413 lines
13 KiB
PHP
413 lines
13 KiB
PHP
|
<?php
|
||
|
|
|
||
|
|
namespace WebPExpress;
|
||
|
|
|
||
|
|
use \WebPExpress\PathHelper;
|
||
|
|
use \WebPExpress\Sanitize;
|
||
|
|
use \WebPExpress\SanityException;
|
||
|
|
|
||
|
|
class SanityCheck
|
||
|
|
{
|
||
|
|
|
||
|
|
private static function fail($errorMsg, $input)
|
||
|
|
{
|
||
|
|
// sanitize input before calling error_log(), it might be sent to file, mail, syslog etc.
|
||
|
|
//error_log($errorMsg . '. input:' . Sanitize::removeNUL($input) . 'backtrace: ' . print_r(debug_backtrace(), true));
|
||
|
|
error_log($errorMsg . '. input:' . Sanitize::removeNUL($input));
|
||
|
|
|
||
|
|
//error_log(get_magic_quotes_gpc() ? 'on' :'off');
|
||
|
|
throw new SanityException($errorMsg); // . '. Check debug.log for details (and make sure debugging is enabled)'
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
/**
|
||
|
|
*
|
||
|
|
* @param string $input string to test for NUL char
|
||
|
|
*/
|
||
|
|
public static function mustBeString($input, $errorMsg = 'String expected')
|
||
|
|
{
|
||
|
|
if (gettype($input) !== 'string') {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* The NUL character is a demon, because it can be used to bypass other tests
|
||
|
|
* See https://st-g.de/2011/04/doing-filename-checks-securely-in-PHP.
|
||
|
|
*
|
||
|
|
* @param string $input string to test for NUL char
|
||
|
|
*/
|
||
|
|
public static function noNUL($input, $errorMsg = 'NUL character is not allowed')
|
||
|
|
{
|
||
|
|
self::mustBeString($input);
|
||
|
|
if (strpos($input, chr(0)) !== false) {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Prevent control chararters (#00 - #20).
|
||
|
|
*
|
||
|
|
* This prevents line feed, new line, tab, charater return, tab, ets.
|
||
|
|
* https://www.rapidtables.com/code/text/ascii-table.html
|
||
|
|
*
|
||
|
|
* @param string $input string to test for control characters
|
||
|
|
*/
|
||
|
|
public static function noControlChars($input, $errorMsg = 'Control characters are not allowed')
|
||
|
|
{
|
||
|
|
self::mustBeString($input);
|
||
|
|
self::noNUL($input);
|
||
|
|
if (preg_match('#[\x{0}-\x{1f}]#', $input)) {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
/**
|
||
|
|
*
|
||
|
|
* @param mixed $input something that may not be empty
|
||
|
|
*/
|
||
|
|
public static function notEmpty($input, $errorMsg = 'Must be non-empty')
|
||
|
|
{
|
||
|
|
if (empty($input)) {
|
||
|
|
self::fail($errorMsg, '');
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
public static function noDirectoryTraversal($input, $errorMsg = 'Directory traversal is not allowed')
|
||
|
|
{
|
||
|
|
self::mustBeString($input);
|
||
|
|
self::noControlChars($input);
|
||
|
|
if (preg_match('#\.\.\/#', $input)) {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function noStreamWrappers($input, $errorMsg = 'Stream wrappers are not allowed')
|
||
|
|
{
|
||
|
|
self::mustBeString($input);
|
||
|
|
self::noControlChars($input);
|
||
|
|
|
||
|
|
// Prevent stream wrappers ("phar://", "php://" and the like)
|
||
|
|
// https://www.php.net/manual/en/wrappers.phar.php
|
||
|
|
if (preg_match('#^\\w+://#', Sanitize::removeNUL($input))) {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function pathDirectoryTraversalAllowed($input)
|
||
|
|
{
|
||
|
|
self::notEmpty($input);
|
||
|
|
self::mustBeString($input);
|
||
|
|
self::noControlChars($input);
|
||
|
|
self::noStreamWrappers($input);
|
||
|
|
|
||
|
|
// PS: The following sanitize has no effect, as we have just tested that there are no NUL and
|
||
|
|
// no stream wrappers. It is here to avoid false positives on coderisk.com
|
||
|
|
$input = Sanitize::path($input);
|
||
|
|
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function pathWithoutDirectoryTraversal($input)
|
||
|
|
{
|
||
|
|
self::pathDirectoryTraversalAllowed($input);
|
||
|
|
self::noDirectoryTraversal($input);
|
||
|
|
$input = Sanitize::path($input);
|
||
|
|
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function path($input)
|
||
|
|
{
|
||
|
|
return self::pathWithoutDirectoryTraversal($input);
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Beware: This does not take symlinks into account.
