Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Merge pull request #469 from KnpLabs/fix/GHSA-gq6w-q6wh-jggc
fix: security issue GHSA-gq6w-q6wh-jggc
  • Loading branch information
AntoineLelaisant committed Mar 17, 2023
2 parents cef6d3f + 1ee6360 commit b66f793
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 0 deletions.
4 changes: 4 additions & 0 deletions src/Knp/Snappy/AbstractGenerator.php
Expand Up @@ -625,6 +625,10 @@ protected function executeCommand($command)
*/
protected function prepareOutput($filename, $overwrite)
{
if (\strpos($filename, 'phar://') === 0) {
throw new InvalidArgumentException('The output file cannot be a phar archive.');
}

$directory = \dirname($filename);

if ($this->fileExists($filename)) {
Expand Down
24 changes: 24 additions & 0 deletions tests/Knp/Snappy/AbstractGeneratorTest.php
Expand Up @@ -938,6 +938,30 @@ protected function configure(): void
);
}

public function testFailingGenerateWithOutputContainingPharPrefix(): void
{
$media = $this->getMockBuilder(AbstractGenerator::class)
->setMethods([
'configure',
'prepareOutput',
])
->setConstructorArgs(['the_binary', [], ['PATH' => '/usr/bin']])
->getMock()
;

$media->setTimeout(2000);

$media
->expects($this->once())
->method('prepareOutput')
->with($this->equalTo('phar://the_output_file'))
;

$this->expectException(InvalidArgumentException::class);

$media->generate('the_input_file', 'phar://the_output_file', ['foo' => 'bar']);
}

/**
* @return null|string
*/
Expand Down

0 comments on commit b66f793

Please sign in to comment.