rackspace/php-cloudfiles — Issue #59: bogus is_file() calls in computing md5 etag for write() calls with data strings
Author: AaronSchulz
Created: 2012-01-24 22:44:29+00:00
State: open

When a CF_Object is written and the etag is not given, compute_md5sum() will try is_file() if the $data variable is a string. This can cause is_file() checks on large blobs of text, which seems pretty unacceptable. It also means that if file contents are user generated (e.g. originating from a web form or the like), then users can maliciously give file contents that equal a local file system path, which is a security problem.