Fix #79467: data:// wrappers are writable

Despite the docs claiming that data: wrappers would not be writable[1],
they are implemented as writing to a memory stream.  That does not seem
to be particularly sensible, so we disallow writing altogether.

[1] <https://www.php.net/manual/en/wrappers.data.php#refsect1-wrappers.data-options>

diff --git a/NEWS b/NEWS
index 94e8e4855f3e8e5206492d04366cdf8cc29f0661..5536119a808147d16bdaa567e7c3b5c7c18fd3ec 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -24,6 +24,7 @@ PHP                                                                        NEWS
     (cmb)
   . Use SSE2 instructions do locale independent strtolower. (Laruence)
   . Fixed bug #79521 (Check __set_state structure). (carusogabriel)
+  . Fixed bug #79467 (data:// wrappers are writable). (cmb)
 
 - BZ2:
   . Fixed bug #71263 (fread() does not report bzip2.decompress errors). (cmb)

diff --git a/UPGRADING b/UPGRADING
index fc832ba2e37b2e8fce6dfcfaeb4eed659792c92f..5345111acc0e1066aa9723f234a6d8b3aabd1186 100644 (file)
--- a/UPGRADING
+++ b/UPGRADING
@@ -181,6 +181,7 @@ PHP 8.0 UPGRADE NOTES
   . Disabled functions are now treated exactly like non-existent functions.
     Calling a disabled function will report it as unknown, and redefining a
     disabled function is now possible.
+  . data: wrappers are no longer writable, what matches the documented behavior.
 
 - COM:
   . Removed the ability to import case-insensitive constants from type

diff --git a/ext/standard/tests/streams/bug79467.phpt b/ext/standard/tests/streams/bug79467.phpt
new file mode 100644 (file)
index 0000000..0611601
--- /dev/null
+++ b/ext/standard/tests/streams/bug79467.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Bug #79467 (data:// wrappers are writable)
+--FILE--
+<?php
+var_dump(file_put_contents('data://text/plain,cccc', 'data'));
+?>
+--EXPECTF--
+Notice: file_put_contents(): Stream is not writable in %s on line %d
+bool(false)

diff --git a/main/streams/memory.c b/main/streams/memory.c
index 6929ee480dcc180ba6d80264a38bf29601b6d298..35be57d3c38f1de033054cddbdf762f36c4663ce 100644 (file)
--- a/main/streams/memory.c
+++ b/main/streams/memory.c
@@ -619,7 +619,7 @@ PHPAPI php_stream *_php_stream_temp_open(int mode, size_t max_memory_usage, char
 /* }}} */
 
 PHPAPI const php_stream_ops php_stream_rfc2397_ops = {
-       php_stream_temp_write, php_stream_temp_read,
+       NULL, php_stream_temp_read,
        php_stream_temp_close, php_stream_temp_flush,
        "RFC2397",
        php_stream_temp_seek,