fix: security advisory GHSA-92rv-4j2h-8mjj

KnpLabs · Sep 6, 2023 · 8d893a8 · 8d893a8
1 parent 409ec35
commit 8d893a8
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 2 deletions.
diff --git a/src/Knp/Snappy/AbstractGenerator.php b/src/Knp/Snappy/AbstractGenerator.php
@@ -625,8 +625,11 @@ protected function executeCommand($command)
      */
     protected function prepareOutput($filename, $overwrite)
     {
-        if (\strpos($filename, 'phar://') === 0) {
-            throw new InvalidArgumentException('The output file cannot be a phar archive.');
+        $parsedFilename = parse_url($filename);
+        $scheme = isset($parsedFilename['scheme']) ? mb_strtolower($parsedFilename['scheme']) : '';
+
+        if ($scheme !== '' && $scheme !== 'file') {
+            throw new InvalidArgumentException(sprintf('The output file scheme is not supported. Expected \'\' or \'file\' but got \'%s\'.', $scheme));
         }
 
         $directory = \dirname($filename);

diff --git a/tests/Knp/Snappy/AbstractGeneratorTest.php b/tests/Knp/Snappy/AbstractGeneratorTest.php
@@ -965,6 +965,30 @@ public function testFailingGenerateWithOutputContainingPharPrefix(): void
         $media->generate('the_input_file', 'phar://the_output_file', ['foo' => 'bar']);
     }
 
+    public function testFailingGenerateWithOutputContainingUppercasePharPrefix(): void
+    {
+        $media = $this->getMockBuilder(AbstractGenerator::class)
+            ->setMethods([
+                'configure',
+                'prepareOutput',
+            ])
+            ->setConstructorArgs(['the_binary', [], ['PATH' => '/usr/bin']])
+            ->getMock()
+        ;
+
+        $media->setTimeout(2000);
+
+        $media
+            ->expects($this->once())
+            ->method('prepareOutput')
+            ->with($this->equalTo('PHAR://the_output_file'))
+        ;
+
+        $this->expectException(InvalidArgumentException::class);
+
+        $media->generate('the_input_file', 'PHAR://the_output_file', ['foo' => 'bar']);
+    }
+
     /**
      * @return null|string
      */