Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:17834
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <002601c59e84$628da990$65d41a44@lighthammer>
To: "\"Kamesh Jayachandran\"" <kameshj@fastmail.fm>
Cc: <internals@lists.php.net>
References: <1123760274.4692.240461014@webmail.messagingengine.com>
Date: Thu, 11 Aug 2005 07:52:56 -0700
MIME-Version: 1.0
Content-Type: text/plain;
	format=flowed;
	charset="iso-8859-1";
	reply-type=original
Content-Transfer-Encoding: 7bit
Subject: Re: realpath is not available in all LibCs
From: pollita@php.net ("Sara Golemon")

> Version PHP 5.1
> file main/php_init.c
> function int php_init_config() uses realpath.
> In NetWare our earlier releases of LibC SDK has no realpath
> implementation.
>
> I could see the following lines in TSRM/tsrm_virtual_cwd.c
>
> #ifndef HAVE_REALPATH
> #define realpath(x,y) strcpy(y,x)
> #endif
>
> Why not this be in TSRM/tsrm_virtual_cwd.h so that it will work in all
> the cases.
>
> Can I go ahead and checkin this?
>
I have two concerns with this "solution" (both here and in TSRM).

(1) Security:  Both internally with checks such as open_basedir and in 
userspace when evaluating URL parameters (an all too common practice).

(2) Functionality: require_once()/include_once() could be fooled into 
including the same file twice.

Granted #2 requires specific circumstances and #1 can be worked around for 
tightly managed systems running no external packages.

How about a more expensive, but more closely aproximating substitute to 
satisfy all of these?

/* psuedo-code */
#ifndef HAVE_REALPATH
realpath(...) {
itterate path from root:
  if symlink, resolve
  if dir, append next portion of remaining path
  otherwise, ergh...whatever realpath() would do in this situation...
loop
}
#endif