Skip to content

Commit d94fac3

Browse files
dependabot-preview[bot]dependabot-preview[bot]
authored
Merge pull request #534 from nextcloud/dependabot/composer/stable18/pear/archive_tar-1.4.11
2 parents 642cd66 + c4282c7 commit d94fac3

File tree

8 files changed

+116
-35
lines changed

8 files changed

+116
-35
lines changed

‎composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
"nikic/php-parser": "^4.2",
3030
"patchwork/jsqueeze": "^2.0",
3131
"patchwork/utf8": "1.3.1",
32-
"pear/archive_tar": "1.4.8",
32+
"pear/archive_tar": "1.4.11",
3333
"pear/pear-core-minimal": "^v1.10",
3434
"phpseclib/phpseclib": "2.0.23",
3535
"php-opencloud/openstack": "3.0.6",

‎composer.lock‎

Lines changed: 15 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎composer/ClassLoader.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ class ClassLoader
6060
public function getPrefixes()
6161
{
6262
if (!empty($this->prefixesPsr0)) {
63-
return call_user_func_array('array_merge', $this->prefixesPsr0);
63+
return call_user_func_array('array_merge', array_values($this->prefixesPsr0));
6464
}
6565

6666
return array();

‎composer/autoload_real.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ public static function loadClassLoader($class)
1313
}
1414
}
1515

16+
/**
17+
* @return \Composer\Autoload\ClassLoader
18+
*/
1619
public static function getLoader()
1720
{
1821
if (null !== self::$loader) {

‎composer/installed.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2094,17 +2094,17 @@
20942094
},
20952095
{
20962096
"name": "pear/archive_tar",
2097-
"version": "1.4.8",
2098-
"version_normalized": "1.4.8.0",
2097+
"version": "1.4.11",
2098+
"version_normalized": "1.4.11.0",
20992099
"source": {
21002100
"type": "git",
21012101
"url": "https://github.com/pear/Archive_Tar.git",
2102-
"reference": "442bdffb7edb84c898cfd94f7ac8500e49d5bbb5"
2102+
"reference": "17d355cb7d3c4ff08e5729f29cd7660145208d9d"
21032103
},
21042104
"dist": {
21052105
"type": "zip",
2106-
"url": "https://api.github.com/repos/pear/Archive_Tar/zipball/442bdffb7edb84c898cfd94f7ac8500e49d5bbb5",
2107-
"reference": "442bdffb7edb84c898cfd94f7ac8500e49d5bbb5",
2106+
"url": "https://api.github.com/repos/pear/Archive_Tar/zipball/17d355cb7d3c4ff08e5729f29cd7660145208d9d",
2107+
"reference": "17d355cb7d3c4ff08e5729f29cd7660145208d9d",
21082108
"shasum": ""
21092109
},
21102110
"require": {
@@ -2119,7 +2119,7 @@
21192119
"ext-xz": "Lzma2 compression support.",
21202120
"ext-zlib": "Gzip compression support."
21212121
},
2122-
"time": "2019-10-21T13:31:24+00:00",
2122+
"time": "2020-11-19T22:10:24+00:00",
21232123
"type": "library",
21242124
"extra": {
21252125
"branch-alias": {

‎pear/archive_tar/.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,8 @@ vendor
88
.buildpath
99
.project
1010
.settings
11+
# pear
12+
.tarballs
13+
*.tgz
14+
# phpunit
15+
build

‎pear/archive_tar/Archive/Tar.php‎

Lines changed: 34 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -312,11 +312,12 @@ public function add($p_filelist)
312312
/**
313313
* @param string $p_path
314314
* @param bool $p_preserve
315+
* @param bool $p_symlinks
315316
* @return bool
316317
*/
317-
public function extract($p_path = '', $p_preserve = false)
318+
public function extract($p_path = '', $p_preserve = false, $p_symlinks = true)
318319
{
319-
return $this->extractModify($p_path, '', $p_preserve);
320+
return $this->extractModify($p_path, '', $p_preserve, $p_symlinks);
320321
}
321322

