Fixed bug #49026 (proc_open() can bypass safe_mode_protected_env_vars

restrictions).

diff --git a/NEWS b/NEWS
index 4b52774f13967d3dbf25cedeaca08445a6706602..3fd0205829126c53ec3ddeb67080fcce7d7c810b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,8 @@ PHP                                                                        NEWS
   --with-curlwrappers). (Jani)
 - Fixed bug #49032 (SplFileObject::fscanf() variables passed by reference).
   (Jani)
+- Fixed bug #49026 (proc_open() can bypass safe_mode_protected_env_vars
+  restrictions). (Ilia)
 - Fixed bug #48980 (Crash when compiling with pdo_firebird). (Felipe)
 - Fixed bug #48962 (cURL does not upload files with specified filename).
   (Ilia)

diff --git a/ext/standard/proc_open.c b/ext/standard/proc_open.c
index 57beb8c5525d4c37aef99a80da528395f91a1c8d..a70b3362b22cf037a9a0ecd927f6bc8da74f8c72 100644 (file)
--- a/ext/standard/proc_open.c
+++ b/ext/standard/proc_open.c
@@ -30,6 +30,7 @@
 #include "php_string.h"
 #include "safe_mode.h"
 #include "ext/standard/head.h"
+#include "ext/standard/basic_functions.h"
 #include "ext/standard/file.h"
 #include "exec.h"
 #include "php_globals.h"
@@ -152,6 +153,34 @@ static php_process_env_t _php_array_to_envp(zval *environment, int is_persistent
                                if (string_length == 0) {
                                        continue;
                                }
+                               if (PG(safe_mode)) {
+                                       /* Check the protected list */
+                                       if (zend_hash_exists(&BG(sm_protected_env_vars), string_key, string_length - 1)) {
+                                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Safe Mode warning: Cannot override protected environment variable '%s'", string_key);
+                                               return env;
+                                       }
+                                       /* Check the allowed list */
+                                       if (BG(sm_allowed_env_vars) && *BG(sm_allowed_env_vars)) {
+                                               char *allowed_env_vars = estrdup(BG(sm_allowed_env_vars));
+                                               char *strtok_buf = NULL;
+                                               char *allowed_prefix = php_strtok_r(allowed_env_vars, ", ", &strtok_buf);
+                                               zend_bool allowed = 0;
+
+                                               while (allowed_prefix) {
+                                                       if (!strncmp(allowed_prefix, string_key, strlen(allowed_prefix))) {
+                                                               allowed = 1;
+                                                               break;
+                                                       }
+                                                       allowed_prefix = php_strtok_r(NULL, ", ", &strtok_buf);
+                                               }
+                                               efree(allowed_env_vars);
+                                               if (!allowed) {
+                                                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Safe Mode warning: Cannot set environment variable '%s' - it's not in the allowed list", string_key);
+                                                       return env;
+                                               }
+                                       }
+                               }
+
                                l = string_length + el_len + 1;
                                memcpy(p, string_key, string_length);
                                strcat(p, "=");