# filepaths, uris, safemode, etc..

- Thread: https://externals.io/message/4622
- Original archive: https://news-web.php.net/php.internals/4622
- Started by Wez Furlong on 2003-09-30T18:21:09+00:00
- Messages: 2
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #4622 — Wez Furlong — 2003-09-30T18:21:09+00:00

URL: https://externals.io/message/4622#4622

Sorry about the forwarding... had a little hiccup with my mail server...

----- Original Message ----- 
From: "Wez Furlong" <wez@thebrainroom.com>
To: "Rob Richards" <rrichards@ctindustries.net>; <internals@lists.php.net>
Sent: Tuesday, September 30, 2003 7:10 PM
Subject: Re: [PHP-DEV] filepaths, uris, safemode, etc..


> Hi Rob,
>
> The streams code, and also sqlite does this when checking for safemode for
> local files:
>
> if (PG(safe_mode) && (!php_checkuid(path, NULL,
> CHECKUID_CHECK_FILE_AND_DIR))) {
>     return SQLITE_DENY;
> }
> if (php_check_open_basedir(path TSRMLS_CC)) {
>     return SQLITE_DENY;
> }
>
> You'll probably want to check if the path is a URI or local path first;
the
> streams code checks for :// to make this decision.
>
> If you're planning to tie streams into libxml, feel free to reuse the code
I
> added to pecl/soap:
> http://cvs.php.net/diff.php/pecl/soap/php_xml.c?r1=1.5&r2=1.6&ty=u
> http://cvs.php.net/diff.php/pecl/soap/soap.c?r1=1.15&r2=1.16&ty=u
>
> --Wez.
>
>
> ----- Original Message ----- 
> From: "Rob Richards" <rrichards@ctindustries.net>
> To: <internals@lists.php.net>
> Sent: Tuesday, September 30, 2003 12:52 PM
> Subject: [PHP-DEV] filepaths, uris, safemode, etc..
>
>
> Within the dom extension, I am trying to resolve an issue with uris and
> local filepaths which are passed to libxml.
> When I get the filepath, I need to resolve any local filepaths to an
> absoulte path. On top of this the safemode checks need to be done before
> passing any of these to libxml.
>
> So far I started with taking the user supplied source string and running
> that through the safemode checks.
> If this passes, then the source is tested as follows:
>
> If uri, then it is passed to libxml, otherwise it gets passed through
> expand_filepath and the resolved path is passed to libxml.
>
> It has been noted that file uris should not be passed in directly, but go
> through the same path resolutions as local files and that the following
> block of code be used instead of just using expand_filepath on all non uri
> and file uri source strings:
> #ifdef VIRTUAL_DIR
>     virtual_filepath_ex(source, &resolved_path, `NULL` TSRMLS_CC);
> #else
>     resolved_path = source;
> #endif
>
> My problem is that if VIRTUAL_DIR is not defined, then the resolved path
> ends up being the origional source supplied, which means that relative
paths
> are not resolved. Also, should the path resolutions be done before the
> safemode checks?
>
> On top of this I am looking at allowing additional registered streams to
be
> used, so not sure if that would change any of this.
>
> What is the correct way to implement this?
>
> Thanks,
>
> Rob

---

## #4625 — Rob Richards — 2003-09-30T20:49:32+00:00

URL: https://externals.io/message/4622#4625 · In reply to: #4622

From: Wez Furlong

> > […]
> the
> > […]

I loaded the soap extension and now run into an issue (though streams now
work in dom without having to touch it).
xmlRegisterInputCallbacks is in the global libxml space, so streams are
automatically supported in all libxml based extensions upon the soap MINIT.

When a file:// uri is passed in, you end up with an `E_NOTICE` as the streams
code issues a php_error_docref that the stream cannot be found. Although,
libxml will continue on matching against its default handlers which
successfully finds the file:// handler. As libxml converts all local
filepaths to file uris, this notice is generated with all external
referenced files within the document as well. Anyway that the errors can be
surpressed as libxml already handles the return code?

It would be nice if that block of code could be ripped out of soap and put
into a some libxml module which php would load on startup if libxml were
defined, so that streams would be included by default for all libxml
extensions. This module would then handle any global functionality needed in
startup/shutdown rather than the individual extensions trying to deal with
them.Something like this would also have prevented the issue with 2.5.8 and
the parser cleanup.

Now about the path resolution. Do you know if:
#ifdef VIRTUAL_DIR
    virtual_filepath_ex(source, &resolved_path, `NULL` TSRMLS_CC);
#else
    resolved_path = source;
#endif
is the correct way to resolve the paths, which could be anything like:
file:///../xmltest.xml
./xmltest.xml
/www/xmltest.xml
E:\xmltest.xml
file:///E:\xmltest.xml

or is there anything more or different that needs to be done to insure that
relative paths are expanded?

Thanks,

Rob