Problem/Motivation

Found in codex audit:

- Medium: the credentials path validator does not actually enforce “outside
the webroot.” It only rejects strings starting with public:// at
anata/web/modules/orig/firebase_php/src/Form/FirebasePhpConfigurationForm.p
hp:136. Absolute or relative paths inside DRUPAL_ROOT, including public
files paths, can pass if readable. Canonicalize with realpath() and reject
anything under the webroot/public files directory, including symlink
targets.

Issue fork firebase_php-3593727

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

ptmkenny created an issue. See original summary.

ptmkenny opened merge request !57

  • ptmkenny committed 24978995 on 8.0.x 
    fix: #3593727 Security hardening: reject Firebase credential files...
ptmkenny’s picture

ptmkenny commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.