Do not read from argv on non-CLI SAPIs

wouterj · wouterj · commit a77b308c3f17 · 2024-11-05T13:04:22.000+01:00
diff --git a/src/Symfony/Component/Runtime/SymfonyRuntime.php b/src/Symfony/Component/Runtime/SymfonyRuntime.php
@@ -95,7 +95,7 @@ public function __construct(array $options = [])
 
         if (isset($options['env'])) {
             $_SERVER[$envKey] = $options['env'];
-        } elseif (isset($_SERVER['argv']) && class_exists(ArgvInput::class)) {
+        } elseif (empty($_GET) && isset($_SERVER['argv']) && class_exists(ArgvInput::class)) {
             $this->options = $options;
             $this->getInput();
         }
@@ -216,6 +216,10 @@ protected static function register(GenericRuntime $runtime): GenericRuntime
 
     private function getInput(): ArgvInput
     {
+        if (!empty($_GET) && filter_var(ini_get('register_argc_argv'), \FILTER_VALIDATE_BOOL)) {
+            throw new \Exception('CLI applications cannot be run safely on non-CLI SAPIs with register_argc_argv=On.');
+        }
+
         if (null !== $this->input) {
             return $this->input;
         }
diff --git a/src/Symfony/Component/Runtime/Tests/phpt/kernel.php b/src/Symfony/Component/Runtime/Tests/phpt/kernel.php
@@ -17,19 +17,21 @@
 
 class TestKernel implements HttpKernelInterface
 {
+    private $env;
     private $var;
 
-    public function __construct(string $var)
+    public function __construct(string $env, string $var)
     {
+        $this->env = $env;
         $this->var = $var;
     }
 
     public function handle(Request $request, $type = self::MASTER_REQUEST, $catch = true): Response
     {
-        return new Response('OK Kernel '.$this->var);
+        return new Response('OK Kernel (env='.$this->env.') '.$this->var);
     }
 }
 
 return function (array $context) {
-    return new TestKernel($context['SOME_VAR']);
+    return new TestKernel($context['APP_ENV'], $context['SOME_VAR']);
 };
diff --git a/src/Symfony/Component/Runtime/Tests/phpt/kernel.phpt b/src/Symfony/Component/Runtime/Tests/phpt/kernel.phpt
@@ -9,4 +9,4 @@ require $_SERVER['SCRIPT_FILENAME'] = __DIR__.'/kernel.php';
 
 ?>
 --EXPECTF--
-OK Kernel foo_bar
+OK Kernel (env=dev) foo_bar
diff --git a/src/Symfony/Component/Runtime/Tests/phpt/kernel_register_argc_argv.phpt b/src/Symfony/Component/Runtime/Tests/phpt/kernel_register_argc_argv.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Test HttpKernelInterface with register_argc_argv=1
+--INI--
+display_errors=1
+register_argc_argv=1
+--FILE--
+<?php
+
+// emulating PHP behavior with register_argc_argv=1
+$_GET['-e_test'] = '';
+$_SERVER['argc'] = 1;
+$_SERVER['argv'] = [' ', '-e', 'test'];
+
+require $_SERVER['SCRIPT_FILENAME'] = __DIR__.'/kernel.php';
+
+?>
+--EXPECTF--
+OK Kernel (env=dev) foo_bar

Original file line number	Diff line number	Diff line change
`@@ -95,7 +95,7 @@ public function __construct(array $options = [])`
`95`	`95`
`96`	`96`	`if (isset($options['env'])) {`
`97`	`97`	`$_SERVER[$envKey] = $options['env'];`
`98`		`- } elseif (isset($_SERVER['argv']) && class_exists(ArgvInput::class)) {`
	`98`	`+ } elseif (empty($_GET) && isset($_SERVER['argv']) && class_exists(ArgvInput::class)) {`
`99`	`99`	`$this->options = $options;`
`100`	`100`	`$this->getInput();`
`101`	`101`	`}`
`@@ -216,6 +216,10 @@ protected static function register(GenericRuntime $runtime): GenericRuntime`
`216`	`216`
`217`	`217`	`private function getInput(): ArgvInput`
`218`	`218`	`{`
	`219`	`+ if (!empty($_GET) && filter_var(ini_get('register_argc_argv'), \FILTER_VALIDATE_BOOL)) {`
	`220`	`+ throw new \Exception('CLI applications cannot be run safely on non-CLI SAPIs with register_argc_argv=On.');`
	`221`	`+ }`
	`222`	`+`
`219`	`223`	`if (null !== $this->input) {`
`220`	`224`	`return $this->input;`
`221`	`225`	`}`
Original file line number	Diff line number	Diff line change
`@@ -17,19 +17,21 @@`
`17`	`17`
`18`	`18`	`class TestKernel implements HttpKernelInterface`
`19`	`19`	`{`
	`20`	`+ private $env;`
`20`	`21`	`private $var;`
`21`	`22`
`22`		`- public function __construct(string $var)`
	`23`	`+ public function __construct(string $env, string $var)`
`23`	`24`	`{`
	`25`	`+ $this->env = $env;`
`24`	`26`	`$this->var = $var;`
`25`	`27`	`}`
`26`	`28`
`27`	`29`	`public function handle(Request $request, $type = self::MASTER_REQUEST, $catch = true): Response`
`28`	`30`	`{`
`29`		`- return new Response('OK Kernel '.$this->var);`
	`31`	`+ return new Response('OK Kernel (env='.$this->env.') '.$this->var);`
`30`	`32`	`}`
`31`	`33`	`}`
`32`	`34`
`33`	`35`	`return function (array $context) {`
`34`		`- return new TestKernel($context['SOME_VAR']);`
	`36`	`+ return new TestKernel($context['APP_ENV'], $context['SOME_VAR']);`
`35`	`37`	`};`