Req #71966 [Com]: PHP Phar issue with leading ./ in tar archives

Edit report at https://bugs.php.net/bug.php?id=71966&edit=1 ID: 71966 Comment by: pandrade at redhat dot com Reported by: pandrade at redhat dot com Summary: PHP Phar issue with leading ./ in tar archives Status: Open Type: Feature/Change Request Package: PHAR related Operating System: Linux PHP Version: Irrelevant Block user comment: N Private report: N New Comment: Note that the attached patch is not fully functional, It works for the described problem: "./file", but fails for "./dir/file". I added it to manage to get the bug reported. Previous Comments: ------------------------------------------------------------------------ [2016-04-05 13:09:54] pandrade at redhat dot com Description: ------------ To test the below script, run first: $ touch file1 file2 file3 $ tar zcf dotslash.tar.gz ./file1 ./file2 ./file3 $ tar zcf nodotslash.tar.gz file1 file2 file3 I made an initial experiment, that "almost" works, will work for "./file" but fail for "./dir/file". ---8<--- diff -up php-5.4.16/ext/phar/tar.c.orig php-5.4.16/ext/phar/tar.c --- php-5.4.16/ext/phar/tar.c.orig 2016-03-29 11:39:57.020599910 -0300 +++ php-5.4.16/ext/phar/tar.c 2016-03-29 11:42:25.582624697 -0300 @@ -481,6 +481,9 @@ bail: entry.link = estrdup(hdr->linkname); } phar_set_inode(&entry TSRMLS_CC); + if (entry.filename_len > 2 && entry.filename[0] == '.' && entry.filename[1] == '/') + /* Also copy trailing nul */ + memmove(entry.filename, entry.filename + 2, (entry.filename_len -= 2) + 1); zend_hash_add(&myphar->manifest, entry.filename, entry.filename_len, (void*)&entry, sizeof(phar_entry_info), (void **) &newentry); if (entry.is_persistent) { ---8<--- If erroring out on "." or ".." on tar pathnames is the expected result, please let me know. Test script: --------------- #!/usr/bin/php <?php echo "\nRunning for the broken file\n"; $path = realpath('./dotslash.tar.gz'); $pharpath = "phar://" . $path; $phardata = new PharData($path); $phariter = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($pharpath)); echo "The phar has " . $phardata->count() . " entries\n"; $i = 0; foreach($phariter as $file){ echo $file . "\n"; $i++; } echo "There were $i entries listed.\n"; echo "\nNow running for the working file\n"; $path = realpath('./nodotslash.tar.gz'); $pharpath = "phar://" . $path; $phardata = new PharData($path); $phariter = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($pharpath)); echo "The phar has " . $phardata->count() . " entries\n"; $i = 0; foreach($phariter as $file){ echo $file . "\n"; $i++; } echo "There were $i entries listed.\n"; ?> Expected result: ---------------- $ ./pharbug.php Running for the broken file The phar has 3 entries phar:///home/testuser/dotslash.tar.gz/file1 phar:///home/testuser/dotslash.tar.gz/file2 phar:///home/testuser/dotslash.tar.gz/file3 There were 3 entries listed. Now running for the working file The phar has 3 entries phar:///home/testuser/nodotslash.tar.gz/file1 phar:///home/testuser/nodotslash.tar.gz/file2 phar:///home/testuser/nodotslash.tar.gz/file3 There were 3 entries listed. Actual result: -------------- $ ./pharbug.php Running for the broken file The phar has 3 entries phar:///home/testuser/dotslash.tar.gz/. There were 1 entries listed. Now running for the working file The phar has 3 entries phar:///home/testuser/nodotslash.tar.gz/file1 phar:///home/testuser/nodotslash.tar.gz/file2 phar:///home/testuser/nodotslash.tar.gz/file3 There were 3 entries listed. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71966&edit=1