Fix #76929: zip-based phar does not respect phar.require_hash

Based on the patch provided by david at bamsoftware.

Closes GH-6517.

diff --git a/NEWS b/NEWS
index 446dd9be21cbe550b9284180d3c2ffd6b80e1bf2..57572a1417d6c1a5b8b8172802fd09bb6b1b3948 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -28,6 +28,10 @@ PHP                                                                        NEWS
   . Fixed bug #80521 (Parameters with underscores no longer recognized). (cmb,
     Simonov Denis)
 
+- Phar:
+  . Fixed bug #76929 (zip-based phar does not respect phar.require_hash).
+    (david at bamsoftware, cmb)
+
 07 Jan 2021, PHP 8.0.1
 
 - Core:

diff --git a/ext/phar/tests/zip/badalias.phpt b/ext/phar/tests/zip/badalias.phpt
index 9e7fdf809145819020308c4b097bfb9c606aef6a..81e5be55fd895a51d9ba93d99b04279c210392d1 100644 (file)
--- a/ext/phar/tests/zip/badalias.phpt
+++ b/ext/phar/tests/zip/badalias.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar: invalid aliases
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip no zlib"); ?>

diff --git a/ext/phar/tests/zip/bzip2.phpt b/ext/phar/tests/zip/bzip2.phpt
index 13bdde3ea6b9cd9654fecb37b577e4c43ddb9abd..3a51c52957bdd37c42f6688cd416e5b86564f232 100644 (file)
--- a/ext/phar/tests/zip/bzip2.phpt
+++ b/ext/phar/tests/zip/bzip2.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar: process bzip2-compressed zip entry
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("bz2")) die("skip bz2 not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller1.phar.phpt b/ext/phar/tests/zip/frontcontroller1.phar.phpt
index b4ace60869e2c0f815c188c36964ce85849b9448..bbd5208b64ba70361383fc25d2226588e496caf8 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller1.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller1.phar.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar front controller other zip-based
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller11.phar.phpt b/ext/phar/tests/zip/frontcontroller11.phar.phpt
index 15534d02c5b246ea91edbb7400016f39f15f5a7e..ce36f32f04e40c3504051fb8ca39e9ee332a4687 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller11.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller11.phar.phpt
@@ -2,6 +2,7 @@
 Phar front controller mime type extension is not a string zip-based
 --INI--
 default_charset=
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip phar extension not loaded"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller12.phar.phpt b/ext/phar/tests/zip/frontcontroller12.phar.phpt
index b0caca91ac8468f5704e0a475c945aed7b6f0334..9f5b0a13aa988d59130086e54156dff3f1a16112 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller12.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller12.phar.phpt
@@ -2,6 +2,7 @@
 Phar front controller mime type unknown int zip-based
 --INI--
 default_charset=UTF-8
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller13.phar.phpt b/ext/phar/tests/zip/frontcontroller13.phar.phpt
index 18a1c1fd2f8a42f34340364a74e881b14de86ccd..5d2a77e4ac255b95603d449aa987c9d3fca06b9b 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller13.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller13.phar.phpt
@@ -2,6 +2,7 @@
 Phar front controller mime type not string/int zip-based
 --INI--
 default_charset=UTF-8
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller14.phar.phpt b/ext/phar/tests/zip/frontcontroller14.phar.phpt
index 496160b12fbf3bf61424ddd2aa781e1babd7e730..9a3e34a90f29426daaa71b9a3eb6f45282f7e14d 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller14.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller14.phar.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar front controller mime type override, other zip-based
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller15.phar.phpt b/ext/phar/tests/zip/frontcontroller15.phar.phpt
index f6468ee5210dfe6198a71a5273435e5860c5178c..04fdc57ef02207fee8fe781584bad8d499196f51 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller15.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller15.phar.phpt
@@ -2,6 +2,7 @@
 Phar front controller mime type override, Phar::PHPS zip-based
 --INI--
 default_charset=UTF-8
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller16.phar.phpt b/ext/phar/tests/zip/frontcontroller16.phar.phpt
index 890eb5d0e2a2f376d75948bc53b82680765b527f..6c75f7df517424041c912338e30ee110354393b7 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller16.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller16.phar.phpt
@@ -2,6 +2,7 @@
 Phar front controller mime type override, Phar::PHP zip-based
 --INI--
 default_charset=UTF-8
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller17.phar.phpt b/ext/phar/tests/zip/frontcontroller17.phar.phpt
