Releases v3.1.1 and v.2.1.1 aim to overcome drawbacks in Phar's alias resolving from Phar stub as well as solving performance aspects.
Releases v3.1.0 and v.2.1.0 aim to overcome drawbacks in Phar's alias resolving (either by Phar archives using Phar::setAlias() in meta-data or Phar::mapPhar() in stub code).
Merged pull-requests
In case custom Assertable interceptors have been used, path resolving has to be adjusted in order to make use of alias resolving features.
$baseFile = Helper::determineBaseFile($path);
$invocation = Manager::instance()->resolve($path);
$baseName = $invocation->getBaseName(); // previously called $baseFile
There have been reports about flaws using stream_select() and according stream_cast() in PharStreamWrapper. Since it was not possible to reproduce the behavior in an isolated scenario and specific platform requiresments were not clear, these aspects have not been covered by these releses - see #8 and #19 for details.
Phar\Reader for stub & meta-data (incl. alias) and their model representationsResolver\PharInvocationResolver in order to resolve/handle alias namesInterceptor\ConjunctionInterceptor for combining multiple interceptorsInterceptor\PharMetaDataInterceptor for actually testing against insecure deserialization in meta-data of Phar archivesBackports unserialize options introduced in PHP 7.0 to older PHP versions. This was originally designed as a Proof of Concept for Symfony Issue #21090.
You can use this package in projects that rely on PHP versions older than PHP 7.0. In case you are using PHP 7.0+ the original unserialize() will be used instead.
From the documentation:
Warning: Do not pass untrusted user input to unserialize(). Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this.
This warning holds true even when allowed_classes is used.
Please login to add feedback.
This update has been submitted for testing by siwinski.
This update test gating status has been changed to 'waiting'.
This update test gating status has been changed to 'ignored'.
This update has been pushed to testing.
This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes
This update has been submitted for stable by siwinski.
This update has been pushed to stable.