[11.x] Fix PHP_MAXPATHLEN check for existing check of files for views #50962
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
joshuaruesweg
force-pushed
the
fix_php_maxpathlen_views
branch
5 times, most recently
from
7fa41d6
to
cfaa329
Compare
A PHP warning can occur if the filename is a little less than (or equal to) \PHP_MAXPATHLEN [1] AND open_basedir [2] is configured (otherwise PHP will not throw this error [3]). By searching for the filename and appending a suffix (and also using the absolute path), we may exceed the limit. If the limit is exceeded, PHP throws a warning message [4] and Laravel aborts the execution of the code. [1] https://www.php.net/manual/en/reserved.constants.php#constant.php-maxpathlen [2] https://www.php.net/manual/en/ini.core.php#ini.open-basedir [3] https://github.com/php/php-src/blob/7c860628cd2bf11ee867bfb41b3fd0314c5177c5/main/fopen_wrappers.c#L302 [4] File name is longer than the maximum allowed path length on this platform
A PHP warning can occur if the filename is a little less than (or equal to) \PHP_MAXPATHLEN [1] AND open_basedir [2] is configured (otherwise PHP will not throw this error [3]). By searching for the filename and appending a suffix (and also using the absolute path), we may exceed the limit. If the limit is exceeded, PHP throws a warning message [4] and Laravel aborts the execution of the code. [1] https://www.php.net/manual/en/reserved.constants.php#constant.php-maxpathlen [2] https://www.php.net/manual/en/ini.core.php#ini.open-basedir [3] https://github.com/php/php-src/blob/7c860628cd2bf11ee867bfb41b3fd0314c5177c5/main/fopen_wrappers.c#L302 [4] File name is longer than the maximum allowed path length on this platform
joshuaruesweg
force-pushed
the
fix_php_maxpathlen_views
branch
from
cfaa329
to
50b8885
Compare
joshuaruesweg
added a commit
to joshuaruesweg/framework
that referenced
this pull request
Jun 20, 2024
The previous test was wrong. In fact, `PHP_MAXPATHLEN` is not the maximum length of a file, but `PHP_MAXPATHLEN - 1`. This is checked internally in the PHP source code and if the file is PHP_MAXPATHLEN characters long or longer, the error is thrown in Open-Base-Dir [1]. The problem was incompletely fixed here: laravel#50962 [1] https://github.com/php/php-src/blob/7c860628cd2bf11ee867bfb41b3fd0314c5177c5/main/fopen_wrappers.c#L301
taylorotwell
pushed a commit
that referenced
this pull request
Jun 20, 2024
…_MAXPATHLEN (#51850) * Fix `PHP_MAXPATHLEN` test This test was incorrect because it does not take into account the paths that are prefixed in the FileViewFinder. This means that we have so far tested a path that is significantly longer than `PHP_MAXPATHLEN`. As we cannot reliably access the path, we approach `PHP_MAXPATHLEN` and test all file names from `PHP_MAXPATHLEN - 200` to `PHP_MAXPATHLEN + 1`. * Fix `PHP_MAXPATHLEN` check The previous test was wrong. In fact, `PHP_MAXPATHLEN` is not the maximum length of a file, but `PHP_MAXPATHLEN - 1`. This is checked internally in the PHP source code and if the file is PHP_MAXPATHLEN characters long or longer, the error is thrown in Open-Base-Dir [1]. The problem was incompletely fixed here: #50962 [1] https://github.com/php/php-src/blob/7c860628cd2bf11ee867bfb41b3fd0314c5177c5/main/fopen_wrappers.c#L301
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Laravel can throw an error
File name is longer than the maximum allowed path length on this platform, If a string is passed to the functionBlade::render, which is the same length or slightly shorter than\PHP_MAXPATHLEN[1]. This happens due to an invalid check for the filename, because the filename gets an prefix (full path) and suffix (e.g..blade.php) before the existence is checked. This leads to a filename, which is greater than\PHP_MAXPATHLENwhich results in a PHP warning.Thus PHP warning is only thrown, if
open_basedir[2] is configured [3].[1] https://www.php.net/manual/en/reserved.constants.php#constant.php-maxpathlen
[2] https://www.php.net/manual/en/ini.core.php#ini.open-basedir
[3] https://github.com/php/php-src/blob/7c860628cd2bf11ee867bfb41b3fd0314c5177c5/main/fopen_wrappers.c#L302