Repository navigation
CLI server: prevent using symlinks to escape the docroot - #23975
DanielEScherzer wants to merge 3 commits into
Conversation
|
Is this mitigation needed? I personally wouldn't think so. The built-in web server is documented to be a development tool only. |
Not strictly needed, but mythos flagged it as a footgun and it seems harmless to fix it so that the development tool is more secure But because it is a development tool I didn't file a security report and send a patch for 8.2 (or even 8.4), just 8.6 |
66cb1d7 to
1abfffe
Compare
Sjord
left a comment
Sjord
left a comment
There was a problem hiding this comment.
I am not sure whether this is a good idea. Using symlinks can be a bug or a feature. I think it can be useful to symlink other directories into the webroot. I imagine it being used quite often, so making it impossible can break people's workflows. I would like to see an RFC or at least a mailing list discussion on this.
This is for the CLI server, which is explicitly a development only tool, and is documented as an experimental feature, https://www.php.net/manual/en/features.commandline.webserver.php |
1abfffe to
37dead4
Compare
|
@DanielEScherzer Just to clarify: I don't object to this change. But I'll need some more time for the review, unless somebody beats me to it. |
37dead4 to
dbfeb8a
Compare
The server properly prevents escaping the document root with path traversal, but does not account for escaping through the use of existing symlinks under the document root. Add a test so that when the behavior changes it is visible.
In `php_cli_server_request_translate_vpath()`, after translating the requested path, confirm that `realpath()` returns a path that is contained in the document root.
dbfeb8a to
b4e9c45
Compare
No description provided.