\Drupal\Core\Security\PharExtensionInterceptor is incompatible with GeoIP and other libraries that use phar aliases or Phar::mapPhar()

Created on 16 January 2019, over 5 years ago
Updated 30 January 2023, over 1 year ago

Problem/Motivation

In #3026386: Drush fatal error after upgrading to 8.6.6, 8.5.9, or 7.62: PHP Fatal error: Uncaught TYPO3\PharStreamWrapper\Exception β†’ and Slack, multiple users reported that their GeoIP installation was broken after updating Drupal to 7.62. All users were using the phar version of the GeoIP library.

From @jlockhart:

This doesn't appear to be limited to Drush. While it fixed one of my sites I'm still seeing the error on 2 others. In those cases its with the geoip module.

Warning: Uncaught TYPO3\PharStreamWrapper\Exception: Unexpected file extension in "phar://geoip2.phar/vendor/autoload.php"

I've applied the patch from #32 for a Drupal 7, PHP 7.1

Steps to Reproduce

TODO

Proposed resolution

Improve the handling of paths in typo3/phar-stream-wrapper and update core/composer.json and core/composer.lock with the next version of that library.

Remaining tasks

The issue branched into working on typo3/phar-stream-wrapper per @alexpott's comments in #48 πŸ› \Drupal\Core\Security\PharExtensionInterceptor is incompatible with GeoIP and other libraries that use phar aliases or Phar::mapPhar() Needs work :

  • Open a PR to backport changes to https://github.com/TYPO3/phar-stream-wrapper/ master to the v2 branch - we need the v2 branch for PHP5 support
  • Improve PHAR alias handling: typo3/phar-stream-wrapper Pull Request #12: DONE
  • Back port #12 to v2: typo3/phar-stream-wrapper Pull Request #15: DONE
  • Update the issue summary with clear reproduction steps from comments and reports from people in this issue and in sub-issues
  • Create a patch to test typo3/phar-stream-wrapper:dev-master in core/composer.json and composer.lock
  • Update our libraries: requires typo3/phar-stream-wrapper:2.0.2.
  • Review the eventual patch for security concerns.
  • Update the issue summary to address API changes and Release notes snippet TBD.

User interface changes

None.

API changes

TBD.

Data model changes

None.

Release notes snippet

TBD.

πŸ› Bug report
Status

Needs work

Version

10.1 ✨

Component
BootstrapΒ  β†’

Last updated 11 days ago

No maintainer
Created by

πŸ‡ΊπŸ‡ΈUnited States samuel.mortenson

Live updates comments and jobs are added and updated live.
  • Contributed project blocker

    It denotes an issue that prevents porting of a contributed project to the stable version of Drupal due to missing APIs, regressions, and so on.

  • Needs issue summary update

    Issue summaries save everyone time if they are kept up-to-date. See Update issue summary task instructions.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • The Needs Review Queue Bot β†’ tested this issue. It either no longer applies to Drupal core, or fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

    Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

    Consult the Drupal Contributor Guide β†’ to find step-by-step guides for working with issues.

Production build 0.69.0 2024