Use /dev/urandom if it's encapsulated by open_basedir

paragonie · Oct 12, 2015 · 4629665 · 4629665
1 parent 40bd4c1
commit 4629665
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/lib/random.php b/lib/random.php
@@ -59,13 +59,25 @@
         } elseif (!ini_get('open_basedir') && is_readable('/dev/urandom')) {
             // See random_bytes_dev_urandom.php
             require_once "random_bytes_dev_urandom.php";
+        } elseif (
+            // Is /dev/urandom encapsualted by open_basedir?
+            $basedir = explode(':', ini_get('open_basedir')) && (
+                in_array('/dev', $basedir) || in_array('/dev/', $basedir)
+            )
+        ) {
+            // See random_bytes_dev_urandom.php
+            require_once "random_bytes_dev_urandom.php";
         } elseif (PHP_VERSION_ID >= 50307 && extension_loaded('mcrypt')) {
             // See random_bytes_mcrypt.php
             require_once "random_bytes_mcrypt.php";
         } elseif (extension_loaded('com_dotnet')) {
             // See random_bytes_com_dotnet.php
             require_once "random_bytes_com_dotnet.php";
-        } elseif (extension_loaded('openssl')) {
+        } elseif (extension_loaded('openssl') && (
+               PHP_VERSION_ID >= 50444 && PHP_VERSION_ID <= 50499
+            || PHP_VERSION_ID >= 50528 && PHP_VERSION_ID <= 50599
+            || PHP_VERSION_ID >= 50612 && PHP_VERSION_ID <= 50699
+        )) {
             // See random_bytes_openssl.php
             require_once "random_bytes_openssl.php";
         } else {

diff --git a/tests/phpunit.sh b/tests/phpunit.sh
@@ -68,6 +68,11 @@ if [ $? -eq 0 ]; then
         # Test failure
         exit 1
     fi
+    php -d open_basedir=$parentdir:/dev/ phpunit.phar --bootstrap "$parentdir/vendor/autoload.php" "$parentdir/tests/unit"
+    if [ $? -ne 0 ]; then
+        # Test failure
+        exit 1
+    fi
     php -d mbstring.func_overload=7 phpunit.phar --bootstrap "$parentdir/vendor/autoload.php" "$parentdir/tests/unit"
     if [ $? -ne 0 ]; then
         # Test failure