PHAR Archives & Packaging

Also Known As

TL;DR

Explanation

A PHAR (PHP Archive) bundles PHP code, assets, and metadata into a single file. The stub bootstraps execution. PHARs are used by Composer (composer.phar), PHPUnit, and many CLI tools — run with php tool.phar, required, or accessed via the phar:// stream wrapper. Creating PHARs requires phar.readonly=0 in php.ini. Critical security note: PHAR metadata is deserialized on any file operation using a phar:// URI — enabling PHAR injection attacks without a direct unserialize() call. Never allow user-controlled input to reach file functions that might accept phar:// paths.

Common Misconception

Why It Matters

Common Mistakes

• Not disabling phar.readonly in php.ini when creating PHARs — required for writing but creates security risk if left on.
• Using user-controlled paths in file functions without blocking phar:// wrapper — triggers PHAR deserialization.
• Including dev dependencies in a distributed PHAR — increases file size and attack surface.
• Not signing PHARs for distributed tools — an unsigned PHAR can be replaced with a malicious one.

Code Examples

// User path in file function — PHAR injection:
$path = $_GET['file'];
if (file_exists($path)) { // ?file=phar://uploads/evil.jpg
    include $path;          // Deserializes and executes PHAR metadata
}

// Create a distributable CLI tool as a PHAR archive
\$phar = new Phar('mytool.phar');
\$phar->startBuffering();
\$phar->buildFromDirectory(__DIR__ . '/src', '/\.php\$/');
\$phar->setDefaultStub('bin/mytool.php', 'bin/mytool.php');
\$phar->stopBuffering();
chmod('mytool.phar', 0755);

// Run: php mytool.phar --help

// Security:
; php.ini: phar.readonly = On  — prevents modification of PHAR files
// Never pass attacker-controlled paths to phar:// stream wrapper
// Validate PHAR signatures before extracting untrusted archives

References

• ↗ https://www.php.net/manual/en/book.phar.php

Tags

Related Terms