Skip to content

[Intl] Fixed directory traversal in emoji compression tool #51030

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 20, 2023
Merged

[Intl] Fixed directory traversal in emoji compression tool #51030

merged 1 commit into from
Jul 20, 2023

Conversation

rlandgrebe
Copy link
Contributor

When using the compression tool, the emoji data is not compressed properly due to directory traversal issues. It only goes one level deep in the `data' directory.

Q A
Branch? 6.3
Bug fix? yes
New feature? no
Deprecations? no
Tickets Fix #51029
License MIT
Doc PR

@carsonbot
Copy link

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has a contribution guide which I suggest you to read.

In short:

  • Always add tests
  • Keep backward compatibility (see https://symfony.com/bc).
  • Bug fixes must be submitted against the lowest maintained branch where they apply (see https://symfony.com/releases)
  • Features and deprecations must be submitted against the 6.4 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

@carsonbot
Copy link

It looks like you unchecked the "Allow edits from maintainer" box. That is fine, but please note that if you have multiple commits, you'll need to squash your commits into one before this can be merged. Or, you can check the "Allow edits from maintainers" box and the maintainer can squash for you.

Cheers!

Carsonbot

Comment on lines 20 to 27
$file_iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator(
dirname(__DIR__).'/data',
FilesystemIterator::CURRENT_AS_FILEINFO | FilesystemIterator::SKIP_DOTS
)
);

foreach ($file_iterator as $file) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we use camelCase for variables:

Suggested change
$file_iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator(
dirname(__DIR__).'/data',
FilesystemIterator::CURRENT_AS_FILEINFO | FilesystemIterator::SKIP_DOTS
)
);
foreach ($file_iterator as $file) {
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator(
dirname(__DIR__).'/data',
FilesystemIterator::CURRENT_AS_FILEINFO | FilesystemIterator::SKIP_DOTS
)
);
foreach ($iterator as $file) {

@nicolas-grekas
Copy link
Member

Thanks for the update. Can you please squash the two commits in one? I would have done it but "Allow edits from maintainer" is disabled so I can't.

When using the compression tool, the emoji data is not compressed properly due to directory traversal issues. It only goes one level deep in the `data' directory.
@rlandgrebe
Copy link
Contributor Author

Thanks for your feedback, Nicolas. I just squashed the two commits into one.

@nicolas-grekas
Copy link
Member

Thank you @rlandgrebe.

@nicolas-grekas nicolas-grekas merged commit f105b5a into symfony:6.3 Jul 20, 2023
@fabpot fabpot mentioned this pull request Jul 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants