keep track of separate prepared_env set for a php_server

correctly exposes env vars into $_ENV when E is in `variables_order`
also fixes the problem of lazy server eval I didn't think about last commit

Author: henderkes

cgi.go

@@ -178,12 +178,17 @@ func addHeadersToServer(ctx context.Context, request *http.Request, trackVarsArr
 func addPreparedEnvToServer(fc *frankenPHPContext, trackVarsArray *C.zval) {
 	for k, v := range fc.env {
 		C.frankenphp_register_variable_safe(toUnsafeChar(k), toUnsafeChar(v), C.size_t(len(v)), trackVarsArray)
-		// Also expose to getenv()
-		C.frankenphp_add_to_sandboxed_env(toUnsafeChar(k), C.size_t(len(k)-1), toUnsafeChar(v), C.size_t(len(v)))
 	}
 	fc.env = nil
 }
 
+// addPreparedEnvToSandbox exposes fc.env to getenv() before any PHP code runs.
+func addPreparedEnvToSandbox(fc *frankenPHPContext) {
+	for k, v := range fc.env {
+		C.frankenphp_add_to_sandboxed_env(toUnsafeChar(k), C.size_t(len(k)-1), toUnsafeChar(v), C.size_t(len(v)))
+	}
+}
+
 //export go_register_server_variables
 func go_register_server_variables(threadIndex C.uintptr_t, trackVarsArray *C.zval) {
 	thread := phpThreads[threadIndex]
@@ -302,6 +307,8 @@ func go_update_request_info(threadIndex C.uintptr_t, info *C.sapi_request_info)
 		return nil
 	}
 
+	addPreparedEnvToSandbox(fc)
+
 	if m, ok := cStringHTTPMethods[request.Method]; ok {
 		info.request_method = m
 	} else {

frankenphp.c

@@ -92,6 +92,10 @@ HashTable *main_thread_env = NULL;
 __thread uintptr_t thread_index;
 __thread bool is_worker_thread = false;
 __thread HashTable *sandboxed_env = NULL;
+/* prepared_env holds entries from php(_server)'s `env KEY VAL`,
+ * so they can be merged into $_ENV when 'E' is in
+ * variables_order. Separate from putenv() so we don't leak into $_ENV*/
+__thread HashTable *prepared_env = NULL;
 
 /* Published via SG(server_context) so ext-parallel children, which inherit
  * the parent's SG(server_context), can route SAPI callbacks back to the
@@ -429,9 +433,16 @@ bool frankenphp_shutdown_dummy_request(void) {
 }
 
 void get_full_env(zval *track_vars_array) {
-  zend_hash_extend(Z_ARR_P(track_vars_array),
-                   zend_hash_num_elements(main_thread_env), 0);
+  size_t total = zend_hash_num_elements(main_thread_env);
+  if (prepared_env != NULL) {
+    // perf: doesn't matter if we get the exact count, just >= needed
+    total += zend_hash_num_elements(prepared_env);
+  }
+  zend_hash_extend(Z_ARR_P(track_vars_array), total, 0);
   zend_hash_copy(Z_ARR_P(track_vars_array), main_thread_env, NULL);
+  if (prepared_env != NULL) {
+    zend_hash_copy(Z_ARR_P(track_vars_array), prepared_env, NULL);
+  }
 }
 
 /* Adapted from php_request_startup() */
@@ -1239,10 +1250,14 @@ static inline void reset_sandboxed_environment() {
     zend_hash_release(sandboxed_env);
     sandboxed_env = NULL;
   }
+  if (prepared_env != NULL) {
+    zend_hash_release(prepared_env);
+    prepared_env = NULL;
+  }
 }
 
 /* Adds a key/value pair to the per-thread sandboxed environment so it becomes
- * visible to getenv(). Used to expose env vars declared in the php(_server)
+ * visible to getenv()/$_ENV. Used to expose env vars declared in the php(_server)
  * directive, which would otherwise only appear in $_SERVER. */
 void frankenphp_add_to_sandboxed_env(char *name, size_t name_len, char *val,
                                      size_t val_len) {
@@ -1252,6 +1267,14 @@ void frankenphp_add_to_sandboxed_env(char *name, size_t name_len, char *val,
   zval zv = {0};
   ZVAL_STRINGL(&zv, val, val_len);
   zend_hash_str_update(sandboxed_env, name, name_len, &zv);
+
+  if (prepared_env == NULL) {
+    ALLOC_HASHTABLE(prepared_env);
+    zend_hash_init(prepared_env, 8, NULL, ZVAL_PTR_DTOR, 0);
+  }
+  zval zv2 = {0};
+  ZVAL_STRINGL(&zv2, val, val_len);
+  zend_hash_str_update(prepared_env, name, name_len, &zv2);
 }
 
 static void *php_thread(void *arg) {