SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

@@ -95,7 +95,7 @@ public function __construct(array $options = [])
 
         if (isset($options['env'])) {
             $_SERVER[$envKey] = $options['env'];
-        } elseif (empty($_GET) && isset($_SERVER['argv']) && class_exists(ArgvInput::class)) {
+        } elseif (!isset($_SERVER['QUERY_STRING']) && isset($_SERVER['argv']) && class_exists(ArgvInput::class)) {
             $this->options = $options;
             $this->getInput();
         }
@@ -216,7 +216,7 @@ protected static function register(GenericRuntime $runtime): GenericRuntime
 
     private function getInput(): ArgvInput
     {
-        if (!empty($_GET) && filter_var(ini_get('register_argc_argv'), \FILTER_VALIDATE_BOOL)) {
+        if (isset($_SERVER['QUERY_STRING']) && filter_var(ini_get('register_argc_argv'), \FILTER_VALIDATE_BOOL)) {
             throw new \Exception('CLI applications cannot be run safely on non-CLI SAPIs with register_argc_argv=On.');
         }
 

@@ -0,0 +1,21 @@
+--TEST--
+Test that argv is ignored on web requests even when $_GET parses empty (QUERY_STRING gap)
+--INI--
+display_errors=1
+register_argc_argv=1
+--FILE--
+<?php
+
+// A real web request with QUERY_STRING="=+--env=prod+--no-debug":
+// parse_str() drops the leading "=" token so $_GET is empty,
+// but the web SAPI builds argv from the raw query and feeds attacker flags in.
+$_GET = [];
+$_SERVER['QUERY_STRING'] = '=+--env=prod+--no-debug';
+$_SERVER['argc'] = 3;
+$_SERVER['argv'] = ['=', '--env=prod', '--no-debug'];
+
+require $_SERVER['SCRIPT_FILENAME'] = __DIR__.'/kernel.php';
+
+?>
+--EXPECTF--
+OK Kernel (env=dev) foo_bar

@@ -8,6 +8,7 @@ register_argc_argv=1
 
 // emulating PHP behavior with register_argc_argv=1
 $_GET['-e_test'] = '';
+$_SERVER['QUERY_STRING'] = '-e_test=';
 $_SERVER['argc'] = 1;
 $_SERVER['argv'] = [' ', '-e', 'test'];