🚨 [security] [php] Update league/flysystem 3.29.1 → 3.36.0 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ league/flysystem (indirect, 3.29.1 → 3.36.0) · Repo · Changelog

Security Advisories 🚨

🚨 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Related public issue (context, not a duplicate)

Closed issue #1429 ("Handle non-UTF-8 paths", 2024-03-24) raised exactly this general concern and
even suggested detection via preg_match('//u', $path) !== 1 -- note the reporter's suggested check
explicitly compares !== 1, which would correctly treat PCRE's false return as "reject." The
maintainer's reply pointed to the PathNormalizer interface as the place to implement this. The
control-character check that ended up shipping in WhitespacePathNormalizer
(if (preg_match('#\p{C}+#u', $unixPath))) addresses the general concern but does not use the
!== 1-style comparison the original issue suggested -- it uses a bare truthy check, which is exactly
the gap this report demonstrates. So this is not a duplicate of #1429; it's a concrete bypass
surviving in the fix that issue's concern led to.

Vulnerability Details

File: src/WhitespacePathNormalizer.php, lines 22-28 (normalizePath()) -- the default
PathNormalizer used by Filesystem for every adapter (Local, FTP, SFTP, S3, AsyncAwsS3, Azure, GCS,
ZipArchive, GridFS, InMemory) unless the application supplies a custom one.

Root Cause

public function normalizePath(string $path): string
{
    $unixPath = str_replace('\\', '/', $path);
<span class="pl-k">if</span> (<span class="pl-en">preg_match</span>(<span class="pl-s">'<span class="pl-s">#\p{C}+#u</span>'</span>, <span class="pl-s1"><span class="pl-c1">$</span>unixPath</span>)) {
    <span class="pl-k">throw</span> CorruptedPathDetected::<span class="pl-en">forPath</span>(<span class="pl-s1"><span class="pl-c1">$</span>path</span>);
}
<span class="pl-c1">.</span>.<span class="pl-c1">.</span></pre></div>

preg_match() returns false (a PHP engine error) rather than 0 when the subject string is not

valid UTF-8 and the pattern uses the /u modifier -- PCRE can't even attempt the match. false and

0 are both falsy in PHP, and if (preg_match(...)) does not distinguish them. So a path containing

any single invalid UTF-8 byte anywhere in the string makes preg_match() fail with a "Malformed

UTF-8 characters" engine error, the if evaluates false, and CorruptedPathDetected is silently not

thrown -- even when the same string also contains literal control characters this exact check exists

to catch.
the identical payload IS correctly rejected once it's valid UTF-8:
$n->normalizePath("foo\x1bbar");         // valid UTF-8, contains ESC -> throws CorruptedPathDetected (correct)
$n->normalizePath("foo\x80\x1bbar");    // 0x80 = invalid lone UTF-8 continuation byte -> NOT thrown (bypass)
The path-traversal protection is unaffected -- it's exact byte-string comparison on

/-delimited segments, independent of UTF-8 validity:
$n->normalizePath("\x80/../../etc/passwd");   // still throws PathTraversalDetected
Recommended Fix
public function normalizePath(string $path): string
{
    $unixPath = str_replace('\\', '/', $path);
    $matched = preg_match('#\p{C}+#u', $unixPath);
<span class="pl-k">if</span> (<span class="pl-s1"><span class="pl-c1">$</span>matched</span> !== <span class="pl-c1">0</span>) {
    <span class="pl-c">// $matched === false means malformed UTF-8 -- must also be treated as corrupted,</span>
    <span class="pl-c">// not silently allowed through.</span>
    <span class="pl-k">throw</span> CorruptedPathDetected::<span class="pl-en">forPath</span>(<span class="pl-s1"><span class="pl-c1">$</span>path</span>);
}
<span class="pl-c1">.</span>.<span class="pl-c1">.</span></pre></div>

Verification
Dynamically confirmed on league/flysystem HEAD 6837e1d / tag 3.35.2, PHP 8.4.22 CLI, end-to-end

through LocalFilesystemAdapter:
[1] write() succeeded -- normalizer did NOT reject the path.
[2] Actual bytes on disk: ...801b5b386d6e6f726d616c2d6c6f6f6b696e672d66696c652e7478741b5b306d...
[3] Filesystem::listContents() path contains raw ESC (0x1b): YES
[4] Raw terminal output (via `cat -v`): M-^@^[[8mnormal-looking-file.txt^[[0m^[[2K^[[1Aurgent-invoice.pdf

Release Notes

3.36.0 (from changelog)

• [SFTP V3] Support multiple fingerprints for zero-downtime fingerprint changes.
• [FTP] Unset connection when resolving the root failed.

3.35.3 (from changelog)

• [Filesystem] Report broken utf-8 as corrupted path

3.35.2 (from changelog)

• [AwsS3V3] Let ACL config take precedence over visibility during copy (#1905)

3.35.1 (from changelog)

• [AwsS3V3] Remove lock file from artefact.

3.35.0 (from changelog)

• [Filesystem] Guard against null mime-type return at Filesystem level (#1901)

3.33.0 (from changelog)

Changes

• [SFTP V3] Add support for multiple fingerprints (#1893)

3.32.0 (from changelog)

Changes

• [AwsS3V3] Allow SSE-C options when fetching file metadata

3.31.0 (from changelog)

Changes

• [AsyncAwsS3] Allow V3

3.30.2 (from changelog)

Fixes

• [Local] Clear last error for rename and copy operations (#1883)

3.30.1 (from changelog)

Fixes

• Ensure listing directories called "0" do not produce unfiltered listings.

3.30.0 (from changelog)

Changes

• [MongoDB] Allow v2
• [AsyncAWS] Encode/decode object identifiers
• [GoogleCloudStorage] Add option to stream responses
• [Local] Clear stat cache consistently
• [SFTP] Add option to disconnect connections on destruction
• [WebDAV] Deal with 405 case when trying to create a directory that already exists.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 1549adc0-1416-4487-a591-d51757d16cbd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}