Disable the PHAR stream wrapper

Author: glye

app/console

@@ -7,6 +7,11 @@
 
 set_time_limit(0);
 
+// Disable the PHAR stream wrapper as it is insecure
+if (in_array('phar', stream_get_wrappers())) {
+    stream_wrapper_unregister('phar');
+}
+
 // Ensure UTF-8 is used in string operations
 setlocale(LC_CTYPE, 'C.UTF-8');
 

web/app.php

@@ -3,6 +3,11 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\Debug\Debug;
 
+// Disable the PHAR stream wrapper as it is insecure
+if (in_array('phar', stream_get_wrappers())) {
+    stream_wrapper_unregister('phar');
+}
+
 // Ensure UTF-8 is used in string operations
 setlocale(LC_CTYPE, 'C.UTF-8');