Harden proc_open() against cmd.exe hijacking

As is, whenever `proc_open()` needs to invoke the shell, cmd.exe is
looked up in the usual executable search path. That implies that any

Harden proc_open() against cmd.exe hijacking

As is, whenever `proc_open()` needs to invoke the shell, cmd.exe is
looked up in the usual executable search path. That implies that any
cmd.exe which is placed in the current working directory (which is not
necessarily what is reported by `getcwd()` for ZTS builds), will be
used. This is a known attack vector, and Microsoft recommends to
always use the fully qualified path to cmd.exe.

To prevent any cmd.exe in the current working directory to be used, but
to still allow users to use a drop in replacement for cmd.exe, we
search only the `PATH` for cmd.exe (and pass the fully qualified path
to `CreateProcessW`), instead of relying on automatic executable search
by passing the base name only.

To be able to easily test this, we provide a minimalist C file which
will be build as test_helper, and used by the new test case.

[1] <https://msrc.microsoft.com/blog/2014/04/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file/>

Closes GH-17043.

show more ...

Define default RE2C_FLAGS (#14615)

The --no-generation-date flag is a common re2c flag used in all re2c
invocations. This adds the 2nd optional argument to PHP_PROG_RE2C M4
macro in

Define default RE2C_FLAGS (#14615)

The --no-generation-date flag is a common re2c flag used in all re2c
invocations. This adds the 2nd optional argument to PHP_PROG_RE2C M4
macro in BC manner to set the default re2c command-line options and sets
the default RE2C_FLAGS similarly on Windows.

show more ...

Add bison -Wall flag to Windows build (#13098)

Following the d7d3a1c66e090489779eb43ffba18297d22d4893, this adds bison
flag -Wall also to Windows build system.

Flag has been add

Add bison -Wall flag to Windows build (#13098)

Following the d7d3a1c66e090489779eb43ffba18297d22d4893, this adds bison
flag -Wall also to Windows build system.

Flag has been added via 2127a37b833a863e28a4692e7394613b89c89290.

show more ...

Remove unneeded zend_language_parser.h patch (#12178)

This was cleaned in 4cbffd89d9e82d81a26746aadca27ad061cab43a and
patching the Zend/zend_language_parser.h file to include zend.h is

Remove unneeded zend_language_parser.h patch (#12178)

This was cleaned in 4cbffd89d9e82d81a26746aadca27ad061cab43a and
patching the Zend/zend_language_parser.h file to include zend.h is not
needed anymore.

Autotools build system part has been similarly cleaned via
32cdd330f33f01605f17d39c9ddd27cbe783f00c

show more ...

zend win32 RE2C header files to Make targets and generated_files

like zend_ini_parser.h, list zend_ini_scanner_defs.h and
zend_language_scanner_defs.h.

Add all these files to ge

zend win32 RE2C header files to Make targets and generated_files

like zend_ini_parser.h, list zend_ini_scanner_defs.h and
zend_language_scanner_defs.h.

Add all these files to generated_files so they don't get missed.

show more ...

Windows arm64 build system support

Closes GH-9116.

Merge branch 'PHP-8.0'

* PHP-8.0:
Fix #81120: PGO data for main PHP DLL are not used

Fix #81120: PGO data for main PHP DLL are not used

We need to look for the right file. To avoid total confusion, we also
rename the variables; however, the right solution would have bee

Fix #81120: PGO data for main PHP DLL are not used

We need to look for the right file. To avoid total confusion, we also
rename the variables; however, the right solution would have been to
drop the version suffixes, since they don't help (major + minor maybe,
but not major only).

show more ...

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |

show more ...

Add gen_stub.php to devel pack

Clean up the generation of the parsers

Prefer '%define api.value.type' to '#define YYSTYPE', so that Bison
know the type.

Use '%code requires' to declare what is needed to defin

Clean up the generation of the parsers

Prefer '%define api.value.type' to '#define YYSTYPE', so that Bison
know the type.

Use '%code requires' to declare what is needed to define the api.value.type
(that code is output in the generated header before the generated
definition of YYSTYPE).

Prefer '%define api.prefix' inside the grammar file to '-p' outside,
as anyway the functions defined in the file actually use this prefix.

Prefer `%param` to both `%parse-param` and `%lex-param`.

Closes GH-5138

show more ...

Replace fakemail with minimal PHP script

Unify mail related tests for *nix and Windows

Currently mail related tests are split for *nix and Windows (if there
are even Windows versions). The basic difference is that the *nix

Unify mail related tests for *nix and Windows

Currently mail related tests are split for *nix and Windows (if there
are even Windows versions). The basic difference is that the *nix
variants set the INI directive sendmail_path to just write the email to
disk, while the Windows tests use ext/imap. The latter tests are way
more verbose, and such duplicated tests are generally a pain point.
Furthermore, the Windows tests are much slower, and could not be run
without ext/imap being available.

