Completed
Pull Request — release-2.1 (#4092)
by Rick
10:23
created

curl_fetch_web_data   A

Complexity

Total Complexity 33

Size/Duplication

Total Lines 285
Duplicated Lines 0 %

Coupling/Cohesion

Components 1
Dependencies 0

Importance

Changes 0
Metric Value
dl 0
loc 285
rs 9.3999
c 0
b 0
f 0
wmc 33
lcom 1
cbo 0

9 Methods

Rating   Name   Duplication   Size   Complexity  
A __construct() 0 6 1
A get_url_data() 0 14 4
C curl_request() 0 49 9
B get_redirect_url() 0 15 6
A result() 0 10 3
A result_raw() 0 10 2
A build_post_data() 0 16 4
A set_options() 0 22 3
A redirect() 0 7 1
1
<?php
2
/**
3
 * Simple Machines Forum (SMF)
4
 *
5
 * @package SMF
6
 * @author Simple Machines http://www.simplemachines.org
7
 * @copyright 2017 Simple Machines and individual contributors
8
 * @license http://www.simplemachines.org/about/smf/license.php BSD
9
 *
10
 * @version 2.1 Beta 3
11
 */
12
13
if (!defined('SMF'))
14
	die('No direct access...');
15
16
/**
17
 * Class curl_fetch_web_data
18
 * Simple cURL class to fetch a web page
19
 * Properly redirects even with safe mode and basedir restrictions
20
 * Can provide simple post options to a page
21
 *
22
 * Load class
23
 * Initiate as
24
 *  - $fetch_data = new cURL_fetch_web_data();
25
 *	- optionally pass an array of cURL options and redirect count
26
 *	- cURL_fetch_web_data(cURL options array, Max redirects);
27
 *  - $fetch_data = new cURL_fetch_web_data(array(CURLOPT_SSL_VERIFYPEER => 1), 5);
28
 *
29
 * Make the call
30
 *  - $fetch_data('https://www.simplemachines.org'); // fetch a page
31
 *  - $fetch_data('https://www.simplemachines.org', array('user' => 'name', 'password' => 'password')); // post to a page
32
 *  - $fetch_data('https://www.simplemachines.org', parameter1&parameter2&parameter3); // post to a page
33
 *
34
 * Get the data
35
 *  - $fetch_data->result('body'); // just the page content
36
 *  - $fetch_data->result(); // an array of results, body, header, http result codes
37
 *  - $fetch_data->result_raw(); // show all results of all calls (in the event of a redirect)
38
 *  - $fetch_data->result_raw(0); // show all results of call x
39
 */
40
class curl_fetch_web_data
41
{
42
	/**
43
	 * Set the default items for this class
44
	 *
45
	 * @var array $default_options
46
	 */
47
	private $default_options = array(
48
		CURLOPT_RETURNTRANSFER	=> 1, // Get returned value as a string (don't output it)
49
		CURLOPT_HEADER			=> 1, // We need the headers to do our own redirect
50
		CURLOPT_FOLLOWLOCATION	=> 0, // Don't follow, we will do it ourselves so safe mode and open_basedir will dig it
51
		CURLOPT_USERAGENT		=> 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko Firefox/11.0', // set a normal looking useragent
52
		CURLOPT_CONNECTTIMEOUT	=> 15, // Don't wait forever on a connection
53
		CURLOPT_TIMEOUT			=> 90, // A page should load in this amount of time
54
		CURLOPT_MAXREDIRS		=> 5, // stop after this many redirects
55
		CURLOPT_ENCODING		=> 'gzip,deflate', // accept gzip and decode it
56
		CURLOPT_SSL_VERIFYPEER	=> 0, // stop cURL from verifying the peer's certificate
57
		CURLOPT_SSL_VERIFYHOST	=> 0, // stop cURL from verifying the peer's host
58
		CURLOPT_POST			=> 0, // no post data unless its passed
59
	);
60
	
61
	/**
62
	 * @var int Maximum number of redirects
63
	 */
64
	public $max_redirect;
65
	
66
	/**
67
	 * @var array An array of cURL options
68
	 */
69
	public $user_options = array();
70
	
71
	/**
72
	 * @var string Any post data as form name => value
73
	 */
74
	public $post_data;
75
	
76
	/**
77
	 * @var array An array of cURL options
78
	 */
79
	public $options;
80
	
