Have weak_vendors ignore deprecations from outside

phar:// and eval() can execute code that may or may not come from the vendors.
symfony · nicolas-grekas · Jan 21, 2018 · Nov 7, 2017 · Jan 21, 2018 · 9ce0ae23aee0cc32bbedb0436a47f267900017c0
commit 9ce0ae23aee0cc32bbedb0436a47f267900017c0
diff --git a/src/Symfony/Bridge/PhpUnit/DeprecationErrorHandler.php b/src/Symfony/Bridge/PhpUnit/DeprecationErrorHandler.php
@@ -75,9 +75,12 @@ public static function register($mode = 0)
                     }
                 }
             }
-            $path = realpath($path) ?: $path;
+            $realPath = realpath($path);
+            if (false === $realPath && '-' !== $path && 'Standard input code' !== $path) {
+                return true;
+            }
             foreach ($vendors as $vendor) {
-                if (0 === strpos($path, $vendor) && false !== strpbrk(substr($path, strlen($vendor), 1), '/'.DIRECTORY_SEPARATOR)) {
+                if (0 === strpos($realPath, $vendor) && false !== strpbrk(substr($realPath, strlen($vendor), 1), '/'.DIRECTORY_SEPARATOR)) {
                     return true;
                 }
             }

diff --git a/src/Symfony/Bridge/PhpUnit/Tests/DeprecationErrorHandler/deprecation.phar b/src/Symfony/Bridge/PhpUnit/Tests/DeprecationErrorHandler/deprecation.phar
diff --git a/src/Symfony/Bridge/PhpUnit/Tests/DeprecationErrorHandler/deprecation/deprecation.php b/src/Symfony/Bridge/PhpUnit/Tests/DeprecationErrorHandler/deprecation/deprecation.php
@@ -0,0 +1,3 @@
+<?php
+
+@trigger_error('I come from… afar! :D', E_USER_DEPRECATED);
diff --git a/src/Symfony/Bridge/PhpUnit/Tests/DeprecationErrorHandler/generate_phar.php b/src/Symfony/Bridge/PhpUnit/Tests/DeprecationErrorHandler/generate_phar.php
@@ -0,0 +1,4 @@
+<?php
+
+$phar = new Phar(__DIR__.DIRECTORY_SEPARATOR.'deprecation.phar', 0, 'deprecation.phar');
+$phar->buildFromDirectory(__DIR__.DIRECTORY_SEPARATOR.'deprecation');
diff --git a/...fony/Bridge/PhpUnit/Tests/DeprecationErrorHandler/weak_vendors_on_eval_d_deprecation.phpt b/...fony/Bridge/PhpUnit/Tests/DeprecationErrorHandler/weak_vendors_on_eval_d_deprecation.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Test DeprecationErrorHandler in weak vendors mode on eval()'d deprecation
+--FILE--
+<?php
+
+putenv('SYMFONY_DEPRECATIONS_HELPER=weak_vendors');
+putenv('ANSICON');
+putenv('ConEmuANSI');
+putenv('TERM');
+
+$vendor = __DIR__;
+while (!file_exists($vendor.'/vendor')) {
+    $vendor = dirname($vendor);
+}
+define('PHPUNIT_COMPOSER_INSTALL', $vendor.'/vendor/autoload.php');
+require PHPUNIT_COMPOSER_INSTALL;
+require_once __DIR__.'/../../bootstrap.php';
+eval("@trigger_error('who knows where I come from?', E_USER_DEPRECATED);")
+
+?>
+--EXPECTF--
+
+Other deprecation notices (1)
diff --git a/...ymfony/Bridge/PhpUnit/Tests/DeprecationErrorHandler/weak_vendors_on_phar_deprecation.phpt b/...ymfony/Bridge/PhpUnit/Tests/DeprecationErrorHandler/weak_vendors_on_phar_deprecation.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Test DeprecationErrorHandler in weak vendors mode on eval()'d deprecation
+The phar can be regenerated by running php src/Symfony/Bridge/PhpUnit/Tests/DeprecationErrorHandler/generate_phar.php
+--FILE--
+<?php
+
+putenv('SYMFONY_DEPRECATIONS_HELPER=weak_vendors');
+putenv('ANSICON');
+putenv('ConEmuANSI');
+putenv('TERM');
+
+$vendor = __DIR__;
+while (!file_exists($vendor.'/vendor')) {
+    $vendor = dirname($vendor);
+}
+define('PHPUNIT_COMPOSER_INSTALL', $vendor.'/vendor/autoload.php');
+require PHPUNIT_COMPOSER_INSTALL;
+require_once __DIR__.'/../../bootstrap.php';
+\Phar::loadPhar(__DIR__.'/deprecation.phar', 'deprecation.phar');
+include 'phar://deprecation.phar/deprecation.php';
+
+?>
+--EXPECTF--
+
+Other deprecation notices (1)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		<?php

		@trigger_error('I come from… afar! :D', E_USER_DEPRECATED);