Sec Bug->Bug #78141 [Opn]: open_basedir bug when write files on root directory

Edit report at https://bugs.php.net/bug.php?id=78141&edit=1 ID: 78141 Updated by: cmb@php.net Reported by: phith0n dot ph2f at gmail dot com Summary: open_basedir bug when write files on root directory Status: Open -Type: Security +Type: Bug Package: Filesystem function related Operating System: Any PHP Version: 7.3.6 Block user comment: N Private report: Y New Comment: open_basedir bypasses are not considered to be security issues; cf. <https://externals.io/message/105606> and <https://externals.io/message/115406>. Previous Comments: ------------------------------------------------------------------------ [2020-05-11 21:01:45] stas@php.net Looks like on that image, if file doesn't exist, it creates it, but if it does exist, it returns error. Does not reproduce on my local machine. Weird. ------------------------------------------------------------------------ [2020-05-06 15:15:46] cmb@php.net Thanks for checking! ------------------------------------------------------------------------ [2020-05-06 13:32:48] phith0n dot ph2f at gmail dot com Hi @cmb. I still have this bug. I test it on the latest version of PHP 7.4 in docker: # root @ OrangeDeafening-VM in ~ [21:06:31] $ docker pull php:7.4 7.4: Pulling from library/php 54fec2fa59d0: Pull complete cc4504446071: Pull complete f8d55b89827d: Pull complete 6bf7f8bea876: Pull complete 9a178eabfa4a: Pull complete 99583d0b7ff2: Pull complete 79c3ed7f9118: Pull complete cc3f66def185: Pull complete 4f837fda4b52: Pull complete Digest: sha256:aa449b3b778a3549a89dde21b35261516ecabd84891081b72000a8f94a457f3c Status: Downloaded newer image for php:7.4 # root @ OrangeDeafening-VM in ~ [21:07:22] $ docker run -it --rm --name uu php:7.4 bash root@ead2e727ca67:/# cd /var/www/ root@ead2e727ca67:/var/www# ls html root@ead2e727ca67:/var/www# cd html/ root@ead2e727ca67:/var/www/html# ls root@ead2e727ca67:/var/www/html# php -d open_basedir=/var/www/html/ -r "file_put_contents('/file_put_contents', 'data');" root@ead2e727ca67:/var/www/html# ls -al /file_put_contents -rw-r--r-- 1 root root 4 May 6 13:08 /file_put_contents root@ead2e727ca67:/var/www/html# php -v PHP 7.4.5 (cli) (built: Apr 23 2020 16:39:51) ( NTS ) Copyright (c) The PHP Group Zend Engine v3.4.0, Copyright (c) Zend Technologies root@ead2e727ca67:/var/www/html# I also test it on Ubuntu 18.04, but the result is different. I am not sure if this bug only affects docker PHP or source-compiled PHP. ------------------------------------------------------------------------ [2020-05-05 12:31:40] cmb@php.net I cannot reproduce the reported behavior (for me, an open_basedir warning is raised). Does this still happen to you? ------------------------------------------------------------------------ [2019-06-11 10:03:34] phith0n dot ph2f at gmail dot com browser history of title is always wrong... ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=78141 -- Edit this bug report at https://bugs.php.net/bug.php?id=78141&edit=1