81
	/**
82
	 * @var int ???
83
	 */
84
	public $current_redirect;
85
	
86
	/**
87
	 * @var array Stores responses (url, code, error, headers, body) in the response array
88
	 */
89
	public $response = array();
90
	
91
	/**
92
	 * @var string The header
93
	 */
94
	public $headers;
95
96
	/**
97
	* Start the curl object
98
	* - allow for user override values
99
	*
100
	* @param array $options An array of cURL options
101
	* @param int $max_redirect Maximum number of redirects
102
	*/
103
	public function __construct($options = array(), $max_redirect = 3)
104
	{
105
		// Initialize class variables
106
		$this->max_redirect = intval($max_redirect);
107
		$this->user_options = $options;
108
	}
109
110
	/**
111
	* Main calling function,
112
	*  - will request the page data from a given $url
113
	*  - optionally will post data to the page form if post data is supplied
114
	*  - passed arrays will be converted to a post string joined with &'s
115
	*  - calls set_options to set the curl opts array values based on the defaults and user input
116
	*
117
	* @param string $url the site we are going to fetch
118
	* @param array $post_data any post data as form name => value
119
	* @return object An instance of the curl_fetch_web_data class
120
	*/
121
	public function get_url_data($url, $post_data = array())
122
	{
123
		// POSTing some data perhaps?
124
		if (!empty($post_data) && is_array($post_data))
125
			$this->post_data = $this->build_post_data($post_data);
126
		elseif (!empty($post_data))
127
			$this->post_data = trim($post_data);
128
129
		// set the options and get it
130
		$this->set_options();
131
		$this->curl_request(str_replace(' ', '%20', $url));
132
133
		return $this;
134
	}
135
136
	/**
137
	* Makes the actual cURL call
138
	*  - stores responses (url, code, error, headers, body) in the response array
139
	*  - detects 301, 302, 307 codes and will redirect to the given response header location
140
	*
141
	* @param string $url The site to fetch
142
	* @param bool $redirect Whether or not this was a redirect request
143
	* @return void|bool Sets various properties of the class or returns false if the URL isn't specified
144
	*/
145
	private function curl_request($url, $redirect = false)
146
	{
147
		// we do have a url I hope
148
		if ($url == '')
149
			return false;
150
		else
151
			$this->options[CURLOPT_URL] = $url;
152
153
		// if we have not already been redirected, set it up so we can if needed
154
		if (!$redirect)
155
		{
156
			$this->current_redirect = 1;
157
			$this->response = array();
158
		}
159
160
		// Initialize the curl object and make the call
161
		$cr = curl_init();
162
		curl_setopt_array($cr, $this->options);
0 ignored issues
show
Security Header Injection introduced by
$this->options can contain request data and is used in request header context(s) leading to a potential security vulnerability.

26 paths for user data to reach this point

  1. Path: Read from $_GET, and $request is assigned in proxy.php on line 78
  1. Read from $_GET, and $request is assigned
    in proxy.php on line 78
  2. $request is passed to ProxyServer::cacheImage()
    in proxy.php on line 85
  3. $request is passed to curl_fetch_web_data::get_url_data()
    in proxy.php on line 169
  4. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  5. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  6. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  2. Path: Read from $_REQUEST, and $_REQUEST['set_gz'] is passed to fetch_web_data() in Sources/ManageSmileys.php on line 1448
  1. Read from $_REQUEST, and $_REQUEST['set_gz'] is passed to fetch_web_data()
    in Sources/ManageSmileys.php on line 1448
  2. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  3. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  4. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  5. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  3. Path: Read from $_GET, and $_GET['package'] is passed to fetch_web_data() in Sources/PackageGet.php on line 275
  1. Read from $_GET, and $_GET['package'] is passed to fetch_web_data()
    in Sources/PackageGet.php on line 275
  2. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  3. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  4. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  5. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  4. Path: Read from $_REQUEST, and $url . $_REQUEST['package'] is passed to fetch_web_data() in Sources/PackageGet.php on line 601
  1. Read from $_REQUEST, and $url . $_REQUEST['package'] is passed to fetch_web_data()
    in Sources/PackageGet.php on line 601
  2. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  3. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  4. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  5. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  5. Path: Read from $_POST, and $_POST['userpicpersonal'] is passed through parse_url(), and $url is assigned in Sources/Profile-Modify.php on line 3161
  1. Read from $_POST, and $_POST['userpicpersonal'] is passed through parse_url(), and $url is assigned
    in Sources/Profile-Modify.php on line 3161
  2. $url['scheme'] . '://' . $url['host'] . (empty($url['port']) ? '' : ':' . $url['port']) . str_replace(' ', '%20', trim($url['path'])) is passed to fetch_web_data()
    in Sources/Profile-Modify.php on line 3162
  3. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  4. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  5. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  6. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  6. Path: Read from $_POST, and $_POST['userpicpersonal'] is passed through preg_replace(), and preg_replace('~action(?:=|%3d)(?!dlattach)~i', 'action-', $_POST['userpicpersonal']) is passed through str_replace(), and $profile_vars is assigned in Sources/Profile-Modify.php on line 3223
  1. Read from $_POST, and $_POST['userpicpersonal'] is passed through preg_replace(), and preg_replace('~action(?:=|%3d)(?!dlattach)~i', 'action-', $_POST['userpicpersonal']) is passed through str_replace(), and $profile_vars is assigned
    in Sources/Profile-Modify.php on line 3223
  2. $profile_vars['avatar'] is passed to downloadAvatar()
    in Sources/Profile-Modify.php on line 3245
  3. $url is passed to resizeImageFile()
    in Sources/Subs-Graphics.php on line 80
  4. $source is passed to fetch_web_data()
    in Sources/Subs-Graphics.php on line 340
  5. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  6. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  7. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  8. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  7. Path: Read from $_GET, and $_GET['did'] is escaped by urlencode() for all (url-encoded) context(s), and 'https://download.simplemachines.org/fetch_language.php?version=' . urlencode(strtr($forum_version, array('SMF ' => ''))) . ';fetch=' . urlencode($_GET['did']) is passed to read_tgz_file() in Sources/ManageLanguages.php on line 243
  1. Read from $_GET, and $_GET['did'] is escaped by urlencode() for all (url-encoded) context(s), and 'https://download.simplemachines.org/fetch_language.php?version=' . urlencode(strtr($forum_version, array('SMF ' => ''))) . ';fetch=' . urlencode($_GET['did']) is passed to read_tgz_file()
    in Sources/ManageLanguages.php on line 243
  2. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 35
  3. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  4. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  5. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  6. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  7. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  8. Path: Read from $_GET, and $_GET['did'] is escaped by urlencode() for all (url-encoded) context(s), and 'https://download.simplemachines.org/fetch_language.php?version=' . urlencode(strtr($forum_version, array('SMF ' => ''))) . ';fetch=' . urlencode($_GET['did']) is passed to read_tgz_file() in Sources/ManageLanguages.php on line 255
  1. Read from $_GET, and $_GET['did'] is escaped by urlencode() for all (url-encoded) context(s), and 'https://download.simplemachines.org/fetch_language.php?version=' . urlencode(strtr($forum_version, array('SMF ' => ''))) . ';fetch=' . urlencode($_GET['did']) is passed to read_tgz_file()
    in Sources/ManageLanguages.php on line 255
  2. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 35
  3. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  4. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  5. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  6. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  7. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  9. Path: Read from $_REQUEST, and $_REQUEST['set_gz'] is escaped by basename() for file context(s), and basename($_REQUEST['set_gz']) is passed through strtr(), and $base_name is assigned in Sources/ManageSmileys.php on line 1433
  1. Read from $_REQUEST, and $_REQUEST['set_gz'] is escaped by basename() for file context(s), and basename($_REQUEST['set_gz']) is passed through strtr(), and $base_name is assigned
    in Sources/ManageSmileys.php on line 1433
  2. $destination is assigned
    in Sources/ManageSmileys.php on line 1442
  3. $destination is passed to read_tgz_file()
    in Sources/ManageSmileys.php on line 1482
  4. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 35
