[wp-trac] [WordPress Trac] #65320: WordPress 7 core update silently truncates filenames longer than 100 characters during extraction (wp-includes/php-ai-client/ affected)

[WordPress Trac]

#65320: WordPress 7 core update silently truncates filenames longer than 100
characters during extraction (wp-includes/php-ai-client/ affected)
--------------------------+------------------------------
 Reporter:  arakelxvi     |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  General       |     Version:  7.0
 Severity:  major         |  Resolution:
 Keywords:                |     Focuses:
--------------------------+------------------------------

Comment (by arakelxvi):

 After further investigation, the issue is specific to wp core download —
 wp core update is '''not affected''' as it downloads a .zip archive and
 uses ZipArchive, which handles
   long paths correctly.

   wp core download downloads a .tar.gz and extracts it via PHP's PharData,
 which silently truncates any archive-internal path exceeding 100
 characters (the tar format's name field
   size). Confirmed:

   {{{#!sh
   PharData — truncated at 100 chars

   php -r "
   $phar = new PharData('/tmp/wp7.tar.gz');
   foreach (new RecursiveIteratorIterator($phar) as $f) {
       if (strpos($f->getPathName(), 'PuliUnavailable') !== false)
           echo $f->getPathName() . PHP_EOL;
   }
   "
   Result: phar:///tmp/wp7.tar.gz/wordpress/.../PuliUnavailableException.ph
 (truncated)

   system tar — correct

   tar -tvf /tmp/wp7.tar.gz | grep PuliUnavailable
   Result: wordpress/.../PuliUnavailableException.php  (correct)

   ZipArchive (.zip, same as wp core update uses) — correct

   php -r "
   $z = new ZipArchive();
   $z->open('/tmp/wp7.zip');
   for ($i = 0; $i < $z->numFiles; $i++) {
       $name = $z->getNameIndex($i);
       if (strpos($name, 'PuliUnavailable') !== false) echo $name .
 PHP_EOL;
   }
   $z->close();
   "
   Result: wordpress/.../PuliUnavailableException.php  (correct)

   }}}

   The fix should be in wp core download — either switch to downloading
 .zip (same as wp core update) or replace PharData extraction with system
 tar.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/65320#comment:1>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform