Realpath Replacement

realpath() is the libc function that PHP calls to retrieve the full pathname to files it uses. Unfortunately realpath() is implemented on all platforms in slightly different ways. Some of these implementations are still broken or atleast were broken in the past and are responsible for additional security problems within PHP. Earlier OpenBSD versions of realpath() for example silently truncated overlong paths which lead to open_basedir and safe_mode problems within PHP. The GNU libc implementation for example still allows to use ../ on path components that are not directories but existing files. This behaviour results for example in certain include vulnerabilities beeing exploitable on linux. On other systems realpath() is simply not thread safe.

To stop all these attacks Suhosin replaces the realpath() function PHP uses with the one implemented by FreeBSD which was the most robust one at the time this patch was created.

Back to the feature list


© Hardened PHP Project