322323
/**
@@ -557,11 +558,12 @@ public function addString($p_filename, $p_string, $p_datetime = false, $p_params
557558
* removed if present at the beginning of
558559
* the file/dir path.
559560
* @param boolean $p_preserve Preserve user/group ownership of files
561+
* @param boolean $p_symlinks Allow symlinks.
560562
*
561563
* @return boolean true on success, false on error.
562564
* @see extractList()
563565
*/
564-
public function extractModify($p_path, $p_remove_path, $p_preserve = false)
566+
public function extractModify($p_path, $p_remove_path, $p_preserve = false, $p_symlinks = true)
565567
{
566568
$v_result = true;
567569
$v_list_detail = array();
@@ -573,7 +575,8 @@ public function extractModify($p_path, $p_remove_path, $p_preserve = false)
573575
"complete",
574576
0,
575577
$p_remove_path,
576-
$p_preserve
578+
$p_preserve,
579+
$p_symlinks
577580
);
578581
$this->_close();
579582
}
@@ -617,11 +620,12 @@ public function extractInString($p_filename)
617620
* removed if present at the beginning of
618621
* the file/dir path.
619622
* @param boolean $p_preserve Preserve user/group ownership of files
623+
* @param boolean $p_symlinks Allow symlinks.
620624
*
621625
* @return true on success, false on error.
622626
* @see extractModify()
623627
*/
624-
public function extractList($p_filelist, $p_path = '', $p_remove_path = '', $p_preserve = false)
628+
public function extractList($p_filelist, $p_path = '', $p_remove_path = '', $p_preserve = false, $p_symlinks = true)
625629
{
626630
$v_result = true;
627631
$v_list_detail = array();
@@ -642,7 +646,8 @@ public function extractList($p_filelist, $p_path = '', $p_remove_path = '', $p_p
642646
"partial",
643647
$v_list,
644648
$p_remove_path,
645-
$p_preserve
649+
$p_preserve,
650+
$p_symlinks
646651
);
647652
$this->_close();
648653
}
@@ -726,7 +731,7 @@ public function setIgnoreRegexp($regexp)
726731
*/
727732
public function setIgnoreList($list)
728733
{
729-
$regexp = str_replace(array('#', '.', '^', '$'), array('\#', '\.', '\^', '\$'), $list);
734+
$list = str_replace(array('#', '.', '^', '$'), array('\#', '\.', '\^', '\$'), $list);
730735
$regexp = '#/' . join('$|/', $list) . '#';
731736
$this->setIgnoreRegexp($regexp);
732737
}
@@ -1268,7 +1273,7 @@ public function _addFile($p_filename, &$p_header, $p_add_dir, $p_remove_dir, $v_
12681273
while (($v_buffer = fread($v_file, $this->buffer_length)) != '') {
12691274
$buffer_length = strlen("$v_buffer");
12701275
if ($buffer_length != $this->buffer_length) {
1271-
$pack_size = ((int)($buffer_length / 512) + 1) * 512;
1276+
$pack_size = ((int)($buffer_length / 512) + ($buffer_length % 512 !== 0 ? 1 : 0)) * 512;
12721277
$pack_format = sprintf('a%d', $pack_size);
12731278
} else {
12741279
$pack_format = sprintf('a%d', $this->buffer_length);
@@ -1510,8 +1515,13 @@ public function _writeHeaderBlock(
15101515
$userinfo = posix_getpwuid($p_uid);
15111516
$groupinfo = posix_getgrgid($p_gid);
15121517

1513-
$v_uname = $userinfo['name'];
1514-
$v_gname = $groupinfo['name'];
1518+
if ($userinfo === false || $groupinfo === false) {
1519+
$v_uname = '';
1520+
$v_gname = '';
1521+
} else {
1522+
$v_uname = $userinfo['name'];
1523+
$v_gname = $groupinfo['name'];
1524+
}
15151525
} else {
15161526
$v_uname = '';
15171527
$v_gname = '';
@@ -1720,7 +1730,7 @@ public function _readHeader($v_binary_data, &$v_header)
17201730

17211731
// ----- Extract the properties
17221732
$v_header['filename'] = rtrim($v_data['filename'], "\0");
1723-
if ($this->_maliciousFilename($v_header['filename'])) {
1733+
if ($this->_isMaliciousFilename($v_header['filename'])) {
17241734
$this->_error(
17251735
'Malicious .tar detected, file "' . $v_header['filename'] .
17261736
'" will not install in desired directory tree'
@@ -1790,9 +1800,9 @@ private function _tarRecToSize($tar_size)
17901800
*
17911801
* @return bool
17921802
*/
1793-
private function _maliciousFilename($file)
1803+
private function _isMaliciousFilename($file)
17941804
{
1795-
if (strpos($file, 'phar://') === 0) {
1805+
if (strpos($file, '://') !== false) {
17961806
return true;
17971807
}
17981808
if (strpos($file, '../') !== false || strpos($file, '..\\') !== false) {
@@ -1828,7 +1838,7 @@ public function _readLongHeader(&$v_header)
18281838

18291839
$v_filename = rtrim(substr($v_filename, 0, $v_filesize), "\0");
18301840
$v_header['filename'] = $v_filename;
1831-
if ($this->_maliciousFilename($v_filename)) {
1841+
if ($this->_isMaliciousFilename($v_filename)) {
18321842
$this->_error(
18331843
'Malicious .tar detected, file "' . $v_filename .
18341844
'" will not install in desired directory tree'
@@ -1917,6 +1927,7 @@ private function _extractInString($p_filename)
19171927
* @param string $p_file_list
19181928
* @param string $p_remove_path
19191929
* @param bool $p_preserve
1930+
* @param bool $p_symlinks
19201931
* @return bool
19211932
*/
19221933
public function _extractList(
@@ -1925,7 +1936,8 @@ public function _extractList(
19251936
$p_mode,
19261937
$p_file_list,
19271938
$p_remove_path,
1928-
$p_preserve = false
1939+
$p_preserve = false,
1940+
$p_symlinks = true
19291941
)
19301942
{
19311943
$v_result = true;
@@ -2108,6 +2120,13 @@ public function _extractList(
21082120
}
21092121
}
21102122
} elseif ($v_header['typeflag'] == "2") {
2123+
if (!$p_symlinks) {
2124+
$this->_warning('Symbolic links are not allowed. '
2125+
. 'Unable to extract {'
2126+
. $v_header['filename'] . '}'
2127+
);
2128+
return false;
2129+
}
21112130
if (@file_exists($v_header['filename'])) {
21122131
@unlink($v_header['filename']);
21132132
}

0 commit comments

Comments
 (0)