From 09964b32bd7e0ab63bb9d658cef6c0f558a8d6ab Mon Sep 17 00:00:00 2001 From: Daniel Scherzer Date: Thu, 17 Sep 2026 18:34:25 -0700 Subject: [PATCH] Phar extraction: add warning about following symlinks Add a warning to both `Phar::extractTo()` and `PharData::extractTo()` about the fact that symlinks in the target directory are followed. --- reference/phar/Phar/extractTo.xml | 10 ++++++++++ reference/phar/PharData/extractTo.xml | 10 ++++++++++ 2 files changed, 20 insertions(+) diff --git a/reference/phar/Phar/extractTo.xml b/reference/phar/Phar/extractTo.xml index 59d34b8ada0e..525e842ae2e8 100644 --- a/reference/phar/Phar/extractTo.xml +++ b/reference/phar/Phar/extractTo.xml @@ -25,6 +25,16 @@ set to true to enable overwriting of files. This method is similar to ZipArchive::extractTo. + + + + Extraction follows any existing symlinks in the target + directory. If there is a symlink to some other + directory, files may be extracted outside of the desired location; if + there is a symlink to a file, the target of the symlink will be + overwritten when overwrite is true. + + diff --git a/reference/phar/PharData/extractTo.xml b/reference/phar/PharData/extractTo.xml index 2b95f74b40d3..f71bdc5952bf 100644 --- a/reference/phar/PharData/extractTo.xml +++ b/reference/phar/PharData/extractTo.xml @@ -25,6 +25,16 @@ set to true to enable overwriting of files. This method is similar to ZipArchive::extractTo. + + + + Extraction follows any existing symlinks in the target + directory. If there is a symlink to some other + directory, files may be extracted outside of the desired location; if + there is a symlink to a file, the target of the symlink will be + overwritten when overwrite is true. + +