Skip to content

Commit 4b8e906

Browse files
Pantheon Automationgreg-1-anderson
Pantheon Automation
authored and
greg-1-anderson
committed
Update to Drupal 7.67. For more information, see https://www.drupal.org/project/drupal/releases/7.67 
1 parent 5075a31 commit 4b8e906

30 files changed

+1723
-19
lines changed

‎CHANGELOG.txt

+5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
Drupal 7.xx, xxxx-xx-xx (development version)
22
-----------------------
33

4+
Drupal 7.67, 2019-05-08
5+
-----------------------
6+
- Fixed security issues:
7+
- SA-CORE-2019-007
8+
49
Drupal 7.66, 2019-04-17
510
-----------------------
611
- Fixed security issues:

‎includes/bootstrap.inc

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
/**
99
* The current system version.
1010
*/
11-
define('VERSION', '7.66');
11+
define('VERSION', '7.67');
1212

1313
/**
1414
* Core API compatibility.

‎includes/file.phar.inc

+14
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,21 @@ function file_register_phar_wrapper() {
1818
include_once $directory . '/Helper.php';
1919
include_once $directory . '/Manager.php';
2020
include_once $directory . '/PharStreamWrapper.php';
21+
include_once $directory . '/Collectable.php';
22+
include_once $directory . '/Interceptor/ConjunctionInterceptor.php';
23+
include_once $directory . '/Interceptor/PharMetaDataInterceptor.php';
24+
include_once $directory . '/Phar/Container.php';
25+
include_once $directory . '/Phar/DeserializationException.php';
26+
include_once $directory . '/Phar/Manifest.php';
27+
include_once $directory . '/Phar/Reader.php';
28+
include_once $directory . '/Phar/ReaderException.php';
29+
include_once $directory . '/Phar/Stub.php';
30+
include_once $directory . '/Resolvable.php';
31+
include_once $directory . '/Resolver/PharInvocation.php';
32+
include_once $directory . '/Resolver/PharInvocationCollection.php';
33+
include_once $directory . '/Resolver/PharInvocationResolver.php';
2134
include_once DRUPAL_ROOT . '/misc/typo3/drupal-security/PharExtensionInterceptor.php';
35+
include_once DRUPAL_ROOT . '/misc/brumann/polyfill-unserialize/src/Unserialize.php';
2236

2337
// Set up a stream wrapper to handle insecurities due to PHP's built-in
2438
// phar stream wrapper.

‎misc/brumann/polyfill-unserialize/.gitignore

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
/vendor/
2+
/phpunit.xml
3+
/.composer.lock
4+

‎misc/brumann/polyfill-unserialize/.travis.yml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
language: php
2+
3+
sudo: false
4+
5+
php:
6+
- '5.3'
7+
- '5.4'
8+
- '5.5'
9+
- '5.6'
10+
- '7.0'
11+
- '7.1'
12+
13+
before_install:
14+
- phpenv config-rm xdebug.ini
15+
- composer self-update
16+
17+
install:
18+
- composer install
19+
20+
script: phpunit

‎misc/brumann/polyfill-unserialize/LICENSE

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2016 Denis Brumann
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎misc/brumann/polyfill-unserialize/README.md

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
Polyfill unserialize [![Build Status](https://travis-ci.org/dbrumann/polyfill-unserialize.svg?branch=master)](https://travis-ci.org/dbrumann/polyfill-unserialize)
2+
===
3+
4+
Backports unserialize options introduced in PHP 7.0 to older PHP versions.
5+
This was originally designed as a Proof of Concept for Symfony Issue [#21090](https://github.com/symfony/symfony/pull/21090).
6+
7+
You can use this package in projects that rely on PHP versions older than PHP 7.0.
8+
In case you are using PHP 7.0+ the original `unserialize()` will be used instead.
9+
10+
From the [documentation](https://secure.php.net/manual/en/function.unserialize.php):
11+
12+
> Warning: Do not pass untrusted user input to unserialize(). Unserialization can
13+
> result in code being loaded and executed due to object instantiation
14+
> and autoloading, and a malicious user may be able to exploit this.
15+
16+
This warning holds true even when `allowed_classes` is used.
17+
18+
Requirements
19+
------------
20+
21+
- PHP 5.3+
22+
23+
Installation
24+
------------
25+
26+
You can install this package via composer:
27+
28+
```
29+
composer require brumann/polyfill-unserialize "^1.0"
30+
```
31+
32+
Known Issues
33+
------------
34+
35+
There is a mismatch in behavior when `allowed_classes` in `$options` is not
36+
of the correct type (array or boolean). PHP 7.1 will issue a warning, whereas
37+
PHP 7.0 will not. I opted to copy the behavior of the former.
38+
39+
Tests
40+
-----
41+
42+
You can run the test suite using PHPUnit. It is intentionally not bundled as
43+
dev dependency to make sure this package has the lowest restrictions on the
44+
implementing system as possible.
45+
46+
Please read the [PHPUnit Manual](https://phpunit.de/manual/current/en/installation.html)
47+
for information how to install it on your system.
48+
49+
You can run the test suite as follows:
50+
51+
```
52+
phpunit -c phpunit.xml.dist tests/
53+
```
54+
55+
Contributing
56+
------------
57+
58+
This package is considered feature complete. As such I will likely not update it
59+
unless there are security issues.
60+
61+
Should you find any bugs or have questions, feel free to submit an Issue or a Pull Request.