index d6ccdc6dfcd760a6c16ca89f24d048ab28b10095..b4bce3dced665a5b3645a578bc437f9038562737 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller17.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller17.phar.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar front controller mime type unknown zip-based
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller18.phar.phpt b/ext/phar/tests/zip/frontcontroller18.phar.phpt
index 3d01527122729e81d1619c2cc7b61f4663395fec..963170949eb6d36dfbaec108387db9665dd3978c 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller18.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller18.phar.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar front controller $_SERVER munging failure zip-based
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller19.phar.phpt b/ext/phar/tests/zip/frontcontroller19.phar.phpt
index db66ea48b0a92bd25d2048da7cb68c1a039d37f3..c478f428e5401e84dc6e653e2e574089d2e974f8 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller19.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller19.phar.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar front controller $_SERVER munging failure 2 zip-based
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller2.phar.phpt b/ext/phar/tests/zip/frontcontroller2.phar.phpt
index e143e79f3f6fc009348939ab7e1d0f137b510956..d4910e4f7da67cf253490131719c59833bc77afe 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller2.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller2.phar.phpt
@@ -2,6 +2,7 @@
 Phar front controller PHP test zip-based
 --INI--
 default_charset=UTF-8
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller20.phar.phpt b/ext/phar/tests/zip/frontcontroller20.phar.phpt
index 3bab3bfd80c9869b752b309cc55a1a913c1bacc1..fde3590a28c228aef6a488469d05a3bf4a0ac4dc 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller20.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller20.phar.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar front controller $_SERVER munging failure 3 zip-based
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller3.phar.phpt b/ext/phar/tests/zip/frontcontroller3.phar.phpt
index 88a8a2490d8bc056d264a8081c784731e7203c2e..a9f5990d58758808afa72fb60fe8244698314212 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller3.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller3.phar.phpt
@@ -2,6 +2,7 @@
 Phar front controller phps zip-based
 --INI--
 default_charset=UTF-8
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller4.phar.phpt b/ext/phar/tests/zip/frontcontroller4.phar.phpt
index ff85eb6ab60713cb5359b547c83581978f797abe..fe49598695bb8b28004cfd104a33064ec1f97889 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller4.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller4.phar.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar front controller index.php relocate (no /) zip-based
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller5.phar.phpt b/ext/phar/tests/zip/frontcontroller5.phar.phpt
index 1705fac4c492be5b9d6244b0c1feb1a2a8f673bd..4aefdf5b08ce234469dcec9225c34c9b34fbe4eb 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller5.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller5.phar.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar front controller index.php relocate zip-based
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller6.phar.phpt b/ext/phar/tests/zip/frontcontroller6.phar.phpt
index 8188caf7c951f4fa4c6dbd58c0c8ecbc11e23332..bbf702d1d268d72ba8b4e89bee1bf45a1d80cabe 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller6.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller6.phar.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar front controller 404 zip-based
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/frontcontroller7.phar.phpt b/ext/phar/tests/zip/frontcontroller7.phar.phpt
index 828da0aeb49458dc0c76c9ff6129ca99c169121e..0a67802c7f7c8b9180423d555d25a76b0c6ae368 100644 (file)
--- a/ext/phar/tests/zip/frontcontroller7.phar.phpt
+++ b/ext/phar/tests/zip/frontcontroller7.phar.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar front controller alternate index file zip-based
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/tests/zip/getalias.phpt b/ext/phar/tests/zip/getalias.phpt
index e8ab8494cfb947aa0acb58871b4f20c1d55b544a..63ce629ef4e11ff56b3d3a1d7f781a290a41337c 100644 (file)
--- a/ext/phar/tests/zip/getalias.phpt
+++ b/ext/phar/tests/zip/getalias.phpt
@@ -4,6 +4,7 @@ Phar: getAlias() with an existing phar.zip
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 --INI--
 phar.readonly=0
+phar.require_hash=0
 --FILE--
 <?php
 

