[php-src] PR #23213: ext/curl: apply open_basedir restriction to CURLOPT_SSLENGINE
| From: | Sjord | Date: | Tue, 11 Aug 2026 08:32:27 +0000 |
| Subject: | [php-src] PR #23213: ext/curl: apply open_basedir restriction to CURLOPT_SSLENGINE | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37760@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23213
Author: Sjord
CURLOPT_SSLENGINE normally takes an engine name, but in some cases the passed string is loaded as a
shared library. Validate it against open_basedir to restrict the locations the shared library can be
loaded from.
Related to https://github.com/php/php-src/issues/22035,
but does not solve it.