Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

zip_open/ZipArchive should throw an exception in CLI server mode unless opening read-only #9285

Open
fredemmott opened this issue Nov 1, 2022 · 0 comments

Comments

@fredemmott
Copy link
Contributor

Describe the bug

| (_flags & ZIP_RDONLY ? O_RDONLY : O_RDWR);
attempts to set the appropriate flags for various modes in CLI server, however they will never work:

https://libzip.org/documentation/zip_fdopen.html

In contrast to zip_open(3), using zip_fdopen the archive can only be opened in read-only mode.

zip_open can't directly be used here because it would be a privilege escalation bug.

I think a 'real fix' would be making the CLI client process capable of high-level zip operations, but a clear 'unsupported in CLI server mode' exception would make debugging issues much simpler.

Standalone code, or other way to reproduce the problem

IN CLI SERVER MODE

$z = new ZipArchive();
$z->open('/tmp/foo.zip', ZIPARCHIVE::CREATE); // ALWAYS fails

Expected behavior

Ideally, it works, opening the zip as the CLI client user.
Better would be a clear exception saying why it will always fail

Actual behavior

open fails, invalid zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant