symfony-cli · maciekpaprocki · Feb 1, 2023 · Feb 25, 2023 · Feb 25, 2023 · Feb 25, 2023
diff --git a/local/php/envs.go b/local/php/envs.go
@@ -29,20 +29,58 @@ import (
 	"github.com/symfony-cli/symfony-cli/envs"
 )
 
-func (p *Server) generateEnv(req *http.Request) map[string]string {
-	scriptName := p.passthru
-	https := ""
-	if req.TLS != nil {
-		https = "On"
-	}
-
-	pathInfo := req.URL.Path
+func (p *Server) resolveScriptName(pathInfo string) (string, string) {
 	if pos := strings.Index(strings.ToLower(pathInfo), ".php"); pos != -1 {
 		file := pathInfo[:pos+4]
+		if file == filepath.Clean(file) {
+			if _, err := os.Stat(filepath.Join(p.documentRoot, file)); err == nil {
+				return file, pathInfo[pos+4:]
+			}
+		}
+	}
+	// quick return if it's short or path starts with //
+	if len(pathInfo) <= 1 || pathInfo[0:2] == "//" {
+		return p.passthru, pathInfo
+	}
+
+	// removes first slash to make sure we don't loop through it as it always need to be there.
+	paths := strings.Split(pathInfo[1:], "/")
+
+	for n := len(paths); n > 0; n-- {
+		pathPart := paths[n-1]
+		if pathPart == "" {
+			continue
+		}
+
+		// we on purpose don't use filepath join as it resolves the paths. This way if clean filepath is different we break
+		folder := string(filepath.Separator) + strings.Join(paths[:n], string(filepath.Separator))
+
+		if folder != filepath.Clean(folder) {
+			continue
+		}
+
+		file := filepath.Join(folder, p.passthru)
+		path := strings.Join(paths[n:], "/")
+
 		if _, err := os.Stat(filepath.Join(p.documentRoot, file)); err == nil {
-			scriptName = file
-			pathInfo = pathInfo[pos+4:]
+			// I am not sure how we can get rid of this if statements. It's complete abomination, but it's because subdirectory and subdirectory/ should go to this same file, but have different pathinfo
+			if path == "" && pathInfo[len(pathInfo)-1:] != "/" {
+				return file, ""
+			}
+			return file, "/" + path
 		}
+
+	}
+
+	return p.passthru, pathInfo
+}
+
+func (p *Server) generateEnv(req *http.Request) map[string]string {
+	scriptName, pathInfo := p.resolveScriptName(req.URL.Path)
+
+	https := ""
+	if req.TLS != nil {
+		https = "On"
 	}
 
 	remoteAddr := req.Header.Get("X-Client-IP")

