filepaths, uris, safemode, etc..

22 years ago by Wez Furlong — view source — reply

unread

Sorry about the forwarding... had a little hiccup with my mail server...

----- Original Message -----
From: "Wez Furlong" wez@thebrainroom.com
To: "Rob Richards" rrichards@ctindustries.net; internals@lists.php.net
Sent: Tuesday, September 30, 2003 7:10 PM
Subject: Re: [PHP-DEV] filepaths, uris, safemode, etc..

Hi Rob,

The streams code, and also sqlite does this when checking for safemode for
local files:

if (PG(safe_mode) && (!php_checkuid(path, NULL,
CHECKUID_CHECK_FILE_AND_DIR))) {
return SQLITE_DENY;
}
if (php_check_open_basedir(path TSRMLS_CC)) {
return SQLITE_DENY;
}

You'll probably want to check if the path is a URI or local path first;
the
streams code checks for :// to make this decision.

If you're planning to tie streams into libxml, feel free to reuse the code
I
added to pecl/soap:
http://cvs.php.net/diff.php/pecl/soap/php_xml.c?r1=1.5&r2=1.6&ty=u
http://cvs.php.net/diff.php/pecl/soap/soap.c?r1=1.15&r2=1.16&ty=u

--Wez.

----- Original Message -----
From: "Rob Richards" rrichards@ctindustries.net
To: internals@lists.php.net
Sent: Tuesday, September 30, 2003 12:52 PM
Subject: [PHP-DEV] filepaths, uris, safemode, etc..

Within the dom extension, I am trying to resolve an issue with uris and
local filepaths which are passed to libxml.
When I get the filepath, I need to resolve any local filepaths to an
absoulte path. On top of this the safemode checks need to be done before
passing any of these to libxml.

So far I started with taking the user supplied source string and running
that through the safemode checks.
If this passes, then the source is tested as follows:

If uri, then it is passed to libxml, otherwise it gets passed through
expand_filepath and the resolved path is passed to libxml.

It has been noted that file uris should not be passed in directly, but go
through the same path resolutions as local files and that the following
block of code be used instead of just using expand_filepath on all non uri
and file uri source strings:
#ifdef VIRTUAL_DIR
virtual_filepath_ex(source, &resolved_path, NULL TSRMLS_CC);
#else
resolved_path = source;
#endif

My problem is that if VIRTUAL_DIR is not defined, then the resolved path
ends up being the origional source supplied, which means that relative
paths
are not resolved. Also, should the path resolutions be done before the
safemode checks?

On top of this I am looking at allowing additional registered streams to
be
used, so not sure if that would change any of this.

What is the correct way to implement this?

Thanks,

Rob

22 years ago by Rob Richards — view source — reply

unread

From: Wez Furlong

You'll probably want to check if the path is a URI or local path first;
the
streams code checks for :// to make this decision.

I loaded the soap extension and now run into an issue (though streams now
work in dom without having to touch it).
xmlRegisterInputCallbacks is in the global libxml space, so streams are
automatically supported in all libxml based extensions upon the soap MINIT.

When a file:// uri is passed in, you end up with an E_NOTICE as the streams
code issues a php_error_docref that the stream cannot be found. Although,
libxml will continue on matching against its default handlers which
successfully finds the file:// handler. As libxml converts all local
filepaths to file uris, this notice is generated with all external
referenced files within the document as well. Anyway that the errors can be
surpressed as libxml already handles the return code?

It would be nice if that block of code could be ripped out of soap and put
into a some libxml module which php would load on startup if libxml were
defined, so that streams would be included by default for all libxml
extensions. This module would then handle any global functionality needed in
startup/shutdown rather than the individual extensions trying to deal with
them.Something like this would also have prevented the issue with 2.5.8 and
the parser cleanup.

Now about the path resolution. Do you know if:
#ifdef VIRTUAL_DIR
virtual_filepath_ex(source, &resolved_path, NULL TSRMLS_CC);
#else
resolved_path = source;
#endif
is the correct way to resolve the paths, which could be anything like:
file:///../xmltest.xml
./xmltest.xml
/www/xmltest.xml
E:\xmltest.xml
file:///E:\xmltest.xml

or is there anything more or different that needs to be done to insure that
relative paths are expanded?

Thanks,

Rob