‎misc/brumann/polyfill-unserialize/composer.json

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{
2+
"name": "brumann/polyfill-unserialize",
3+
"description": "Backports unserialize options introduced in PHP 7.0 to older PHP versions.",
4+
"type": "library",
5+
"license": "MIT",
6+
"authors": [
7+
{
8+
"name": "Denis Brumann",
9+
"email": "[email protected]"
10+
}
11+
],
12+
"autoload": {
13+
"psr-4": {
14+
"Brumann\\Polyfill\\": "src/"
15+
}
16+
},
17+
"autoload-dev": {
18+
"psr-4": {
19+
"Tests\\Brumann\\Polyfill\\": "tests/"
20+
}
21+
},
22+
"minimum-stability": "stable",
23+
"require": {
24+
"php": "^5.3|^7.0"
25+
}
26+
}

‎misc/brumann/polyfill-unserialize/phpunit.xml.dist

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<phpunit
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:noNamespaceSchemaLocation="http://schema.phpunit.de/4.1/phpunit.xsd"
6+
backupGlobals="false"
7+
colors="true"
8+
bootstrap="vendor/autoload.php"
9+
>
10+
<php>
11+
<ini name="error_reporting" value="-1" />
12+
</php>
13+
14+
<testsuites>
15+
<testsuite name="Brumann\Polyfill Test Suite">
16+
<directory>./tests/</directory>
17+
</testsuite>
18+
</testsuites>
19+
20+
<filter>
21+
<whitelist>
22+
<directory>./src/</directory>
23+
</whitelist>
24+
</filter>
25+
</phpunit>

‎misc/brumann/polyfill-unserialize/src/Unserialize.php

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
<?php
2+
3+
namespace Brumann\Polyfill;
4+
5+
final class Unserialize
6+
{
7+
/**
8+
* @see https://secure.php.net/manual/en/function.unserialize.php
9+
*
10+
* @param string $serialized Serialized data
11+
* @param array $options Associative array containing options
12+
*
13+
* @return mixed
14+
*/
15+
public static function unserialize($serialized, array $options = array())
16+
{
17+
if (PHP_VERSION_ID >= 70000) {
18+
return \unserialize($serialized, $options);
19+
}
20+
if (!array_key_exists('allowed_classes', $options)) {
21+
$options['allowed_classes'] = true;
22+
}
23+
$allowedClasses = $options['allowed_classes'];
24+
if (true === $allowedClasses) {
25+
return \unserialize($serialized);
26+
}
27+
if (false === $allowedClasses) {
28+
$allowedClasses = array();
29+
}
30+
if (!is_array($allowedClasses)) {
31+
trigger_error(
32+
'unserialize(): allowed_classes option should be array or boolean',
33+
E_USER_WARNING
34+
);
35+
$allowedClasses = array();
36+
}
37+
38+
$sanitizedSerialized = preg_replace_callback(
39+
'/(^|;)O:\d+:"([^"]*)":(\d+):{/',
40+
function ($match) use ($allowedClasses) {
41+
list($completeMatch, $leftBorder, $className, $objectSize) = $match;
42+
if (in_array($className, $allowedClasses)) {
43+
return $completeMatch;
44+
} else {
45+
return sprintf(
46+
'%sO:22:"__PHP_Incomplete_Class":%d:{s:27:"__PHP_Incomplete_Class_Name";%s',
47+
$leftBorder,
48+
$objectSize + 1, // size of object + 1 for added string
49+
\serialize($className)
50+
);
51+
}
52+
},
53+
$serialized
54+
);
55+
56+
return \unserialize($sanitizedSerialized);
57+
}
58+
}

‎misc/typo3/phar-stream-wrapper/.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.idea
2+
vendor/
3+
composer.lock

‎misc/typo3/phar-stream-wrapper/README.md

+66-3
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ adjusted to according requirements.
6363

