# realpath is not available in all LibCs

- Thread: https://externals.io/message/17829
- Original archive: https://news-web.php.net/php.internals/17829
- Started by Kamesh Jayachandran on 2005-08-11T11:37:54+00:00
- Messages: 3
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #17829 — Kamesh Jayachandran — 2005-08-11T11:37:54+00:00

URL: https://externals.io/message/17829#17829

Hi,
Version PHP 5.1
file main/php_init.c
function int php_init_config() uses realpath. 
In NetWare our earlier releases of LibC SDK has no realpath
implementation.

I could see the following lines in TSRM/tsrm_virtual_cwd.c

#ifndef HAVE_REALPATH
#define realpath(x,y) strcpy(y,x)
#endif

Why not this be in TSRM/tsrm_virtual_cwd.h so that it will work in all
the cases.

Can I go ahead and checkin this?

With regards
Kamesh Jayachandran

-- 
http://www.fastmail.fm - Does exactly what it says on the tin

---

## #17834 — Sara Golemon — 2005-08-11T14:52:56+00:00

URL: https://externals.io/message/17829#17834 · In reply to: #17829

> Version PHP 5.1
> file main/php_init.c
> function int php_init_config() uses realpath.
> In NetWare our earlier releases of LibC SDK has no realpath
> implementation.
>
> I could see the following lines in TSRM/tsrm_virtual_cwd.c
>
> #ifndef HAVE_REALPATH
> #define realpath(x,y) strcpy(y,x)
> #endif
>
> Why not this be in TSRM/tsrm_virtual_cwd.h so that it will work in all
> the cases.
>
> Can I go ahead and checkin this?
>
I have two concerns with this "solution" (both here and in TSRM).

(1) Security:  Both internally with checks such as open_basedir and in 
userspace when evaluating URL parameters (an all too common practice).

(2) Functionality: require_once()/include_once() could be fooled into 
including the same file twice.

Granted #2 requires specific circumstances and #1 can be worked around for 
tightly managed systems running no external packages.

How about a more expensive, but more closely aproximating substitute to 
satisfy all of these?

/* psuedo-code */
#ifndef HAVE_REALPATH
realpath(...) {
itterate path from root:
  if symlink, resolve
  if dir, append next portion of remaining path
  otherwise, ergh...whatever `realpath()` would do in this situation...
loop
}
#endif

---

## #18173 — Kamesh Jayachandran — 2005-08-16T15:31:57+00:00

URL: https://externals.io/message/17829#18173 · In reply to: #17834

Thanks sara for responding.
Will write a snippet to address this and get back to you.

With regards
Kamesh Jayachandran
On Thu, 11 Aug 2005 07:52:56 -0700, "Sara Golemon" <pollita@php.net>
said:
> > […]
> I have two concerns with this "solution" (both here and in TSRM).
> 
> (1) Security:  Both internally with checks such as open_basedir and in 
> userspace when evaluating URL parameters (an all too common practice).
> 
> (2) Functionality: require_once()/include_once() could be fooled into 
> including the same file twice.
> 
> Granted #2 requires specific circumstances and #1 can be worked around
> for 
> tightly managed systems running no external packages.
> 
> How about a more expensive, but more closely aproximating substitute to 
> satisfy all of these?
> 
> /* psuedo-code */
> #ifndef HAVE_REALPATH
> realpath(...) {
> itterate path from root:
>   if symlink, resolve
>   if dir, append next portion of remaining path
>   otherwise, ergh...whatever `realpath()` would do in this situation...
> loop
> }
> #endif 
> 

-- 
http://www.fastmail.fm - IMAP accessible web-mail