BUGFIX: 4415 Fusion error on dev cache invalidation

Resolves #4415
neos · Sep 14, 2023 · 43b92bf · 43b92bf
1 parent 90c4ce4
commit 43b92bf
Showing 1 changed file with 20 additions and 4 deletions.
diff --git a/Neos.Fusion/Classes/Core/Cache/ParserCacheIdentifierTrait.php b/Neos.Fusion/Classes/Core/Cache/ParserCacheIdentifierTrait.php
@@ -26,19 +26,35 @@ private function getCacheIdentifierForDslCode(string $identifier, string $code):
         return 'dsl_' . $identifier . '_' . md5($code);
     }
 
+
     /**
      * creates a comparable hash of the absolute, resolved $fusionFileName
      *
      * @throws \InvalidArgumentException
      */
     private function getCacheIdentifierForFile(string $fusionFileName): string
     {
-        $realPath = realpath($fusionFileName);
-        if ($realPath === false) {
-            throw new \InvalidArgumentException("Couldn't resolve realpath for: '$fusionFileName'");
+        if (self::isRealPath($fusionFileName)) {
+            $realPath = $fusionFileName;
+        } else {
+            $realPath = realpath($fusionFileName);
+            if ($realPath === false) {
+                throw new \InvalidArgumentException("Couldn't resolve realpath for: '$fusionFileName'");
+            }
         }
-
         $realFusionFilePathWithoutRoot = str_replace(FLOW_PATH_ROOT, '', $realPath);
         return 'file_' . md5($realFusionFilePathWithoutRoot);
     }
+
+    private static function isRealPath(string $path): bool
+    {
+        $isAbsoluteWindowsPath = PHP_OS_FAMILY === 'Windows' && preg_match('`^[a-zA-Z]:/[^/]`', $path) === 1;
+        $isAbsolutePath = $path[0] === '/' || $isAbsoluteWindowsPath;
+        if (!$isAbsolutePath) {
+            return false;
+        }
+        $hasWindowsDirectoryTraversal = PHP_OS_FAMILY === 'Windows' && (str_contains($path, '\\..\\') || str_contains($path, '\\.\\'));
+        $hasDirectoryTraversal = str_contains($path, '/../') || str_contains($path, '/./') || $hasWindowsDirectoryTraversal;
+        return !$hasDirectoryTraversal;
+    }
 }