#31305 [NEW]: The cURL function bypasses open_basedir restriction

From: pavel at msmu dot ru Operating system: Linux PHP version: 4.3.10 PHP Bug Type: cURL related Bug description: The cURL function bypasses open_basedir restriction Description: ------------ It is possible to access a file which is outside directory specified in open_basedir directive. This bug is really easy to reproduce - just set some open_basedir and try to read the contents of, for example, /etc/passwd I didn't find this bug, I read about it on security-related web-site, checked it, and it worked :( Reproduce code: --------------- <?php $var1 = curl_init("file:///etc/passwd"); $anyfile=curl_exec($var1); echo $anyfile ?> Expected result: ---------------- I would expect an error in the log saying about open_basedir restriction and access to the file being denied. Actual result: -------------- you'll get the contents of /etc/passwd -- Edit bug report at http://bugs.php.net/?id=31305&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=31305&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=31305&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=31305&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=31305&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=31305&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=31305&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=31305&r=needscript Try newer version: http://bugs.php.net/fix.php?id=31305&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=31305&r=support Expected behavior: http://bugs.php.net/fix.php?id=31305&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=31305&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=31305&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=31305&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=31305&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=31305&r=dst IIS Stability: http://bugs.php.net/fix.php?id=31305&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=31305&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=31305&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=31305&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=31305&r=mysqlcfg