bug61367-write.phpt 1.1 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546
  1. --TEST--
  2. Bug #61367: open_basedir bypass in libxml RSHUTDOWN: write test
  3. --EXTENSIONS--
  4. dom
  5. --INI--
  6. open_basedir=.
  7. --FILE--
  8. <?php
  9. class StreamExploiter {
  10. public function stream_close ( ) {
  11. $doc = new DOMDocument;
  12. $doc->appendChild($doc->createTextNode('hello'));
  13. var_dump($doc->save(dirname(getcwd()) . '/bad'));
  14. }
  15. public function stream_open ( $path , $mode , $options , &$opened_path ) {
  16. return true;
  17. }
  18. }
  19. var_dump(mkdir('test_bug_61367-write'));
  20. var_dump(mkdir('test_bug_61367-write/base'));
  21. var_dump(file_put_contents('test_bug_61367-write/bad', 'blah'));
  22. var_dump(chdir('test_bug_61367-write/base'));
  23. stream_wrapper_register( 'exploit', 'StreamExploiter' );
  24. $s = fopen( 'exploit://', 'r' );
  25. ?>
  26. --CLEAN--
  27. <?php
  28. @unlink('test_bug_61367-write/bad');
  29. rmdir('test_bug_61367-write/base');
  30. rmdir('test_bug_61367-write');
  31. ?>
  32. --EXPECTF--
  33. bool(true)
  34. bool(true)
  35. int(4)
  36. bool(true)
  37. Warning: DOMDocument::save(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (.) in %s on line %d
  38. Warning: DOMDocument::save(%s): Failed to open stream: Operation not permitted in %s on line %d
  39. bool(false)