diff --git a/local/php/envs_test.go b/local/php/envs_test.go
@@ -182,6 +182,138 @@ func (s *PHPFPMSuite) TestGenerateEnv(c *C) {
 				"SCRIPT_NAME":     "/index.php",
 			},
 		},
+		{
+			passthru: "/index.php",
+			uri:      "/subdirectory",
+			expected: map[string]string{
+				"PATH_INFO":       "",
+				"REQUEST_URI":     "/subdirectory",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/subdirectory/index.php",
+				"SCRIPT_NAME":     "/subdirectory/index.php",
+			},
+		},
+		{
+			passthru: "/index.php",
+			uri:      "/subdirectory/",
+			expected: map[string]string{
+				"PATH_INFO":       "/",
+				"REQUEST_URI":     "/subdirectory/",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/subdirectory/index.php",
+				"SCRIPT_NAME":     "/subdirectory/index.php",
+			},
+		},
+		{
+			passthru: "/index.php",
+			uri:      "/subdirectory/unknown.php",
+			expected: map[string]string{
+				"PATH_INFO":       "/unknown.php",
+				"REQUEST_URI":     "/subdirectory/unknown.php",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/subdirectory/index.php",
+				"SCRIPT_NAME":     "/subdirectory/index.php",
+			},
+		},
+		{
+			passthru: "/index.php",
+			uri:      "/subdirectory/unknown.php/",
+			expected: map[string]string{
+				"PATH_INFO":       "/unknown.php/",
+				"REQUEST_URI":     "/subdirectory/unknown.php/",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/subdirectory/index.php",
+				"SCRIPT_NAME":     "/subdirectory/index.php",
+			},
+		},
+		{
+			passthru: "/index.php",
+			uri:      "/subdirectory/index.php/foo",
+			expected: map[string]string{
+				"PATH_INFO":       "/foo",
+				"REQUEST_URI":     "/subdirectory/index.php/foo",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/subdirectory/index.php",
+				"SCRIPT_NAME":     "/subdirectory/index.php",
+			},
+		},
+		{
+			passthru: "/index.php",
+			uri:      "/subdirectory/subdirectory/",
+			expected: map[string]string{
+				"PATH_INFO":       "/",
+				"REQUEST_URI":     "/subdirectory/subdirectory/",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/subdirectory/subdirectory/index.php",
+				"SCRIPT_NAME":     "/subdirectory/subdirectory/index.php",
+			},
+		},
+		{
+			passthru: "/index.php",
+			uri:      "///subdirectory",
+			expected: map[string]string{
+				"PATH_INFO":       "///subdirectory",
+				"REQUEST_URI":     "///subdirectory",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/index.php",
+				"SCRIPT_NAME":     "/index.php",
+			},
+		},
+		{
+			passthru: "/index.php",
+			uri:      "/subdirectory///subdirectory//foo/",
+			expected: map[string]string{
+				"PATH_INFO":       "///subdirectory//foo/",
+				"REQUEST_URI":     "/subdirectory///subdirectory//foo/",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/subdirectory/index.php",
+				"SCRIPT_NAME":     "/subdirectory/index.php",
+			},
+		},
+		{
+			passthru: "/index.php",
+			uri:      "/../index.php",
+			expected: map[string]string{
+				"PATH_INFO":       "/../index.php",
+				"REQUEST_URI":     "/../index.php",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/index.php",
+				"SCRIPT_NAME":     "/index.php",
+			},
+		},
+		{
+			passthru: "/index.php",
+			uri:      "/subdirectory/../../index.php",
+			expected: map[string]string{
+				"PATH_INFO":       "/../../index.php",
+				"REQUEST_URI":     "/subdirectory/../../index.php",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/subdirectory/index.php",
+				"SCRIPT_NAME":     "/subdirectory/index.php",
+			},
+		},
+		{
+			passthru: "/index.php",
+			uri:      "/subdirectory/subdirectory/foo/subdirectory/bar",
+			expected: map[string]string{
+				"PATH_INFO":       "/foo/subdirectory/bar",
+				"REQUEST_URI":     "/subdirectory/subdirectory/foo/subdirectory/bar",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/subdirectory/subdirectory/index.php",
+				"SCRIPT_NAME":     "/subdirectory/subdirectory/index.php",
+			},
+		},
+		{
+			passthru: "/index.php",
+			uri:      "/foo/../update.php",
+			expected: map[string]string{
+				"PATH_INFO":       "/foo/../update.php",
+				"REQUEST_URI":     "/foo/../update.php",
+				"QUERY_STRING":    "",
+				"SCRIPT_FILENAME": testdataDir + "/public/index.php",
+				"SCRIPT_NAME":     "/index.php",
+			},
+		},
 	}
 	for _, test := range tests {
 		process := &Server{
@@ -197,7 +329,7 @@ func (s *PHPFPMSuite) TestGenerateEnv(c *C) {
 		for k, v := range test.expected {
 			vv, ok := env[k]
 			c.Assert(ok, Equals, true)
-			c.Assert(vv, DeepEquals, v)
+			c.Assert(vv, DeepEquals, v, Commentf("#test uri:\"%s\" varName:\"%s\"", test.uri, k))
 		}
 	}
 }
diff --git a/local/php/testdata/index.php b/local/php/testdata/index.php
diff --git a/local/php/testdata/public/subdirectory/index.php b/local/php/testdata/public/subdirectory/index.php
diff --git a/local/php/testdata/public/subdirectory/subdirectory/index.php b/local/php/testdata/public/subdirectory/subdirectory/index.php