6464
```
6565
$behavior = new \TYPO3\PharStreamWrapper\Behavior();
66-
Manager::initialize(
66+
\TYPO3\PharStreamWrapper\Manager::initialize(
6767
$behavior->withAssertion(new PharExtensionInterceptor())
6868
);
6969
@@ -90,7 +90,7 @@ if (in_array('phar', stream_get_wrappers())) {
9090
+ `COMMAND_UNLINK`
9191
+ `COMMAND_URL_STAT`
9292

93-
## Interceptor
93+
## Interceptors
9494

9595
The following interceptor is shipped with the package and ready to use in order
9696
to block any Phar invocation of files not having a `.phar` suffix. Besides that
@@ -137,9 +137,72 @@ class PharExtensionInterceptor implements Assertable
137137
}
138138
```
139139

140+
### ConjunctionInterceptor
141+
142+
This interceptor combines multiple interceptors implementing `Assertable`.
143+
It succeeds when all nested interceptors succeed as well (logical `AND`).
144+
145+
```
146+
$behavior = new \TYPO3\PharStreamWrapper\Behavior();
147+
\TYPO3\PharStreamWrapper\Manager::initialize(
148+
$behavior->withAssertion(new ConjunctionInterceptor(array(
149+
new PharExtensionInterceptor(),
150+
new PharMetaDataInterceptor()
151+
)))
152+
);
153+
```
154+
155+
### PharExtensionInterceptor
156+
157+
This (basic) interceptor just checks whether the invoked Phar archive has
158+
an according `.phar` file extension. Resolving symbolic links as well as
159+
Phar internal alias resolving are considered as well.
160+
161+
```
162+
$behavior = new \TYPO3\PharStreamWrapper\Behavior();
163+
\TYPO3\PharStreamWrapper\Manager::initialize(
164+
$behavior->withAssertion(new PharExtensionInterceptor())
165+
);
166+
```
167+
168+
### PharMetaDataInterceptor
169+
170+
This interceptor is actually checking serialized Phar meta-data against
171+
PHP objects and would consider a Phar archive malicious in case not only
172+
scalar values are found. A custom low-level `Phar\Reader` is used in order to
173+
avoid using PHP's `Phar` object which would trigger the initial vulnerability.
174+
175+
```
176+
$behavior = new \TYPO3\PharStreamWrapper\Behavior();
177+
\TYPO3\PharStreamWrapper\Manager::initialize(
178+
$behavior->withAssertion(new PharMetaDataInterceptor())
179+
);
180+
```
181+
182+
## Reader
183+
184+
* `Phar\Reader::__construct(string $fileName)`: Creates low-level reader for Phar archive
185+
* `Phar\Reader::resolveContainer(): Phar\Container`: Resolves model representing Phar archive
186+
* `Phar\Container::getStub(): Phar\Stub`: Resolves (plain PHP) stub section of Phar archive
187+
* `Phar\Container::getManifest(): Phar\Manifest`: Resolves parsed Phar archive manifest as
188+
documented at http://php.net/manual/en/phar.fileformat.manifestfile.php
189+
* `Phar\Stub::getMappedAlias(): string`: Resolves internal Phar archive alias defined in stub
190+
using `Phar::mapPhar('alias.phar')` - actually the plain PHP source is analyzed here
191+
* `Phar\Manifest::getAlias(): string` - Resolves internal Phar archive alias defined in manifest
192+
using `Phar::setAlias('alias.phar')`
193+
* `Phar\Manifest::getMetaData(): string`: Resolves serialized Phar archive meta-data
194+
* `Phar\Manifest::deserializeMetaData(): mixed`: Resolves deserialized Phar archive meta-data
195+
containing only scalar values - in case an object is determined, an according
196+
`Phar\DeserializationException` will be thrown
197+
198+
```
199+
$reader = new Phar\Reader('example.phar');
200+
var_dump($reader->resolveContainer()->getManifest()->deserializeMetaData());
201+
```
202+
140203
## Helper
141204

142-
* `Helper::determineBaseFile(string $path)`: Determines base file that can be
205+
* `Helper::determineBaseFile(string $path): string`: Determines base file that can be
143206
accessed using the regular file system. For instance the following path
144207
`phar:///home/user/bundle.phar/content.txt` would be resolved to
145208
`/home/user/bundle.phar`.

‎misc/typo3/phar-stream-wrapper/composer.json

+5-1
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,13 @@
66
"homepage": "https://typo3.org/",
77
"keywords": ["php", "phar", "stream-wrapper", "security"],
88
"require": {
9-
"php": "^5.3.3|^7.0"
9+
"php": "^5.3.3|^7.0",
10+
"ext-fileinfo": "*",
11+
"ext-json": "*",
12+
"brumann/polyfill-unserialize": "^1.0"
1013
},
1114
"require-dev": {
15+
"ext-xdebug": "*",
1216
"phpunit/phpunit": "^4.8.36"
1317
},
1418
"autoload": {

0 commit comments

Comments
 (0)