Gecko [ www.foryou-vip.com ]

Name	Size	Permission	Date
001.phpt	615 B	-rw-rw-r--	2022-10-31 11:36
002.phpt	1.64 KB	-rw-rw-r--	2022-10-31 11:36
003.phpt	512 B	-rw-rw-r--	2022-10-31 11:36
004.phpt	1.28 KB	-rw-rw-r--	2022-10-31 11:36
bug42112.phpt	672 B	-rw-rw-r--	2022-10-31 11:36
bug51903.phpt	1.15 KB	-rw-rw-r--	2022-10-31 11:36
bug54138.phpt	564 B	-rw-rw-r--	2022-10-31 11:36
bug54138_1.phpt	596 B	-rw-rw-r--	2022-10-31 11:36
bug54138_2.phpt	690 B	-rw-rw-r--	2022-10-31 11:36
bug54440.phpt	996 B	-rw-rw-r--	2022-10-31 11:36
bug61367-read.phpt	1.7 KB	-rw-rw-r--	2022-10-31 11:36
bug61367-read_2.phpt	1.61 KB	-rw-rw-r--	2022-10-31 11:36
bug61367-write.phpt	1.15 KB	-rw-rw-r--	2022-10-31 11:36
bug63389.phpt	420 B	-rw-rw-r--	2022-10-31 11:36
bug69753-mb.phpt	621 B	-rw-rw-r--	2022-10-31 11:36
bug69753.phpt	585 B	-rw-rw-r--	2022-10-31 11:36
bug69753.xml	64 B	-rw-rw-r--	2022-10-31 11:36
bug69753私はガラスを食べられます.xml	64 B	-rw-rw-r--	2022-10-31 11:36
bug76777.phpt	861 B	-rw-rw-r--	2022-10-31 11:36
bug79191.phpt	527 B	-rw-rw-r--	2022-10-31 11:36
libxml_disable_entity_loader.phpt	1.26 KB	-rw-rw-r--	2022-10-31 11:36
libxml_disable_entity_loader_2.phpt	1.06 KB	-rw-rw-r--	2022-10-31 11:36
libxml_disable_entity_loader_payload.txt	11 B	-rw-rw-r--	2022-10-31 11:36
libxml_set_external_entity_loader_basic.phpt	818 B	-rw-rw-r--	2022-10-31 11:36
libxml_set_external_entity_loader_error1.phpt	1.21 KB	-rw-rw-r--	2022-10-31 11:36
libxml_set_external_entity_loader_variation1.phpt	1.43 KB	-rw-rw-r--	2022-10-31 11:36
libxml_set_external_entity_loader_variation2.phpt	899 B	-rw-rw-r--	2022-10-31 11:36
test.xml	122 B	-rw-rw-r--	2022-10-31 11:36

Rename

--TEST--
Bug #61367: open_basedir bypass in libxml RSHUTDOWN: read test
--SKIPIF--
<?php
if(!extension_loaded('dom')) echo 'skip dom extension not available';
if (LIBXML_VERSION >= 20912) die('skip For libxml2 < 2.9.12 only');
?>
--INI--
open_basedir=.
error_reporting=E_ALL & ~E_NOTICE
--FILE--
<?php
/*
 * Note: Using error_reporting=E_ALL & ~E_NOTICE to suppress "Trying to get property of non-object" notices.
 */
class StreamExploiter {
	public function stream_close (  ) {
		$doc = new DOMDocument;
		$doc->resolveExternals = true;
		$doc->substituteEntities = true;
		$dir = htmlspecialchars(dirname(getcwd()));
		$dir = str_replace('\\', '/', $dir); // fix for windows
		$doc->loadXML( <<<XML
<!DOCTYPE doc [
	<!ENTITY file SYSTEM "file:///$dir/bad">
]>
<doc>&file;</doc>
XML
		);
		print $doc->documentElement->firstChild->nodeValue;
	}

public function stream_open (  $path ,  $mode ,  $options ,  &$opened_path ) {
		return true;
	}
}

var_dump(mkdir('test_bug_61367-read'));
var_dump(mkdir('test_bug_61367-read/base'));
var_dump(file_put_contents('test_bug_61367-read/bad', 'blah'));
var_dump(chdir('test_bug_61367-read/base'));

stream_wrapper_register( 'exploit', 'StreamExploiter' );
$s = fopen( 'exploit://', 'r' );

?>
--CLEAN--
<?php
unlink('test_bug_61367-read/bad');
rmdir('test_bug_61367-read/base');
rmdir('test_bug_61367-read');
?>
--EXPECTF--
bool(true)
bool(true)
int(4)
bool(true)

Warning: DOMDocument::loadXML(): I/O warning : failed to load external entity "file:///%s/test_bug_61367-read/bad" in %s on line %d

Warning: DOMDocument::loadXML(): Failure to process entity file in Entity, line: 4 in %s on line %d

Warning: DOMDocument::loadXML(): Entity 'file' not defined in Entity, line: 4 in %s on line %d