Snuffleupagus writable execution of eval'd code ?

[gnd]

Hi,

i notice that after enabling readonly_exec() i get these kind of errors:

Mar 22 12:48:20 xxx snuffleupagus[3179578]: [snuffleupagus][0.0.0.0][Writable execution][log] Error while accessing /xxx/wp-content/plugins/sitepress-multilingual-cms/lib/twig/src/Environment.php(442) : eval()'d code: No such file or directory in /xxx/wp-content/plugins/sitepress-multilingual-cms/lib/twig/src/Environment.php(442) : eval()'d code on line 29

What is Snuffleupagus doing here ? In the Enviroment.php it seems like the plugin is building a sort of template that is then executed with eval(). How can I solve this issue without giving up on readonly_exec() ?

thanks !

[jvoisin]

Can you please:

• check if /xxx/wp-content/plugins/sitepress-multilingual-cms/lib/twig/src/Environment.php is writable
• Provide the file or a link to it
  • Is it https://github.com/OpendataCH/sitepress-multilingual-cms/blob/master/lib/twig/src/Environment.php?
• What version of Snuffleupagus are you using?
• What version of php are you using?

[gnd]

Hi,

• the file is not writable, otherwise would not bother you.
• Yes, that is the file. To make sure, i also attach a copy of it (renamed to .log)
  Environment.log
• Snuffleupagus compiled from HEAD @ eede222
• php-fpm 7.4.28.1

[gnd]

HI, I wonder if you had any time to check this ? Thanks )

[jvoisin]

I still have to coordinate with @bef, so this one is still on the backburner for now, sorry :/

[bef]

This definitely sounds like a bug. Unfortunately I failed to reproduce the error.

I suspect some kind of construct like eval(include(file.php)) with file.php once more containing eval(include(...)) may not be caught properly. I will look into that.

In the meantime, have you tried the latest head from 2022? Maybe the bug magically disappeared?

On a more general note, having a template system like Twig writing some kind of cache file and then reading the cache file for execution at a later stage is exactly what readonly_exec is trying to prevent in the first place, so even after fixing the bug, Twig most likely won't be running with readonly_exec enabled. Maybe we introduce whitelisted directories, which may be dangerous if configured incorrectly. What do you think @jvoisin ?

[bef]

After some testing I failed to recreate the problem using the current master/head version.