Stdlib: php_strip_whitespace/highlight_file/show_source ignore allow_url_include for data:// (ext/standard/basic_functions.c)

[PurHur]

Category

Stdlib · php-src-strict · allow_url_include / data:// script streams

Problem

php-src opens php_strip_whitespace(), highlight_file(), and show_source() through the script/include stream path. With default allow_url_include=0, the data:// wrapper is disabled for those functions: Zend emits data:// wrapper is disabled in the server configuration by allow_url_include=0, fails to open the stream, and returns empty / prints nothing.

This compiler reads data:// anyway (VmFs::fileGetContents / highlight engine) with no warning and returns stripped/highlighted source. file() / file_get_contents('data://…') correctly still work (allow_url_fopen=1) — do not “fix” those.

show_source is the Zend alias of highlight_file.

Probed 2026-08-18 @ 03a5c7b939 — Zend 8.2.32 vs php bin/vm.php. ini_get('allow_url_include') is empty/0 on both.

Repro	Zend 8.2.32	VM (2026-08-18)
php_strip_whitespace('data://text/plain,<?php echo 1; //c')	'' + wrapper-disabled Warning	'<?php echo 1; ' (no warning)
highlight_file('data://text/plain,<?php echo 1;')	empty + 3 Warnings	HTML highlight (no warning)
show_source(same)	empty + 3 Warnings	HTML highlight (no warning)

php-src reference

• php/php-src ext/standard/basic_functions.c — PHP_FUNCTION(php_strip_whitespace), PHP_FUNCTION(highlight_file) (show_source alias)
• php/php-src Zend/zend_highlight.c — zend_strip / highlight
• php/php-src main/streams/streams.c / fopen wrappers — data:// for include-like opens requires allow_url_include

PHP implementation target

• ext/standard/php_strip_whitespace.php — do not fileGetContents data:// (and other include-only wrappers) when allow_url_include is off; emit Zend’s wrapper-disabled + failed-to-open Warnings; return ''
• ext/standard/highlight_file.php / ext/standard/show_source.php / ext/standard/HighlightEngine.php — same stream policy
• Reuse the include-wrapper check include() already uses (or should use) rather than a one-off string prefix test
• No new runtime/*.c

Repro

./script/docker-exec.sh -- bash -lc 'php test/repro/maintainer_gap_strip_whitespace_data.php'
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_strip_whitespace_data.php'
./script/docker-exec.sh -- bash -lc 'php test/repro/maintainer_gap_highlight_file_data.php'
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_highlight_file_data.php'

Done when

• With allow_url_include=0, all three functions refuse data://, warn like Zend, and do not return highlighted/stripped source (VM + JIT)
• file_get_contents('data://…') / file('data://…') still succeed (allow_url_fopen)
• Compliance .phpt under test/compliance/cases/stdlib/
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

claim: PHP Compiler STD Lib — starting this run

[PurHur]

claim: PHP Compiler STD Lib — starting this run (prior claim had no PR/code; picking up #32104)

[PurHur]

Merged via #32126

Verification

• VM + JIT repros: php_strip_whitespace/highlight_file/show_source return empty/false with Zend-shaped wrapper-disabled warnings; file_get_contents('data://…') still works on VM/JIT
• AOT: same blocking behavior for the three script builtins after rebase onto Fix cold-build hello-world AOT verification on fresh helper cache (#32122) #32125
• Unit: StreamIncludeOpenPolicyTest (3 tests)

Not covered: PHPUnit harness run for new compliance .phpt; AOT standalone file_get_contents(data://) still returns false (pre-existing, outside this diff).