From: Stephen Rees-Carter <stephen@rees-carter.net>
Date: Thu, 18 Nov 2021 12:10:56 +1000
Subject: Add .phar to blocked PHP extensions (#39666)

By default Debian includes support for executing .phar files alongside
.php and .phtml files, and should be included in the blocked list.

Origin: https://github.com/laravel/framework/commit/ccea1bfcbb37cf923dc1bb30cdbf2effbfb1619c
Applied-Upstream: 6.20.41
---
 src/Illuminate/Validation/Concerns/ValidatesAttributes.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Illuminate/Validation/Concerns/ValidatesAttributes.php b/src/Illuminate/Validation/Concerns/ValidatesAttributes.php
index 84e0964..6f0d8d6 100644
--- a/src/Illuminate/Validation/Concerns/ValidatesAttributes.php
+++ b/src/Illuminate/Validation/Concerns/ValidatesAttributes.php
@@ -1254,7 +1254,7 @@ trait ValidatesAttributes
         }
 
         $phpExtensions = [
-            'php', 'php3', 'php4', 'php5', 'phtml',
+            'php', 'php3', 'php4', 'php5', 'phtml', 'phar',
         ];
 
         return ($value instanceof UploadedFile)