file.phar.inc 2.4 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455
  1. <?php
  2. use Drupal\Core\Security\PharExtensionInterceptor;
  3. use TYPO3\PharStreamWrapper\Manager as PharStreamWrapperManager;
  4. use TYPO3\PharStreamWrapper\Behavior as PharStreamWrapperBehavior;
  5. use TYPO3\PharStreamWrapper\PharStreamWrapper;
  6. /**
  7. * Registers a phar stream wrapper that is more secure than PHP's built-in one.
  8. *
  9. * @see file_get_stream_wrappers()
  10. */
  11. function file_register_phar_wrapper() {
  12. $directory = DRUPAL_ROOT . '/misc/typo3/phar-stream-wrapper/src';
  13. include_once $directory . '/Assertable.php';
  14. include_once $directory . '/Behavior.php';
  15. include_once $directory . '/Exception.php';
  16. include_once $directory . '/Helper.php';
  17. include_once $directory . '/Manager.php';
  18. include_once $directory . '/PharStreamWrapper.php';
  19. include_once $directory . '/Collectable.php';
  20. include_once $directory . '/Interceptor/ConjunctionInterceptor.php';
  21. include_once $directory . '/Interceptor/PharMetaDataInterceptor.php';
  22. include_once $directory . '/Phar/Container.php';
  23. include_once $directory . '/Phar/DeserializationException.php';
  24. include_once $directory . '/Phar/Manifest.php';
  25. include_once $directory . '/Phar/Reader.php';
  26. include_once $directory . '/Phar/ReaderException.php';
  27. include_once $directory . '/Phar/Stub.php';
  28. include_once $directory . '/Resolvable.php';
  29. include_once $directory . '/Resolver/PharInvocation.php';
  30. include_once $directory . '/Resolver/PharInvocationCollection.php';
  31. include_once $directory . '/Resolver/PharInvocationResolver.php';
  32. include_once DRUPAL_ROOT . '/misc/typo3/drupal-security/PharExtensionInterceptor.php';
  33. include_once DRUPAL_ROOT . '/misc/brumann/polyfill-unserialize/src/Unserialize.php';
  34. // Set up a stream wrapper to handle insecurities due to PHP's built-in
  35. // phar stream wrapper.
  36. try {
  37. $behavior = new PharStreamWrapperBehavior();
  38. PharStreamWrapperManager::initialize(
  39. $behavior->withAssertion(new PharExtensionInterceptor())
  40. );
  41. }
  42. catch (\LogicException $e) {
  43. // Continue if the PharStreamWrapperManager is already initialized.
  44. // For example, this occurs following a drupal_static_reset(), such
  45. // as during tests.
  46. };
  47. // To prevent file_stream_wrapper_valid_scheme() treating "phar" as a valid
  48. // scheme, this is registered with PHP only, not with hook_stream_wrappers()
  49. // or the internal storage of file_get_stream_wrappers().
  50. stream_wrapper_register('phar', '\\TYPO3\\PharStreamWrapper\\PharStreamWrapper');
  51. }