diff options
author | Stanislav Malyshev <stas@php.net> | 2012-03-25 12:51:46 -0700 |
---|---|---|
committer | Stanislav Malyshev <stas@php.net> | 2012-03-25 12:51:46 -0700 |
commit | 2a74cb40080c9e16f7ae952fc46f64b219aaf77e (patch) | |
tree | 8545aedc195249d18fe45dc830b740f7f47b6b31 | |
parent | b08b7fe78785230dd37e7969e38f1913727fbc88 (diff) | |
parent | 167e2fd78224887144496cdec2089cd5b2f3312d (diff) | |
download | php-git-2a74cb40080c9e16f7ae952fc46f64b219aaf77e.tar.gz |
Merge branch 'sec53' into sec54
* sec53:
fix bug #61367 - open_basedir bypass using libxml RSHUTDOWN
-rw-r--r-- | NEWS | 4 | ||||
-rw-r--r-- | ext/libxml/libxml.c | 10 | ||||
-rw-r--r-- | ext/libxml/tests/bug61367-read.phpt | 58 | ||||
-rw-r--r-- | ext/libxml/tests/bug61367-write.phpt | 48 |
4 files changed, 115 insertions, 5 deletions
@@ -48,6 +48,10 @@ PHP NEWS - mbstring: . MFH mb_ereg_replace_callback() for security enhancements. (Rui) +- Libxml: + . Fixed bug #61367 (open_basedir bypass using libxml RSHUTDOWN). + (Tim Starling) + - mysqli . Fixed bug #61003 (mysql_stat() require a valid connection). (Johannes). diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c index 93d410bc76..9d6c25737d 100644 --- a/ext/libxml/libxml.c +++ b/ext/libxml/libxml.c @@ -86,8 +86,8 @@ ZEND_GET_MODULE(libxml) static PHP_MINIT_FUNCTION(libxml); static PHP_RINIT_FUNCTION(libxml); static PHP_MSHUTDOWN_FUNCTION(libxml); -static PHP_RSHUTDOWN_FUNCTION(libxml); static PHP_MINFO_FUNCTION(libxml); +static int php_libxml_post_deactivate(); /* }}} */ @@ -137,13 +137,13 @@ zend_module_entry libxml_module_entry = { PHP_MINIT(libxml), /* extension-wide startup function */ PHP_MSHUTDOWN(libxml), /* extension-wide shutdown function */ PHP_RINIT(libxml), /* per-request startup function */ - PHP_RSHUTDOWN(libxml), /* per-request shutdown function */ + NULL, /* per-request shutdown function */ PHP_MINFO(libxml), /* information function */ NO_VERSION_YET, PHP_MODULE_GLOBALS(libxml), /* globals descriptor */ PHP_GINIT(libxml), /* globals ctor */ NULL, /* globals dtor */ - NULL, /* post deactivate */ + php_libxml_post_deactivate, /* post deactivate */ STANDARD_MODULE_PROPERTIES_EX }; @@ -861,9 +861,9 @@ static PHP_MSHUTDOWN_FUNCTION(libxml) return SUCCESS; } - -static PHP_RSHUTDOWN_FUNCTION(libxml) +static int php_libxml_post_deactivate() { + TSRMLS_FETCH(); /* reset libxml generic error handling */ if (_php_libxml_per_request_initialization) { xmlSetGenericErrorFunc(NULL, NULL); diff --git a/ext/libxml/tests/bug61367-read.phpt b/ext/libxml/tests/bug61367-read.phpt new file mode 100644 index 0000000000..722b8e704e --- /dev/null +++ b/ext/libxml/tests/bug61367-read.phpt @@ -0,0 +1,58 @@ +--TEST-- +Bug #61367: open_basedir bypass in libxml RSHUTDOWN: read test +--SKIPIF-- +<?php if(!extension_loaded('dom')) echo 'skip'; ?> +--INI-- +open_basedir=. +; Suppress spurious "Trying to get property of non-object" notices +error_reporting=E_ALL & ~E_NOTICE +--FILE-- +<?php + +class StreamExploiter { + public function stream_close ( ) { + $doc = new DOMDocument; + $doc->resolveExternals = true; + $doc->substituteEntities = true; + $dir = htmlspecialchars(dirname(getcwd())); + $doc->loadXML( <<<XML +<!DOCTYPE doc [ + <!ENTITY file SYSTEM "file:///$dir/bad"> +]> +<doc>&file;</doc> +XML + ); + print $doc->documentElement->firstChild->nodeValue; + } + + public function stream_open ( $path , $mode , $options , &$opened_path ) { + return true; + } +} + +var_dump(mkdir('test_bug_61367')); +var_dump(mkdir('test_bug_61367/base')); +var_dump(file_put_contents('test_bug_61367/bad', 'blah')); +var_dump(chdir('test_bug_61367/base')); + +stream_wrapper_register( 'exploit', 'StreamExploiter' ); +$s = fopen( 'exploit://', 'r' ); + +?> +--CLEAN-- +<?php +unlink('test_bug_61367/bad'); +rmdir('test_bug_61367/base'); +rmdir('test_bug_61367'); +?> +--EXPECTF-- +bool(true) +bool(true) +int(4) +bool(true) + +Warning: DOMDocument::loadXML(): I/O warning : failed to load external entity "file:///%s/test_bug_61367/bad" in %s on line %d + +Warning: DOMDocument::loadXML(): Failure to process entity file in Entity, line: 4 in %s on line %d + +Warning: DOMDocument::loadXML(): Entity 'file' not defined in Entity, line: 4 in %s on line %d diff --git a/ext/libxml/tests/bug61367-write.phpt b/ext/libxml/tests/bug61367-write.phpt new file mode 100644 index 0000000000..aeed688ff9 --- /dev/null +++ b/ext/libxml/tests/bug61367-write.phpt @@ -0,0 +1,48 @@ +--TEST-- +Bug #61367: open_basedir bypass in libxml RSHUTDOWN: write test +--SKIPIF-- +<?php if(!extension_loaded('dom')) echo 'skip'; ?> +--INI-- +open_basedir=. +; Suppress spurious "Trying to get property of non-object" notices +error_reporting=E_ALL & ~E_NOTICE +--FILE-- +<?php + +class StreamExploiter { + public function stream_close ( ) { + $doc = new DOMDocument; + $doc->appendChild($doc->createTextNode('hello')); + var_dump($doc->save(dirname(getcwd()) . '/bad')); + } + + public function stream_open ( $path , $mode , $options , &$opened_path ) { + return true; + } +} + +var_dump(mkdir('test_bug_61367')); +var_dump(mkdir('test_bug_61367/base')); +var_dump(file_put_contents('test_bug_61367/bad', 'blah')); +var_dump(chdir('test_bug_61367/base')); + +stream_wrapper_register( 'exploit', 'StreamExploiter' ); +$s = fopen( 'exploit://', 'r' ); + +?> +--CLEAN-- +<?php +@unlink('test_bug_61367/bad'); +rmdir('test_bug_61367/base'); +rmdir('test_bug_61367'); +?> +--EXPECTF-- +bool(true) +bool(true) +int(4) +bool(true) + +Warning: DOMDocument::save(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (.) in %s on line %d + +Warning: DOMDocument::save(%s): failed to open stream: Operation not permitted in %s on line %d +bool(false) |