CVE-2016-6639 (Python, published 2016-09-18T02:59Z)
Description: value: Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products, place the .profile file in the htdocs directory, which might allow remote attackers to obtain sensitive information via an HTTP GET request for this file.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-254 \u2014 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Repository: https://github.com/cloudfoundry/php-buildpack
Files changed:
cf_spec/fixtures/php_app_with_profile_script/.profile
cf_spec/fixtures/php_app_with_profile_script/index.php
cf_spec/integration/profile_d_sets_environment_variables_spec.rb
lib/compile_helpers.py
tests/data/app-with-all-possible-system-files-that-should-not-move/README.txt
tests/test_compile_helpers.py
Commit message: Execute .profile script at runtime

- Add integration showing that .profile script runs.
- Add unit test for all top-level system files which are not meant to
  be moved into the htdocs directory.
- Move a stray assertion about not moving manifest.yml to the new test.
- Add .profile to the list of files/dirs which should not be moved from
  the toplevel into htdocs/

[#127923697]

Signed-off-by: Sam Smith <sesmith177@gmail.com>
Signed-off-by: Jacques Chester <jchester@pivotal.io>


Vulnerable code:
        self.assert_exists(self.build_dir, 'manifest.yml')

Fixed code:
export PROFILE_SCRIPT_IS_PRESENT_AND_RAN="Hooray for environment variables!"
<?php echo phpinfo() ?>

  context 'deploying a PHP app with .profile script' do
    let(:app_name) { 'php_app_with_profile_script' }

    it "sets environment variables via .profile script" do
      cf_api_output = Machete::CF::API.new.execute

      cf_api_version = cf_api_output.match( /API version: (?<version_number>\d+\.\d+\.\d+)/ )['version_number']
      minimum_acceptable_cf_api_version = Gem::Version.new('2.57.0')
      skip(".profile script functionality not supported before CF API version #{minimum_acceptable_cf_api_version}") if Gem::Version.new(cf_api_version) < minimum_acceptable_cf_api_version
      browser.visit_path('/')
      expect(browser).to have_body('PROFILE_SCRIPT_IS_PRESENT_AND_RAN')
    end
  end
            fu.where_name_does_not_match(
                '^%s$' % os.path.join(ctx['BUILD_DIR'], '.profile'))
This directory is not a "real" app. It is a fixture intended to support test_system_files_not_moved_into_webdir. That's why all the files and folders are empty.
    def test_system_files_not_moved_into_webdir(self):
        shutil.copytree('tests/data/app-with-all-possible-system-files-that-should-not-move', self.build_dir)
        setup_webdir_if_it_doesnt_exist(utils.FormattedDict({
            'BUILD_DIR': self.build_dir,
            'WEBDIR': 'htdocs',
            'LIBDIR': 'lib'
        }))
        self.assert_exists(self.build_dir, '.bp')
        self.assert_exists(self.build_dir, '.extensions')
        self.assert_exists(self.build_dir, '.bp-config')
        self.assert_exists(self.build_dir, 'manifest.yml')
        self.assert_exists(self.build_dir, '.profile.d')
        self.assert_exists(self.build_dir, '.profile')