variable PHP_MAXLENGHT behaves differently than the name suggests. In fact, files can have a maximum length of PHP_MAXLENGHT - 1 character [1].

Because the test was also faulty and did not take the path into account internally, the test was unable to detect the error.

This pull request fixes both the test (see the first commit), which shows that the problem still exists (see the tests from the first commit) and the actual problem in the second commit.

[1] https://github.com/php/php-src/blob/7c860628cd2bf11ee867bfb41b3fd0314c5177c5/main/fopen_wrappers.c#L301

This test was incorrect because it does not take into account the paths that are prefixed in the FileViewFinder. This means that we have so far tested a path that is significantly longer than `PHP_MAXPATHLEN`. As we cannot reliably access the path, we approach `PHP_MAXPATHLEN` and test all file names from `PHP_MAXPATHLEN - 200` to `PHP_MAXPATHLEN + 1`.
Copy link

Thanks for submitting a PR!

Note that draft PR's are not reviewed. If you would like a review, please mark your pull request as ready for review in the GitHub user interface.

Pull requests that are abandoned in draft may be closed due to inactivity.

The previous test was wrong. In fact, `PHP_MAXPATHLEN` is not the maximum length of a file, but `PHP_MAXPATHLEN - 1`. This is checked internally in the PHP source code and if the file is PHP_MAXPATHLEN characters long or longer, the error is thrown in Open-Base-Dir [1].

The problem was incompletely fixed here: laravel#50962

[1] https://github.com/php/php-src/blob/7c860628cd2bf11ee867bfb41b3fd0314c5177c5/main/fopen_wrappers.c#L301
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants