com php-src: Fix #70264: CLI server directory traversal: sapi/cli/php_cli_server.c sapi/cli/tests/bug702 64.phpt

Commit: 9c805a6cb31596c41609512bdd8a9a76c9ce9b15 Author: Christoph M. Becker <cmb@php.net> Fri, 14 Aug 2015 16:56:40 +0200 Parents: 0e51f9798c6cea1b155cb18342a43c54be55a1fd Branches: PHP-5.6 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=9c805a6cb31596c41609512bdd8a9a76c9ce9b15 Log: Fix #70264: CLI server directory traversal On Windows the built-in webserver doesn't prevent directory traversal when backslashes are used as path component separators. Even though that is not a security issue (the CLI webserver is meant for testing only), we fix that by replacing backslashes in the path with slashes on Windows, because backslashes may be valid characters for file names on other systems, but not on Windows. Bugs: https://bugs.php.net/70264 Changed paths: M sapi/cli/php_cli_server.c A sapi/cli/tests/bug70264.phpt Diff: diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c index 0022678..e4ea00a 100644 --- a/sapi/cli/php_cli_server.c +++ b/sapi/cli/php_cli_server.c @@ -1579,6 +1579,18 @@ static void normalize_vpath(char **retval, size_t *retval_len, const char *vpath decoded_vpath_end = decoded_vpath + php_url_decode(decoded_vpath, vpath_len); +#ifdef PHP_WIN32 + { + char *p = decoded_vpath; + + do { + if (*p == '\\') { + *p = '/'; + } + } while (*p++); + } +#endif + p = decoded_vpath; if (p < decoded_vpath_end && *p == '/') { diff --git a/sapi/cli/tests/bug70264.phpt b/sapi/cli/tests/bug70264.phpt new file mode 100644 index 0000000..877b119 --- /dev/null +++ b/sapi/cli/tests/bug70264.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #70264 (CLI server directory traversal) +--INI-- +allow_url_fopen=1 +--SKIPIF-- +<?php +include "skipif.inc"; +?> +--FILE-- +<?php +include "php_cli_server.inc"; +php_cli_server_start(null, null); +echo file_get_contents("http://" . PHP_CLI_SERVER_ADDRESS . "/..\\CREDITS"); +echo file_get_contents("http://" . PHP_CLI_SERVER_ADDRESS . "/..%5CCREDITS"); +?> +--EXPECTF-- +Warning: file_get_contents(http://%s/..\CREDITS): failed to open stream: HTTP request failed! HTTP/1.0 404 Not Found + in %sbug70264.php on line %d + +Warning: file_get_contents(http://%s/..%5CCREDITS): failed to open stream: HTTP request failed! HTTP/1.0 404 Not Found + in %sbug70264.php on line %d