[doc-en] master: Phar extraction: add warning about following symlinks (#5864)

Author: Daniel Scherzer (DanielEScherzer) Committer: GitHub (web-flow) Pusher: DanielEScherzer Date: 2026-09-23T17:10:17-07:00 Commit: https://github.com/php/doc-en/commit/04c8b5cf613b1b8ad5cdd80f17b872ad4012f0b8 Raw diff: https://github.com/php/doc-en/commit/04c8b5cf613b1b8ad5cdd80f17b872ad4012f0b8.diff Phar extraction: add warning about following symlinks (#5864) Add a warning to both Phar::extractTo() and PharData::extractTo() about the fact that symlinks in the target directory are followed. Changed paths: M reference/phar/Phar/extractTo.xml M reference/phar/PharData/extractTo.xml Diff: diff --git a/reference/phar/Phar/extractTo.xml b/reference/phar/Phar/extractTo.xml index 59d34b8ada0e..aa85a612d409 100644 --- a/reference/phar/Phar/extractTo.xml +++ b/reference/phar/Phar/extractTo.xml @@ -25,6 +25,28 @@ set to true to enable overwriting of files. This method is similar to <function>ZipArchive::extractTo</function>. </para> + + <warning> + <para> + Extraction follows any existing symlinks in the target + <parameter>directory</parameter>. If there is a symlink present in the + target <parameter>directory</parameter>: + + <simplelist> + <member> + if the symlink is to another directory, files may be extracted + outside of the desired location. + </member> + <member> + if the symlink is to a file that does not exist, it will be created. + </member> + <member> + if the symlink is to a file that exists, the target will be overwritten + when <parameter>overwrite</parameter> is true. + </member> + </simplelist> + </para> + </warning> </refsect1> <refsect1 role="parameters"> diff --git a/reference/phar/PharData/extractTo.xml b/reference/phar/PharData/extractTo.xml index 2b95f74b40d3..0215224731ac 100644 --- a/reference/phar/PharData/extractTo.xml +++ b/reference/phar/PharData/extractTo.xml @@ -25,6 +25,28 @@ set to true to enable overwriting of files. This method is similar to <function>ZipArchive::extractTo</function>. </para> + + <warning> + <para> + Extraction follows any existing symlinks in the target + <parameter>directory</parameter>. If there is a symlink present in the + target <parameter>directory</parameter>: + + <simplelist> + <member> + if the symlink is to another directory, files may be extracted + outside of the desired location. + </member> + <member> + if the symlink is to a file that does not exist, it will be created. + </member> + <member> + if the symlink is to a file that exists, the target will be overwritten + when <parameter>overwrite</parameter> is true. + </member> + </simplelist> + </para> + </warning> </refsect1> <refsect1 role="parameters">