Req #71966 [NEW]: PHP Phar issue with leading ./ in tar archives

From: pandrade at redhat dot com Operating system: Linux PHP version: Irrelevant Package: PHAR related Bug Type: Feature/Change Request Bug description:PHP Phar issue with leading ./ in tar archives Description: ------------ To test the below script, run first: $ touch file1 file2 file3 $ tar zcf dotslash.tar.gz ./file1 ./file2 ./file3 $ tar zcf nodotslash.tar.gz file1 file2 file3 I made an initial experiment, that "almost" works, will work for "./file" but fail for "./dir/file". ---8<--- diff -up php-5.4.16/ext/phar/tar.c.orig php-5.4.16/ext/phar/tar.c --- php-5.4.16/ext/phar/tar.c.orig 2016-03-29 11:39:57.020599910 -0300 +++ php-5.4.16/ext/phar/tar.c 2016-03-29 11:42:25.582624697 -0300 @@ -481,6 +481,9 @@ bail: entry.link = estrdup(hdr->linkname); } phar_set_inode(&entry TSRMLS_CC); + if (entry.filename_len > 2 && entry.filename[0] == '.' && entry.filename[1] == '/') + /* Also copy trailing nul */ + memmove(entry.filename, entry.filename + 2, (entry.filename_len -= 2) + 1); zend_hash_add(&myphar->manifest, entry.filename, entry.filename_len, (void*)&entry, sizeof(phar_entry_info), (void **) &newentry); if (entry.is_persistent) { ---8<--- If erroring out on "." or ".." on tar pathnames is the expected result, please let me know. Test script: --------------- #!/usr/bin/php <?php echo "\nRunning for the broken file\n"; $path = realpath('./dotslash.tar.gz'); $pharpath = "phar://" . $path; $phardata = new PharData($path); $phariter = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($pharpath)); echo "The phar has " . $phardata->count() . " entries\n"; $i = 0; foreach($phariter as $file){ echo $file . "\n"; $i++; } echo "There were $i entries listed.\n"; echo "\nNow running for the working file\n"; $path = realpath('./nodotslash.tar.gz'); $pharpath = "phar://" . $path; $phardata = new PharData($path); $phariter = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($pharpath)); echo "The phar has " . $phardata->count() . " entries\n"; $i = 0; foreach($phariter as $file){ echo $file . "\n"; $i++; } echo "There were $i entries listed.\n"; ?> Expected result: ---------------- $ ./pharbug.php Running for the broken file The phar has 3 entries phar:///home/testuser/dotslash.tar.gz/file1 phar:///home/testuser/dotslash.tar.gz/file2 phar:///home/testuser/dotslash.tar.gz/file3 There were 3 entries listed. Now running for the working file The phar has 3 entries phar:///home/testuser/nodotslash.tar.gz/file1 phar:///home/testuser/nodotslash.tar.gz/file2 phar:///home/testuser/nodotslash.tar.gz/file3 There were 3 entries listed. Actual result: -------------- $ ./pharbug.php Running for the broken file The phar has 3 entries phar:///home/testuser/dotslash.tar.gz/. There were 1 entries listed. Now running for the working file The phar has 3 entries phar:///home/testuser/nodotslash.tar.gz/file1 phar:///home/testuser/nodotslash.tar.gz/file2 phar:///home/testuser/nodotslash.tar.gz/file3 There were 3 entries listed. -- Edit bug report at https://bugs.php.net/bug.php?id=71966&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71966&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71966&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71966&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71966&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71966&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71966&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71966&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71966&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71966&r=support Expected behavior: https://bugs.php.net/fix.php?id=71966&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71966&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71966&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71966&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71966&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71966&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71966&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71966&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71966&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71966&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71966&r=mysqlcfg