diff --git a/ext/phar/tests/zip/require_hash.phpt b/ext/phar/tests/zip/require_hash.phpt
new file mode 100644 (file)
index 0000000..2394355
--- /dev/null
+++ b/ext/phar/tests/zip/require_hash.phpt
@@ -0,0 +1,56 @@
+--TEST--\r
+Phar: zip-based phar, require_hash=1, no signature\r
+--SKIPIF--\r
+<?php if (!extension_loaded('phar')) die('skip'); ?>\r
+--INI--\r
+phar.readonly=1\r
+phar.require_hash=0\r
+--FILE--\r
+<?php\r
+ini_set('phar.require_hash', 1);\r
+include __DIR__ . '/files/zipmaker.php.inc';\r
+$fname = __DIR__ . '/require_hash.phar.zip';\r
+$alias = 'phar://' . $fname;\r
+$fname2 = __DIR__ . '/require_hash.zip';\r
+\r
+$zip = new zipmaker($fname);\r
+$zip->init();\r
+$zip->addFile('zip_001.php', '<?php var_dump(__FILE__);');\r
+$zip->addFile('internal/file/here', "hi there!\n");\r
+$zip->addFile('.phar/stub.php', "__HALT_COMPILER();");\r
+$zip->close();\r
+\r
+try {\r
+       $phar = new Phar($fname);\r
+       var_dump($phar->getStub());\r
+} catch (Exception $e) {\r
+       echo $e->getMessage()."\n";\r
+}\r
+ini_set('phar.require_hash', 0);\r
+try {\r
+       $phar = new PharData($fname2);\r
+       $phar['file'] = 'hi';\r
+       var_dump($phar->getSignature());\r
+       $phar->setSignatureAlgorithm(Phar::MD5);\r
+       var_dump($phar->getSignature());\r
+} catch (Exception $e) {\r
+       echo $e->getMessage()."\n";\r
+}\r
+\r
+?>\r
+===DONE===\r
+--CLEAN--\r
+<?php\r
+@unlink(__DIR__ . '/require_hash.phar.zip');\r
+@unlink(__DIR__ . '/require_hash.zip');\r
+?>\r
+--EXPECTF--\r
+zip-based phar "%srequire_hash.phar.zip" does not have a signature\r
+bool(false)\r
+array(2) {\r
+  ["hash"]=>\r
+  string(32) "%s"\r
+  ["hash_type"]=>\r
+  string(3) "MD5"\r
+}\r
+===DONE===\r

diff --git a/ext/phar/tests/zip/zlib.phpt b/ext/phar/tests/zip/zlib.phpt
index 96b63e73a6f41f0065afd26acd1313934df3f2ad..a51ad5e5fd90d18a6089f9c040205495ffc5e186 100644 (file)
--- a/ext/phar/tests/zip/zlib.phpt
+++ b/ext/phar/tests/zip/zlib.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Phar: process zlib-compressed zip alias
+--INI--
+phar.require_hash=0
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 <?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>

diff --git a/ext/phar/zip.c b/ext/phar/zip.c
index 1d7c5b2217fd0d70804d417eb2d58acfa23a6b55..1b94943ad302e0611f6d98567e91dc2beb2e5118 100644 (file)
--- a/ext/phar/zip.c
+++ b/ext/phar/zip.c
@@ -673,6 +673,16 @@ foundit:
                mydata->is_data = 1;
        }
 
+       /* ensure signature set */
+       if (!mydata->is_data && PHAR_G(require_hash) && !mydata->signature) {
+               php_stream_close(fp);
+               phar_destroy_phar_data(mydata);
+               if (error) {
+                       spprintf(error, 0, "zip-based phar \"%s\" does not have a signature", fname);
+               }
+               return FAILURE;
+       }
+
        zend_hash_str_add_ptr(&(PHAR_G(phar_fname_map)), mydata->fname, fname_len, mydata);
 
        if (actual_alias) {