@@ -56,56 +56,49 @@ public function canServeRequestAsStaticFile(Request $request, RequestContext $co
5656
5757 $ publicPath = $ context ->publicPath ;
5858
59- $ realpath = realpath ($ publicPath .'/ ' .$ request ->path ());
59+ $ pathToFile = realpath ($ publicPath .'/ ' .$ request ->path ());
6060
61- if ($ this ->checkSymlinkInPath ( $ publicPath , $ realpath , $ request -> path () )) {
62- $ realpath = $ publicPath .'/ ' .$ request ->path ();
61+ if ($ this ->isValidFileWithinSymlink ( $ request , $ publicPath , $ pathToFile )) {
62+ $ pathToFile = $ publicPath .'/ ' .$ request ->path ();
6363 }
6464
6565 return $ this ->fileIsServable (
6666 $ publicPath ,
67- $ realpath ,
67+ $ pathToFile ,
6868 );
6969 }
7070
7171 /**
72- * Checks whether the request path contains a Symlink.
73- * When a Symlink is found, it is checked against the the resolved real path,
74- * in order to protect against directory traversal.
72+ * Determine if the request is for a valid static file within a symlink.
7573 *
74+ * @param \Illuminate\Http\Request $request
7675 * @param string $publicPath
77- * @param string $realPath
78- * @param string $requestPath
76+ * @param string $pathToFile
7977 * @return bool
8078 */
81- private function checkSymlinkInPath ( string $ publicPath , string $ realPath , string $ requestPath ): bool
79+ private function isValidFileWithinSymlink ( Request $ request , string $ publicPath , string $ pathToFile ): bool
8280 {
83- $ resolvedPathIfSymlink = $ this ->pathContainsSymlink ($ publicPath , $ requestPath );
84-
85- if (! $ resolvedPathIfSymlink ) {
86- return false ;
87- }
81+ $ pathAfterSymlink = $ this ->pathAfterSymlink ($ publicPath , $ request ->path ());
8882
89- return str_ends_with ($ realPath , $ resolvedPathIfSymlink );
83+ return $ pathAfterSymlink && str_ends_with ($ pathToFile , $ pathAfterSymlink );
9084 }
9185
9286 /**
93- * Determine whether the path contains a symlink.
94- * When a symlink is found, the path after it is returned.
87+ * If the given public file is within a symlinked directory, return the path after the symlink.
9588 *
96- * @param string $publicPath
97- * @param string $path
89+ * @param string $publicPath
90+ * @param string $path
9891 * @return string|bool
9992 */
100- private function pathContainsSymlink (string $ publicPath , string $ path )
93+ private function pathAfterSymlink (string $ publicPath , string $ path )
10194 {
102- $ dirs = explode ('/ ' , $ path );
95+ $ directories = explode ('/ ' , $ path );
10396
104- while ($ dir = array_shift ($ dirs )) {
105- $ publicPath .= '/ ' .$ dir ;
97+ while ($ directory = array_shift ($ directories )) {
98+ $ publicPath .= '/ ' .$ directory ;
10699
107100 if (is_link ($ publicPath )) {
108- return implode ('/ ' , $ dirs );
101+ return implode ('/ ' , $ directories );
109102 }
110103 }
111104
0 commit comments