|
||
|
|
* I should make one that does. Until then, you should probably not call this method from outside this class
|
||
|
|
*/
|
||
|
|
private static function pathBeginsWith($input, $beginsWith, $errorMsg = 'Path is outside allowed path')
|
||
|
|
{
|
||
|
|
self::path($input);
|
||
|
|
if (!(strpos($input, $beginsWith) === 0)) {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
private static function pathBeginsWithSymLinksExpanded($input, $beginsWith, $errorMsg = 'Path is outside allowed path') {
|
||
|
|
$closestExistingFolder = PathHelper::findClosestExistingFolderSymLinksExpanded($input);
|
||
|
|
self::pathBeginsWith($closestExistingFolder, $beginsWith, $errorMsg);
|
||
|
|
}
|
||
|
|
|
||
|
|
private static function absPathMicrosoftStyle($input, $errorMsg = 'Not an fully qualified Windows path')
|
||
|
|
{
|
||
|
|
// On microsoft we allow [drive letter]:\
|
||
|
|
if (!preg_match("#^[A-Z]:\\\\|/#", $input)) {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
private static function isOnMicrosoft()
|
||
|
|
{
|
||
|
|
if (isset($_SERVER['SERVER_SOFTWARE'])) {
|
||
|
|
if (strpos(strtolower($_SERVER['SERVER_SOFTWARE']), 'microsoft') !== false) {
|
||
|
|
return true;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
switch (PHP_OS) {
|
||
|
|
case "WINNT":
|
||
|
|
case "WIN32":
|
||
|
|
case "INTERIX":
|
||
|
|
case "UWIN":
|
||
|
|
case "UWIN-W7":
|
||
|
|
return true;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function absPath($input, $errorMsg = 'Not an absolute path')
|
||
|
|
{
|
||
|
|
// first make sure there are no nasty things like control chars, phar wrappers, etc.
|
||
|
|
// - and no directory traversal either.
|
||
|
|
self::path($input);
|
||
|
|
|
||
|
|
// For non-windows, we require that an absolute path begins with "/"
|
||
|
|
// On windows, we also accept that a path starts with a drive letter, ie "C:\"
|
||
|
|
if ((strpos($input, '/') !== 0)) {
|
||
|
|
if (self::isOnMicrosoft()) {
|
||
|
|
self::absPathMicrosoftStyle($input);
|
||
|
|
} else {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
public static function absPathInOneOfTheseRoots()
|
||
|
|
{
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Look if filepath is within a dir path.
|
||
|
|
* Also tries expanding symlinks
|
||
|
|
*
|
||
|
|
* @param string $filePath Path to file. It may be non-existing.
|
||
|
|
* @param string $dirPath Path to dir. It must exist in order for symlinks to be expanded.
|
||
|
|
*/
|
||
|
|
private static function isFilePathWithinExistingDirPath($filePath, $dirPath)
|
||
|
|
{
|
||
|
|
// sanity-check input. It must be a valid absolute filepath. It is allowed to be non-existing
|
||
|
|
self::absPath($filePath);
|
||
|
|
|
||
|
|
// sanity-check dir and that it exists.
