\Drupal\Core\Security\PharExtensionInterceptor is incompatible with GeoIP and other libraries that use phar aliases or Phar::mapPhar()

Created on 16 January 2019, over 6 years ago

Updated 30 January 2023, over 2 years ago

Problem/Motivation

In #3026386: Drush fatal error after upgrading to 8.6.6, 8.5.9, or 7.62: PHP Fatal error: Uncaught TYPO3\PharStreamWrapper\Exception → and Slack, multiple users reported that their GeoIP installation was broken after updating Drupal to 7.62. All users were using the phar version of the GeoIP library.

From @jlockhart:

This doesn't appear to be limited to Drush. While it fixed one of my sites I'm still seeing the error on 2 others. In those cases its with the geoip module.

Warning: Uncaught TYPO3\PharStreamWrapper\Exception: Unexpected file extension in "phar://geoip2.phar/vendor/autoload.php"

I've applied the patch from #32 for a Drupal 7, PHP 7.1

Steps to Reproduce

TODO

Proposed resolution

Improve the handling of paths in typo3/phar-stream-wrapper and update core/composer.json and core/composer.lock with the next version of that library.

Remaining tasks

The issue branched into working on typo3/phar-stream-wrapper per @alexpott's comments in #48 🐛 \Drupal\Core\Security\PharExtensionInterceptor is incompatible with GeoIP and other libraries that use phar aliases or Phar::mapPhar() Needs work :

Open a PR to backport changes to https://github.com/TYPO3/phar-stream-wrapper/ master to the v2 branch - we need the v2 branch for PHP5 support
Improve PHAR alias handling: typo3/phar-stream-wrapper Pull Request #12: DONE
Back port #12 to v2: typo3/phar-stream-wrapper Pull Request #15: DONE
Update the issue summary with clear reproduction steps from comments and reports from people in this issue and in sub-issues
Create a patch to test typo3/phar-stream-wrapper:dev-master in core/composer.json and composer.lock
Update our libraries: requires typo3/phar-stream-wrapper:2.0.2.
Review the eventual patch for security concerns.
Update the issue summary to address API changes and Release notes snippet TBD.

User interface changes

None.

API changes

TBD.

Data model changes

None.

Release notes snippet

TBD.

🐛 Bug report

Status

Needs work

Version

10.1 ✨

Component

Bootstrap →

Last updated 16 days ago

No maintainer

Created by

🇺🇸United States samuel.mortenson

Live updates comments and jobs are added and updated live.

SA-CORE-2019-002 regression

Contributed project blocker
It denotes an issue that prevents porting of a contributed project to the stable version of Drupal due to missing APIs, regressions, and so on.

Needs security review

Needs issue summary update
Issue summaries save everyone time if they are kept up-to-date. See Update issue summary task instructions.

Incomplete comments

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Comment over 2 years ago →
needs-review-queue-bot
The Needs Review Queue Bot → tested this issue. It either no longer applies to Drupal core, or fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.
Status changed to Closed: outdated 16 days ago8:32pm 22 May 2025
Comment 16 days ago →
🇺🇸United States akalata
\Drupal\Core\Security\PharExtensionInterceptor was removed from D10 in https://www.drupal.org/project/drupal/issues/3210486 → , so this issue no longer applies to Drupal core.

contrib.social Blog FAQ Discussions

Production build 0.71.5 2024