  5. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  6. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  7. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  8. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  9. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  10. Path: Read from $_REQUEST, and $_REQUEST['package'] is escaped by basename() for file context(s), and $destination is assigned in Sources/ManageSmileys.php on line 1457
  1. Read from $_REQUEST, and $_REQUEST['package'] is escaped by basename() for file context(s), and $destination is assigned
    in Sources/ManageSmileys.php on line 1457
  2. $destination is passed to read_tgz_file()
    in Sources/ManageSmileys.php on line 1482
  3. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 35
  4. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  5. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  6. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  7. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  8. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  11. Path: Read from $_REQUEST, and $_REQUEST['package'] is passed through preg_replace(), and $context is assigned in Sources/Packages.php on line 104
  1. Read from $_REQUEST, and $_REQUEST['package'] is passed through preg_replace(), and $context is assigned
    in Sources/Packages.php on line 104
  2. $context is assigned
    in Sources/Packages.php on line 107
  3. $context is assigned
    in Sources/Packages.php on line 132
  4. $context is assigned
    in Sources/Packages.php on line 135
  5. $context is assigned
    in Sources/Packages.php on line 141
  6. $packagesdir . '/' . $context['filename'] is passed to read_tgz_file()
    in Sources/Packages.php on line 152
  7. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 35
  8. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  9. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  10. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  11. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  12. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  12. Path: Read from $_REQUEST, and $context is assigned in Sources/Packages.php on line 780
  1. Read from $_REQUEST, and $context is assigned
    in Sources/Packages.php on line 780
  2. $context is assigned
    in Sources/Packages.php on line 783
  3. $context is assigned
    in Sources/Packages.php on line 789
  4. $context is assigned
    in Sources/Packages.php on line 792
  5. $context is assigned
    in Sources/Packages.php on line 798
  6. $packagesdir . '/' . $context['filename'] is passed to read_tgz_file()
    in Sources/Packages.php on line 815
  7. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 35
  8. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  9. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  10. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  11. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  12. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  13. Path: Read from $_REQUEST, and $context is assigned in Sources/Packages.php on line 1253
  1. Read from $_REQUEST, and $context is assigned
    in Sources/Packages.php on line 1253
  2. $packagesdir . '/' . $context['filename'] is passed to read_tgz_file()
    in Sources/Packages.php on line 1257
  3. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 35
  4. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  5. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  6. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  7. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  8. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  14. Path: Read from $_REQUEST, and $packagesdir . '/' . $_REQUEST['package'] is passed to read_tgz_file() in Sources/Packages.php on line 1285
  1. Read from $_REQUEST, and $packagesdir . '/' . $_REQUEST['package'] is passed to read_tgz_file()
    in Sources/Packages.php on line 1285
  2. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 35
  3. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  4. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  5. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  6. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  7. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  15. Path: Read from $_REQUEST, and $packagesdir . '/' . $_REQUEST['package'] is passed to read_tgz_file() in Sources/Packages.php on line 1309
  1. Read from $_REQUEST, and $packagesdir . '/' . $_REQUEST['package'] is passed to read_tgz_file()
    in Sources/Packages.php on line 1309
  2. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 35
  3. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  4. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  5. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  6. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  7. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  16. Path: Read from $_REQUEST, and $_REQUEST['package'] is passed through preg_replace(), and $context is assigned in Sources/Packages.php on line 1849
  1. Read from $_REQUEST, and $_REQUEST['package'] is passed through preg_replace(), and $context is assigned
    in Sources/Packages.php on line 1849
  2. $packagesdir . '/' . $context['filename'] is passed to read_tgz_file()
    in Sources/Packages.php on line 1854
  3. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 35
  4. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  5. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  6. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  7. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  8. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  17. Path: Read from $_REQUEST, and $_REQUEST['package'] is escaped by basename() for file context(s), and $base_name is assigned in Sources/ManageSmileys.php on line 1453
  1. Read from $_REQUEST, and $_REQUEST['package'] is escaped by basename() for file context(s), and $base_name is assigned
    in Sources/ManageSmileys.php on line 1453
  2. $context is assigned
    in Sources/ManageSmileys.php on line 1455
  3. $context['filename'] is passed to getPackageInfo()
    in Sources/ManageSmileys.php on line 1499
  4. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 533
  5. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  6. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  7. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  8. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  9. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  18. Path: Read from $_GET, and $url is assigned in Sources/PackageGet.php on line 230