We therefore introduce a small fakemail application, which basically
works like `tee <path> >/dev/null`, and which will be shipped with the
Windows tests packs. fakemail.exe would also need to be added to the
PHP binary SDK, so these tests could be run during developments.

To cater to the remaining differences, we also introduce support for
`{MAIL:<path>}` placeholders in the INI sections to run-tests.php. How
to use this can be seen in mail_basic.phpt, which is currently the only
modified test case, because these tests are yet supposed to fail on
Windows, due to the missing fakemail.exe in the PHP SDK.

show more ...

Remove mention of PHP major version in Copyright headers

Closes GH-4732.

Use regedit to register event source

ext/win32std is unmaintained for years, so it is highly unlikely that
it is available. We therefore use regedit instead to register the
event so

Use regedit to register event source

ext/win32std is unmaintained for years, so it is highly unlikely that
it is available. We therefore use regedit instead to register the
event source. We also remove the bundled syslog.reg, since it is of no
use, unless generated for the respective installation.

show more ...

Revert "Remove Windows syslog script and syslog.reg"

This reverts commit cc44bad1f6ded6a62c9bbe4d145b5b418aa775f4, since its
assumptions were not correct. Actually, the classic event lo

Revert "Remove Windows syslog script and syslog.reg"

This reverts commit cc44bad1f6ded6a62c9bbe4d145b5b418aa775f4, since its
assumptions were not correct. Actually, the classic event logging is
still used by PHP, because Windows 7 is still to be supported for a
while. Without the respective registry entries, the event log entries
show an error message regarding missing ID descriptions.

Thanks to ab@php.net for hinting at this!

Obviously, the part depending on ext/win32std has still to be
overhauled, and further improvements are conceivable; we will address
this in due course.

show more ...

Remove Windows syslog script and syslog.reg

These were used on old Windows systems before Vista and also were
used together with unmaintained win32std extension.

https://docs.mi

Remove Windows syslog script and syslog.reg

These were used on old Windows systems before Vista and also were
used together with unmaintained win32std extension.

https://docs.microsoft.com/en-us/windows/win32/eventlog/event-logging

Closes GH-4409

show more ...

Revert "Rename *.l files to *.re"

This reverts commit 969047749d33bb88a0573aa91a57e2070335111a.

Rename *.l files to *.re

This syncs PHP lexer files to all use *.re extension. The *.re files are
processed with the RE2C tool.

Don't use Opcache with the master test process

Additionally, enable opcache.file_cache to mitigate possible reattach
failures in the tests.

Refactor README.md file

- Initial refactorings of the README.md file with some more user
oriented information about the php-src repository and PHP in general.
- SVG logo added

Refactor README.md file

- Initial refactorings of the README.md file with some more user
oriented information about the php-src repository and PHP in general.
- SVG logo added
- README.WIN32-BUILD-SYSTEM file contents moved to README.md
- INSTALL file contents moved to README.md
- Windows releases now instead of install.txt file ship with the
README.md.
- A brief installation section added with help options mentioned for the
configure and make.
- Also mentioned the `-j` option for build and tests

Co-authored-by: Javier Eguiluz <javier.eguiluz@gmail.com>
Co-authored-by: Gabriel Caruso <carusogabriel34@gmail.com>
Co-authored-by: Matthias Kaschubowski <nihylum@gmail.com>

show more ...

Remove yearly range from copyright notice

Sync leading and final newlines in source code files

This patch adds missing newlines, trims multiple redundant final
newlines into a single one, and trims redundant leading newlines.

Sync leading and final newlines in source code files

This patch adds missing newlines, trims multiple redundant final
newlines into a single one, and trims redundant leading newlines.

According to POSIX, a line is a sequence of zero or more non-' <newline>'
characters plus a terminating '<newline>' character. [1] Files should
normally have at least one final newline character.

C89 [2] and later standards [3] mention a final newline:
"A source file that is not empty shall end in a new-line character,
which shall not be immediately preceded by a backslash character."

Although it is not mandatory for all files to have a final newline
fixed, a more consistent and homogeneous approach brings less of commit
differences issues and a better development experience in certain text
editors and IDEs.

[1] http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_206
[2] https://port70.net/~nsz/c/c89/c89-draft.html#2.1.1.2
[3] https://port70.net/~nsz/c/c99/n1256.html#5.1.1.2

show more ...

Trim trailing whitespace in source code files

Remove unused Git attributes ident

The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
use

Remove unused Git attributes ident

The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
user who changed it.

In Git this functionality is different and can be done with Git attribute
ident. These need to be defined manually for each file in the
.gitattributes file and are afterwards replaced with 40-character
hexadecimal blob object name which is based only on the particular file
contents.

This patch simplifies handling of $Id$ keywords by removing them since
they are not used anymore.

show more ...