|
||
|
|
self::absPathExistsAndIsDir($dirPath);
|
||
|
|
|
||
|
|
return PathHelper::isFilePathWithinDirPath($filePath, $dirPath);
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Look if filepath is within multiple dir paths.
|
||
|
|
* Also tries expanding symlinks
|
||
|
|
*
|
||
|
|
* @param string $input Path to file. It may be non-existing.
|
||
|
|
* @param array $roots Allowed root dirs. Note that they must exist in order for symlinks to be expanded.
|
||
|
|
*/
|
||
|
|
public static function filePathWithinOneOfTheseRoots($input, $roots, $errorMsg = 'The path is outside allowed roots.')
|
||
|
|
{
|
||
|
|
self::absPath($input);
|
||
|
|
|
||
|
|
foreach ($roots as $root) {
|
||
|
|
if (self::isFilePathWithinExistingDirPath($input, $root)) {
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
public static function sourcePath($input, $errorMsg = 'The source path is outside allowed roots. It is only allowed to convert images that resides in: home dir, content path, upload dir and plugin dir.')
|
||
|
|
{
|
||
|
|
$validPaths = [
|
||
|
|
Paths::getHomeDirAbs(),
|
||
|
|
Paths::getIndexDirAbs(),
|
||
|
|
Paths::getContentDirAbs(),
|
||
|
|
Paths::getUploadDirAbs(),
|
||
|
|
Paths::getPluginDirAbs()
|
||
|
|
];
|
||
|
|
return self::filePathWithinOneOfTheseRoots($input, $validPaths, $errorMsg);
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function destinationPath($input, $errorMsg = 'The destination path is outside allowed roots. The webps may only be stored in the upload folder and in the folder that WebP Express stores converted images in')
|
||
|
|
{
|
||
|
|
self::absPath($input);
|
||
|
|
|
||
|
|
// Webp Express only store converted images in upload folder and in its "webp-images" folder
|
||
|
|
// Check that destination path is within one of these.
|
||
|
|
$validPaths = [
|
||
|
|
'/var/www/webp-express-tests/we1'
|
||
|
|
//Paths::getUploadDirAbs(),
|
||
|
|
//Paths::getWebPExpressContentDirRel() . '/webp-images'
|
||
|
|
];
|
||
|
|
return self::filePathWithinOneOfTheseRoots($input, $validPaths, $errorMsg);
|
||
|
|
}*/
|
||
|
|
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Test that path is an absolute path and it is in document root.
|
||
|
|
*
|
||
|
|
* If DOCUMENT_ROOT is not available, then only the absPath check will be done.
|
||
|
|
*
|
||
|
|
* TODO: Instead of this method, we shoud check
|
||
|
|
*
|
||
|
|
*
|
||
|
|
* It is acceptable if the absolute path does not exist
|
||
|
|
*/
|
||
|
|
public static function absPathIsInDocRoot($input, $errorMsg = 'Path is outside document root')
|
||
|
|
{
|
||
|
|
self::absPath($input);
|
||
|
|
|
||
|
|
if (!isset($_SERVER["DOCUMENT_ROOT"])) {
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
if ($_SERVER["DOCUMENT_ROOT"] == '') {
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
$docRoot = self::absPath($_SERVER["DOCUMENT_ROOT"]);
|
||
|
|
$docRoot = rtrim($docRoot, '/');
|
||
|
|
|
||
|
|
try {
|
||
|
|
$docRoot = self::absPathExistsAndIsDir($docRoot);
|
||
|
|
} catch (SanityException $e) {
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Use realpath to expand symbolic links and check if it exists
|
||
|
|
$docRootSymLinksExpanded = @realpath($docRoot);
|
||
|
|
if ($docRootSymLinksExpanded === false) {
|
||
|
|
// probably outside open basedir restriction.
