Skip to content

Commit 9f96b2b

Browse files
cmb69cmb69
committed
Fix #76929: zip-based phar does not respect phar.require_hash
Based on the patch provided by david at bamsoftware. Closes GH-6517.
1 parent 821eaaf commit 9f96b2b

24 files changed

+104
-0
lines changed

‎NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ PHP NEWS
2828
. Fixed bug #80521 (Parameters with underscores no longer recognized). (cmb,
2929
Simonov Denis)
3030

31+
- Phar:
32+
. Fixed bug #76929 (zip-based phar does not respect phar.require_hash).
33+
(david at bamsoftware, cmb)
34+
3135
07 Jan 2021, PHP 8.0.1
3236

3337
- Core:

‎ext/phar/tests/zip/badalias.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar: invalid aliases
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip no zlib"); ?>

‎ext/phar/tests/zip/bzip2.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar: process bzip2-compressed zip entry
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("bz2")) die("skip bz2 not available"); ?>

‎ext/phar/tests/zip/frontcontroller1.phar.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar front controller other zip-based
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller11.phar.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
Phar front controller mime type extension is not a string zip-based
33
--INI--
44
default_charset=
5+
phar.require_hash=0
56
--SKIPIF--
67
<?php if (!extension_loaded("phar")) die("skip phar extension not loaded"); ?>
78
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller12.phar.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
Phar front controller mime type unknown int zip-based
33
--INI--
44
default_charset=UTF-8
5+
phar.require_hash=0
56
--SKIPIF--
67
<?php if (!extension_loaded("phar")) die("skip"); ?>
78
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller13.phar.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
Phar front controller mime type not string/int zip-based
33
--INI--
44
default_charset=UTF-8
5+
phar.require_hash=0
56
--SKIPIF--
67
<?php if (!extension_loaded("phar")) die("skip"); ?>
78
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller14.phar.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar front controller mime type override, other zip-based
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller15.phar.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
Phar front controller mime type override, Phar::PHPS zip-based
33
--INI--
44
default_charset=UTF-8
5+
phar.require_hash=0
56
--SKIPIF--
67
<?php if (!extension_loaded("phar")) die("skip"); ?>
78
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller16.phar.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
Phar front controller mime type override, Phar::PHP zip-based
33
--INI--
44
default_charset=UTF-8
5+
phar.require_hash=0
56
--SKIPIF--
67
<?php if (!extension_loaded("phar")) die("skip"); ?>
78
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller17.phar.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar front controller mime type unknown zip-based
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller18.phar.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar front controller $_SERVER munging failure zip-based
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller19.phar.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar front controller $_SERVER munging failure 2 zip-based
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller2.phar.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
Phar front controller PHP test zip-based
33
--INI--
44
default_charset=UTF-8
5+
phar.require_hash=0
56
--SKIPIF--
67
<?php if (!extension_loaded("phar")) die("skip"); ?>
78
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller20.phar.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar front controller $_SERVER munging failure 3 zip-based
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller3.phar.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
Phar front controller phps zip-based
33
--INI--
44
default_charset=UTF-8
5+
phar.require_hash=0
56
--SKIPIF--
67
<?php if (!extension_loaded("phar")) die("skip"); ?>
78
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller4.phar.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar front controller index.php relocate (no /) zip-based
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller5.phar.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar front controller index.php relocate zip-based
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller6.phar.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar front controller 404 zip-based
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/frontcontroller7.phar.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar front controller alternate index file zip-based
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/tests/zip/getalias.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ Phar: getAlias() with an existing phar.zip
44
<?php if (!extension_loaded("phar")) die("skip"); ?>
55
--INI--
66
phar.readonly=0
7+
phar.require_hash=0
78
--FILE--
89
<?php
910

‎ext/phar/tests/zip/require_hash.phpt

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
--TEST--
2+
Phar: zip-based phar, require_hash=1, no signature
3+
--SKIPIF--
4+
<?php if (!extension_loaded('phar')) die('skip'); ?>
5+
--INI--
6+
phar.readonly=1
7+
phar.require_hash=0
8+
--FILE--
9+
<?php
10+
ini_set('phar.require_hash', 1);
11+
include __DIR__ . '/files/zipmaker.php.inc';
12+
$fname = __DIR__ . '/require_hash.phar.zip';
13+
$alias = 'phar://' . $fname;
14+
$fname2 = __DIR__ . '/require_hash.zip';
15+
16+
$zip = new zipmaker($fname);
17+
$zip->init();
18+
$zip->addFile('zip_001.php', '<?php var_dump(__FILE__);');
19+
$zip->addFile('internal/file/here', "hi there!\n");
20+
$zip->addFile('.phar/stub.php', "__HALT_COMPILER();");
21+
$zip->close();
22+
23+
try {
24+
$phar = new Phar($fname);
25+
var_dump($phar->getStub());
26+
} catch (Exception $e) {
27+
echo $e->getMessage()."\n";
28+
}
29+
ini_set('phar.require_hash', 0);
30+
try {
31+
$phar = new PharData($fname2);
32+
$phar['file'] = 'hi';
33+
var_dump($phar->getSignature());
34+
$phar->setSignatureAlgorithm(Phar::MD5);
35+
var_dump($phar->getSignature());
36+
} catch (Exception $e) {
37+
echo $e->getMessage()."\n";
38+
}
39+
40+
?>
41+
===DONE===
42+
--CLEAN--
43+
<?php
44+
@unlink(__DIR__ . '/require_hash.phar.zip');
45+
@unlink(__DIR__ . '/require_hash.zip');
46+
?>
47+
--EXPECTF--
48+
zip-based phar "%srequire_hash.phar.zip" does not have a signature
49+
bool(false)
50+
array(2) {
51+
["hash"]=>
52+
string(32) "%s"
53+
["hash_type"]=>
54+
string(3) "MD5"
55+
}
56+
===DONE===

‎ext/phar/tests/zip/zlib.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Phar: process zlib-compressed zip alias
3+
--INI--
4+
phar.require_hash=0
35
--SKIPIF--
46
<?php if (!extension_loaded("phar")) die("skip"); ?>
57
<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

‎ext/phar/zip.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -673,6 +673,16 @@ int phar_parse_zipfile(php_stream *fp, char *fname, size_t fname_len, char *alia
673673
mydata->is_data = 1;
674674
}
675675

676+
/* ensure signature set */
677+
if (!mydata->is_data && PHAR_G(require_hash) && !mydata->signature) {
678+
php_stream_close(fp);
679+
phar_destroy_phar_data(mydata);
680+
if (error) {
681+
spprintf(error, 0, "zip-based phar \"%s\" does not have a signature", fname);
682+
}
683+
return FAILURE;
684+
}
685+
676686
zend_hash_str_add_ptr(&(PHAR_G(phar_fname_map)), mydata->fname, fname_len, mydata);
677687

678688
if (actual_alias) {

0 commit comments

Comments
 (0)