From: Christian Flothmann <christian.flothmann@sensiolabs.de>
Date: Fri, 1 Sep 2017 09:13:50 +0200
Subject: prevent bundle readers from breaking out of paths

[CVE-2017-16654] https://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-out-of-paths

Origin: upstream, https://github.com/symfony/symfony/commit/c8f9f916b4b93f5676fad46c664980935c7757ae
---
 .../Component/Intl/Data/Bundle/Reader/JsonBundleReader.php |  5 +++++
 .../Component/Intl/Data/Bundle/Reader/PhpBundleReader.php  |  5 +++++
 .../Data/Bundle/Reader/Fixtures/invalid_directory/en.json  |  1 +
 .../Data/Bundle/Reader/Fixtures/invalid_directory/en.php   | 14 ++++++++++++++
 .../Intl/Tests/Data/Bundle/Reader/JsonBundleReaderTest.php |  8 ++++++++
 .../Intl/Tests/Data/Bundle/Reader/PhpBundleReaderTest.php  |  8 ++++++++
 6 files changed, 41 insertions(+)
 create mode 100644 src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.json
 create mode 100644 src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.php

diff --git a/src/Symfony/Component/Intl/Data/Bundle/Reader/JsonBundleReader.php b/src/Symfony/Component/Intl/Data/Bundle/Reader/JsonBundleReader.php
index 84b20ab..4a84b64 100644
--- a/src/Symfony/Component/Intl/Data/Bundle/Reader/JsonBundleReader.php
+++ b/src/Symfony/Component/Intl/Data/Bundle/Reader/JsonBundleReader.php
@@ -30,6 +30,11 @@ class JsonBundleReader implements BundleReaderInterface
     {
         $fileName = $path.'/'.$locale.'.json';
 
+        // prevent directory traversal attacks
+        if (dirname($fileName) !== $path) {
+            throw new ResourceBundleNotFoundException(sprintf('The resource bundle "%s" does not exist.', $fileName));
+        }
+
         if (!file_exists($fileName)) {
             throw new ResourceBundleNotFoundException(sprintf(
                 'The resource bundle "%s/%s.json" does not exist.',
diff --git a/src/Symfony/Component/Intl/Data/Bundle/Reader/PhpBundleReader.php b/src/Symfony/Component/Intl/Data/Bundle/Reader/PhpBundleReader.php
index 57391ce..0b66bb1 100644
--- a/src/Symfony/Component/Intl/Data/Bundle/Reader/PhpBundleReader.php
+++ b/src/Symfony/Component/Intl/Data/Bundle/Reader/PhpBundleReader.php
@@ -30,6 +30,11 @@ class PhpBundleReader implements BundleReaderInterface
     {
         $fileName = $path.'/'.$locale.'.php';
 
+        // prevent directory traversal attacks
+        if (dirname($fileName) !== $path) {
+            throw new ResourceBundleNotFoundException(sprintf('The resource bundle "%s" does not exist.', $fileName));
+        }
+
         if (!file_exists($fileName)) {
             throw new ResourceBundleNotFoundException(sprintf(
                 'The resource bundle "%s/%s.php" does not exist.',
diff --git a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.json b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.json
new file mode 100644
index 0000000..16ea32a
--- /dev/null
+++ b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.json
@@ -0,0 +1 @@
+{"Foo":"Bar"}
diff --git a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.php b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.php
new file mode 100644
index 0000000..f2b06a9
--- /dev/null
+++ b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.php
@@ -0,0 +1,14 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+return array(
+    'Foo' => 'Bar',
+);
diff --git a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/JsonBundleReaderTest.php b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/JsonBundleReaderTest.php
index a6183ed..8366372 100644
--- a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/JsonBundleReaderTest.php
+++ b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/JsonBundleReaderTest.php
@@ -68,4 +68,12 @@ class JsonBundleReaderTest extends \PHPUnit_Framework_TestCase
     {
         $this->reader->read(__DIR__.'/Fixtures/json', 'en_Invalid');
     }
+
+    /**
+     * @expectedException \Symfony\Component\Intl\Exception\ResourceBundleNotFoundException
+     */
+    public function testReaderDoesNotBreakOutOfGivenPath()
+    {
+        $this->reader->read(__DIR__.'/Fixtures/json', '../invalid_directory/en');
+    }
 }
diff --git a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/PhpBundleReaderTest.php b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/PhpBundleReaderTest.php
index 3c58ee7..a026954 100644
--- a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/PhpBundleReaderTest.php
+++ b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/PhpBundleReaderTest.php
@@ -60,4 +60,12 @@ class PhpBundleReaderTest extends \PHPUnit_Framework_TestCase
     {
         $this->reader->read(__DIR__.'/Fixtures/NotAFile', 'en');
     }
+
+    /**
+     * @expectedException \Symfony\Component\Intl\Exception\ResourceBundleNotFoundException
+     */
+    public function testReaderDoesNotBreakOutOfGivenPath()
+    {
+        $this->reader->read(__DIR__.'/Fixtures/php', '../invalid_directory/en');
+    }
 }