|
||
|
|
//$errorMsg = 'Cannot resolve document root';
|
||
|
|
//self::fail($errorMsg, $input);
|
||
|
|
|
||
|
|
// Cannot resolve document root, so cannot test if in document root
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
// See if $filePath begins with the realpath of the $docRoot + '/'. If it does, we are done and OK!
|
||
|
|
// (pull #429)
|
||
|
|
if (strpos($input, $docRootSymLinksExpanded . '/') === 0) {
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
$docRootSymLinksExpanded = rtrim($docRootSymLinksExpanded, '\\/');
|
||
|
|
$docRootSymLinksExpanded = self::absPathExists($docRootSymLinksExpanded, 'Document root does not exist!');
|
||
|
|
$docRootSymLinksExpanded = self::absPathExistsAndIsDir($docRootSymLinksExpanded, 'Document root is not a directory!');
|
||
|
|
|
||
|
|
$directorySeparator = self::isOnMicrosoft() ? '\\' : '/';
|
||
|
|
$errorMsg = 'Path is outside resolved document root (' . $docRootSymLinksExpanded . ')';
|
||
|
|
self::pathBeginsWithSymLinksExpanded($input, $docRootSymLinksExpanded . $directorySeparator, $errorMsg);
|
||
|
|
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function absPathExists($input, $errorMsg = 'Path does not exist or it is outside restricted basedir')
|
||
|
|
{
|
||
|
|
self::absPath($input);
|
||
|
|
if (@!file_exists($input)) {
|
||
|
|
// TODO: We might be able to detect if the problem is that the path does not exist or if the problem
|
||
|
|
// is that it is outside restricted basedir.
|
||
|
|
// ie by creating an error handler or inspecting the php ini "open_basedir" setting
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function absPathExistsAndIsDir(
|
||
|
|
$input,
|
||
|
|
$errorMsg = 'Path points to a file (it should point to a directory)'
|
||
|
|
) {
|
||
|
|
self::absPathExists($input, 'Directory does not exist or is outside restricted basedir');
|
||
|
|
if (!is_dir($input)) {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function absPathExistsAndIsFile(
|
||
|
|
$input,
|
||
|
|
$errorMsg = 'Path points to a directory (it should not do that)'
|
||
|
|
) {
|
||
|
|
self::absPathExists($input, 'File does not exist or is outside restricted basedir');
|
||
|
|
if (@is_dir($input)) {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function absPathExistsAndIsFileInDocRoot($input)
|
||
|
|
{
|
||
|
|
self::absPathExistsAndIsFile($input);
|
||
|
|
self::absPathIsInDocRoot($input);
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function absPathExistsAndIsNotDir(
|
||
|
|
$input,
|
||
|
|
$errorMsg = 'Path points to a directory (it should point to a file)'
|
||
|
|
) {
|
||
|
|
self::absPathExistsAndIsFile($input, $errorMsg);
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
public static function pregMatch($pattern, $input, $errorMsg = 'Does not match expected pattern')
|
||
|
|
{
|
||
|
|
self::noNUL($input);
|
||
|
|
self::mustBeString($input);
|
||
|
|
if (!preg_match($pattern, $input)) {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function isJSONArray($input, $errorMsg = 'Not a JSON array')
|
||
|
|
{
|
||
|
|
self::noNUL($input);
|
||
|
|
self::mustBeString($input);
|
||
|
|
self::notEmpty($input);
|
||
|
|
if ((strpos($input, '[') !== 0) || (!is_array(json_decode($input)))) {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function isJSONObject($input, $errorMsg = 'Not a JSON object')
|
||
|
|
{
|
||
|
|
self::noNUL($input);
|
||
|
|
self::mustBeString($input);
|
||
|
|
self::notEmpty($input);
|
||
|
|
if ((strpos($input, '{') !== 0) || (!is_object(json_decode($input)))) {
|
||
|
|
self::fail($errorMsg, $input);
|
||
|
|
}
|
||
|
|
return $input;
|
||
|
|
}
|
||
|
|
|
||
|
|
}
|