Problem/Motivation

The recent security release ran into #3026386: Drush fatal error after upgrading to 8.6.6, 8.5.9, or 7.62: PHP Fatal error: Uncaught TYPO3\PharStreamWrapper\Exception

Proposed resolution

Add tests for the situation when a CLI phar is invoked from a shutdown function.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

CommentFileSizeAuthor
#22 3026414-22.patch25.48 KBalexpott
#22 10-22-interdiff.txt4.5 KBalexpott
#10 3026414-5.patch25.89 KBalexpott
#10 3026414-10.test-only.patch27.49 KBalexpott
#9 3026414-5.patch25.89 KBalexpott
#9 3026414-9.test-only.patch26.53 KBalexpott
#5 3026414-5.patch25.89 KBalexpott
#5 4-5-interdiff.txt696 bytesalexpott
#4 3026414-4.patch26.07 KBalexpott
#4 2-4-interdiff.txt5.96 KBalexpott
#2 3026414-2.patch25.28 KBalexpott

Comments

alexpott created an issue. See original summary.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Status: Active » Needs review
StatusFileSize
new 3026414-2.patch25.28 KB

Here's a test that runs a phar from the command line without a phar extension and also covers the shutdown function case that failed in the original security release.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented 
+++ b/core/tests/Drupal/KernelTests/Core/File/fixtures/build_phar.php
+++ b/core/tests/Drupal/KernelTests/Core/File/fixtures/cli_phar_builder/index.php

I left these files here because I think it is helpful to have them so we can add other things we find to the phar files and make it easy to rebuild them.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
StatusFileSize
new 2-4-interdiff.txt5.96 KB
new 3026414-4.patch26.07 KB

Improved the test and the code.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
StatusFileSize
new 4-5-interdiff.txt696 bytes
new 3026414-5.patch25.89 KB

No longer need to use FileTestBase - whilst working on the patch I needed a real file system and VFS but that is no longer true.

The last submitted patch, 2: 3026414-2.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented

So #2 was submitted to the queue prior to #3026386: Drush fatal error after upgrading to 8.6.6, 8.5.9, or 7.62: PHP Fatal error: Uncaught TYPO3\PharStreamWrapper\Exception landing so that failure is expected. The others should be green.

fabianx’s picture

fabianx commented

RTBC - but could we have a tests-only patch (with removed sec patch) as well to see it failing?

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
StatusFileSize
new 3026414-9.test-only.patch26.53 KB
new 3026414-5.patch25.89 KB

Well fwiw here is a test-only patch with the security stream wrapper not registered but the real test only patch was done in #2 against a HEAD that did not contain the emergency fix.

Re-uploading #5 so the latest patch on the issue is the real patch to review.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
StatusFileSize
new 3026414-10.test-only.patch27.49 KB
new 3026414-5.patch25.89 KB

Oh here's a test patch with #3026386: Drush fatal error after upgrading to 8.6.6, 8.5.9, or 7.62: PHP Fatal error: Uncaught TYPO3\PharStreamWrapper\Exception reverted as that is helpful.

Uploading #5 again for the same reason.

The last submitted patch, 9: 3026414-9.test-only.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

The last submitted patch, 10: 3026414-10.test-only.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

fabianx’s picture

fabianx commented
Status: Needs review » Reviewed & tested by the community

RTBC - looks great to me -- both cases pass :)

The last submitted patch, 9: 3026414-5.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

effulgentsia’s picture

effulgentsia commented

Looks good to me as well. Crediting @Fabianx for review.

  • effulgentsia committed 25c8f25 on 8.7.x 
    Issue #3026414 by alexpott, Fabianx: Add tests for...
effulgentsia’s picture

effulgentsia commented
Status: Reviewed & tested by the community » Fixed

Pushed to 8.7.x. Marking Fixed for now, but should we cherry pick to 8.6.x and backport to 7.x?

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented

@effulgentsia I would as this is important test coverage and tests are not API.

mondrake’s picture

mondrake
Location 🇮🇹
commented

Mmm, started getting

Fatal error: PHPUnit\Util\Fileloader::main(): Failed opening required '/home/travis/drupal8/core/../../../../../../../autoload.php' (include_path='.:/home/travis/.phpenv/versions/7.3.0/share/pear') in /home/travis/drupal8/core/tests/Drupal/KernelTests/Core/File/fixtures/cli_phar_builder/index.php on line 16

on TravisCI testing since when this got committed.

See https://travis-ci.org/mondrake/imagemagick/builds/484074305

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Status: Fixed » Needs work

oh drats... okay we need to make this work regardless of cwd. I'll revert and then make it work when you run tests from inside the ./core folder.

  • alexpott committed 641bf94 on 8.7.x 
    Revert "Issue #3026414 by alexpott, Fabianx: Add tests for...
alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Status: Needs work » Needs review
StatusFileSize
new 10-22-interdiff.txt4.5 KB
new 3026414-22.patch25.48 KB

This is caused by the fact we evaluate all files in test folders as test not just *Test.php - see #2296635: Evaluate performance impact of limiting test discovery to *Test.php filename suffix.

So we need to move the fixtures outside of a test discovery location.

To test this try adding @group Phar to \Drupal\KernelTests\Core\File\PharWrapperTest and then running ./vendor/bin/phpunit -v -c ./core --group Phar

Before this patch #22 it'll crash the same way @mondrake is reporting and now it won't.

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

smustgrave’s picture

smustgrave commented
Status: Needs review » Postponed (maintainer needs more info)

@catch was trying to check this one out but appears PharWrapperTest is removed in D10?

Is this ticket still needed?

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

quietone’s picture

quietone commented
Status: Postponed (maintainer needs more info) » Closed (outdated)

PharExtensionInterceptor was removed in #3210486: Remove typo3/phar-stream-wrapper and associated code, so yes, there is not need to test.