一位开发者于2014年为AOL内容管理系统编写的PHP函数http_build_url()已成为广泛使用的开源包，在Packagist包管理器上获得近2000万次安装，每月仍有40万次新安装1。这个174行的临时补丁代码通过WPML插件等第三方包深度集成，覆盖超过150万个网站1。
该函数存在一个多年未被发现的bug：在处理URL末尾斜杠时会误删路径中所有字母'a'1。作者近日宣布决定弃用该包，并推荐用户改用PHP League的URI库和PHP 8.5内置的标准API作为替代方案1。作者选择彻底弃用而非寻找新维护者，以规避潜在的供应链安全风险1。这个临时补丁的生命周期跨度达12年，直至AOL CMS平台于2020年关闭时仍在使用1。
A PHP function created as a temporary fix in 2014 has become unexpectedly prevalent across the web, with the developer now announcing its deprecation. The http_build_url() package, originally written for an AOL content management system, has accumulated nearly 20 million installations on Packagist and receives approximately 400,000 new installations monthly.1 The 174-line code snippet spread far beyond its original scope, embedded in third-party packages such as WPML and idna-convert, ultimately reaching over 1.5 million websites through the WordPress plugin ecosystem.1
The developer's decision to deprecate the package stems from several concerns. A bug lurking undetected for years causes the function to remove all instances of the letter 'a' from URL paths when processing trailing slashes.1 Rather than seek new maintainers to fix such issues, the author chose deprecation to mitigate supply chain security risks.1 The original AOL platform continued relying on this temporary solution until its closure in 2020.1 Going forward, developers are encouraged to migrate to PHP League's URI library or adopt PHP 8.5's newly built-in standards-compliant URI API as replacements.1
评论
还没有评论，欢迎留下第一条。