bug #51030 [Intl] Fixed directory traversal in emoji compression tool (rlandgrebe)

nicolas-grekas · nicolas-grekas · commit f105b5aa2405 · 2023-07-20T09:48:28.000+02:00
This PR was merged into the 6.3 branch. Discussion ---------- [Intl] Fixed directory traversal in emoji compression tool When using the compression tool, the emoji data is not compressed properly due to directory traversal issues. It only goes one level deep in the `data' directory. | Q | A | ------------- | --- | Branch? | 6.3  | Bug fix? | yes | New feature? | no  | Deprecations? | no  | Tickets | Fix #51029  | License | MIT | Doc PR |   Commits ------- da26542 [Intl] Fixed directory traversal in emoji compression tool
diff --git a/.github/workflows/intl-data-tests.yml b/.github/workflows/intl-data-tests.yml
@@ -84,7 +84,11 @@ jobs:
         run: |
           [ -f src/Symfony/Component/Intl/Resources/data/locales/en.php ]
           [ ! -f src/Symfony/Component/Intl/Resources/data/locales/en.php.gz ]
+          [ -f src/Symfony/Component/Intl/Resources/data/transliterator/emoji/emoji-en.php ]
+          [ ! -f src/Symfony/Component/Intl/Resources/data/transliterator/emoji/emoji-en.php.gz ]
           src/Symfony/Component/Intl/Resources/bin/compress
           [ ! -f src/Symfony/Component/Intl/Resources/data/locales/en.php ]
           [ -f src/Symfony/Component/Intl/Resources/data/locales/en.php.gz ]
+          [ ! -f src/Symfony/Component/Intl/Resources/data/transliterator/emoji/emoji-en.php ]
+          [ -f src/Symfony/Component/Intl/Resources/data/transliterator/emoji/emoji-en.php.gz ]
           ./phpunit src/Symfony/Component/Intl
diff --git a/src/Symfony/Component/Intl/Resources/bin/compress b/src/Symfony/Component/Intl/Resources/bin/compress
@@ -17,8 +17,15 @@ if (!extension_loaded('zlib')) {
     throw new Exception('This script requires the zlib extension.');
 }
 
-foreach (glob(dirname(__DIR__).'/data/*/*.php') as $file) {
-    if ('meta.php' === basename($file)) {
+$iterator = new RecursiveIteratorIterator(
+    new RecursiveDirectoryIterator(
+        dirname(__DIR__).'/data',
+        FilesystemIterator::CURRENT_AS_FILEINFO | FilesystemIterator::SKIP_DOTS
+    )
+);
+
+foreach ($iterator as $file) {
+    if ('php' !== $file->getExtension() || 'meta.php' === $file->getFilename()) {
         continue;
     }
 
