zip_open/ZipArchive should throw an exception in CLI server mode unless opening read-only
- Dominant language
- C++
- Stars
- 18.7k
- Forks
- 3.1k
- Avg merge
- 1h 47m
- Merged PRs (30d)
- 2
Description
**Describe the bug**
https://github.com/facebook/hhvm/blob/908da97341f8d4b65bd19884489a4e8a1adaaa98/hphp/runtime/ext/zip/ext_zip.cpp#L45 attempts to set the appropriate flags for various modes in CLI server, however they will never work:
https://libzip.org/documentation/zip_fdopen.html
> In contrast to [zip_open(3)](https://libzip.org/documentation/zip_open.html), using zip_fdopen the archive can only be opened in read-only mode.
zip_open can't directly be used here because it would be a privilege escalation bug.
I think a 'real fix' would be making the CLI client process capable of high-level zip operations, but a clear 'unsupported in CLI server mode' exception would make debugging issues much simpler.
**Standalone code, or other way to reproduce the problem**
**IN CLI SERVER MODE**
```
$z = new ZipArchive();
$z->open('/tmp/foo.zip', ZIPARCHIVE::CREATE); // ALWAYS fails
```
**Expected behavior**
Ideally, it works, opening the zip as the CLI client user.
Better would be a clear exception saying why it will always fail
**Actual behavior**
open fails, invalid zip
Contributor guide
Assessment
This issue has not been assessed yet.