file.phar.inc

<?php

use Drupal\Core\Security\PharExtensionInterceptor;
use TYPO3\PharStreamWrapper\Manager as PharStreamWrapperManager;
use TYPO3\PharStreamWrapper\Behavior as PharStreamWrapperBehavior;
use TYPO3\PharStreamWrapper\PharStreamWrapper;

/**
 * Registers a phar stream wrapper that is more secure than PHP's built-in one.
 *
 * @see file_get_stream_wrappers()
 */
function file_register_phar_wrapper() {
    $directory = DRUPAL_ROOT . '/misc/typo3/phar-stream-wrapper/src';
    include_once $directory . '/Assertable.php';
    include_once $directory . '/Behavior.php';
    include_once $directory . '/Exception.php';
    include_once $directory . '/Helper.php';
    include_once $directory . '/Manager.php';
    include_once $directory . '/PharStreamWrapper.php';
    include_once $directory . '/Collectable.php';
    include_once $directory . '/Interceptor/ConjunctionInterceptor.php';
    include_once $directory . '/Interceptor/PharMetaDataInterceptor.php';
    include_once $directory . '/Phar/Container.php';
    include_once $directory . '/Phar/DeserializationException.php';
    include_once $directory . '/Phar/Manifest.php';
    include_once $directory . '/Phar/Reader.php';
    include_once $directory . '/Phar/ReaderException.php';
    include_once $directory . '/Phar/Stub.php';
    include_once $directory . '/Resolvable.php';
    include_once $directory . '/Resolver/PharInvocation.php';
    include_once $directory . '/Resolver/PharInvocationCollection.php';
    include_once $directory . '/Resolver/PharInvocationResolver.php';
    include_once DRUPAL_ROOT . '/misc/typo3/drupal-security/PharExtensionInterceptor.php';
    include_once DRUPAL_ROOT . '/misc/brumann/polyfill-unserialize/src/Unserialize.php';
    // Set up a stream wrapper to handle insecurities due to PHP's built-in
    // phar stream wrapper.
    try {
        $behavior = new PharStreamWrapperBehavior();
        PharStreamWrapperManager::initialize($behavior->withAssertion(new PharExtensionInterceptor()));
    } catch (\LogicException $e) {
        // Continue if the PharStreamWrapperManager is already initialized.
        // For example, this occurs following a drupal_static_reset(), such
        // as during tests.
    }
    // To prevent file_stream_wrapper_valid_scheme() treating "phar" as a valid
    // scheme, this is registered with PHP only, not with  hook_stream_wrappers()
    // or the internal storage of file_get_stream_wrappers().
    stream_wrapper_register('phar', '\\TYPO3\\PharStreamWrapper\\PharStreamWrapper');
}