  1. Read from $_GET, and $url is assigned
    in Sources/PackageGet.php on line 230
  2. $url . '/' . $package['filename'] is passed to getPackageInfo()
    in Sources/PackageGet.php on line 497
  3. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 533
  4. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  5. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  6. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  7. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  8. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  19. Path: Read from $_GET, and $url is assigned in Sources/PackageGet.php on line 239
  1. Read from $_GET, and $url is assigned
    in Sources/PackageGet.php on line 239
  2. $url . '/' . $package['filename'] is passed to getPackageInfo()
    in Sources/PackageGet.php on line 497
  3. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 533
  4. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  5. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  6. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  7. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  8. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  20. Path: Read from $_GET, and $current_url is assigned in Sources/PackageGet.php on line 358
  1. Read from $_GET, and $current_url is assigned
    in Sources/PackageGet.php on line 358
  2. $package is assigned
    in Sources/PackageGet.php on line 366
  3. $package is assigned
    in Sources/PackageGet.php on line 376
  4. $package is assigned
    in Sources/PackageGet.php on line 377
  5. $package is assigned
    in Sources/PackageGet.php on line 466
  6. $package is assigned
    in Sources/PackageGet.php on line 467
  7. $package is assigned
    in Sources/PackageGet.php on line 468
  8. $package is assigned
    in Sources/PackageGet.php on line 469
  9. $package is assigned
    in Sources/PackageGet.php on line 470
  10. $package is assigned
    in Sources/PackageGet.php on line 473
  11. $context is assigned
    in Sources/PackageGet.php on line 476
  12. $packageSection is assigned
    in Sources/PackageGet.php on line 488
  13. $package is assigned
    in Sources/PackageGet.php on line 490
  14. $url . '/' . $package['filename'] is passed to getPackageInfo()
    in Sources/PackageGet.php on line 497
  15. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 533
  16. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  17. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  18. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  19. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  20. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  21. Path: Read from $_GET, and $current_url is assigned in Sources/PackageGet.php on line 360
  1. Read from $_GET, and $current_url is assigned
    in Sources/PackageGet.php on line 360
  2. $package is assigned
    in Sources/PackageGet.php on line 366
  3. $package is assigned
    in Sources/PackageGet.php on line 376
  4. $package is assigned
    in Sources/PackageGet.php on line 377
  5. $package is assigned
    in Sources/PackageGet.php on line 466
  6. $package is assigned
    in Sources/PackageGet.php on line 467
  7. $package is assigned
    in Sources/PackageGet.php on line 468
  8. $package is assigned
    in Sources/PackageGet.php on line 469
  9. $package is assigned
    in Sources/PackageGet.php on line 470
  10. $package is assigned
    in Sources/PackageGet.php on line 473
  11. $context is assigned
    in Sources/PackageGet.php on line 476
  12. $packageSection is assigned
    in Sources/PackageGet.php on line 488
  13. $package is assigned
    in Sources/PackageGet.php on line 490
  14. $url . '/' . $package['filename'] is passed to getPackageInfo()
    in Sources/PackageGet.php on line 497
  15. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 533
  16. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  17. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  18. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  19. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  20. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  22. Path: Read from $_GET, and $current_url is assigned in Sources/PackageGet.php on line 383
  1. Read from $_GET, and $current_url is assigned
    in Sources/PackageGet.php on line 383
  2. $package is assigned
    in Sources/PackageGet.php on line 421
  3. $package is assigned
    in Sources/PackageGet.php on line 422
  4. $package is assigned
    in Sources/PackageGet.php on line 461
  5. $package is assigned
    in Sources/PackageGet.php on line 462
  6. $package is assigned
    in Sources/PackageGet.php on line 466
  7. $package is assigned
    in Sources/PackageGet.php on line 467
  8. $package is assigned
    in Sources/PackageGet.php on line 468
  9. $package is assigned
    in Sources/PackageGet.php on line 469
  10. $package is assigned
    in Sources/PackageGet.php on line 470
  11. $package is assigned
    in Sources/PackageGet.php on line 473
  12. $context is assigned
    in Sources/PackageGet.php on line 476
  13. $packageSection is assigned
    in Sources/PackageGet.php on line 488
  14. $package is assigned
    in Sources/PackageGet.php on line 490
  15. $url . '/' . $package['filename'] is passed to getPackageInfo()
    in Sources/PackageGet.php on line 497
  16. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 533
  17. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  18. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  19. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  20. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  21. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  23. Path: Read from $_GET, and $current_url is assigned in Sources/PackageGet.php on line 385
  1. Read from $_GET, and $current_url is assigned
    in Sources/PackageGet.php on line 385
  2. $package is assigned
    in Sources/PackageGet.php on line 421
  3. $package is assigned
    in Sources/PackageGet.php on line 422
  4. $package is assigned
    in Sources/PackageGet.php on line 461
  5. $package is assigned
    in Sources/PackageGet.php on line 462
  6. $package is assigned
    in Sources/PackageGet.php on line 466
  7. $package is assigned
    in Sources/PackageGet.php on line 467
  8. $package is assigned
    in Sources/PackageGet.php on line 468
  9. $package is assigned
    in Sources/PackageGet.php on line 469
  10. $package is assigned
    in Sources/PackageGet.php on line 470
  11. $package is assigned
    in Sources/PackageGet.php on line 473
  12. $context is assigned
    in Sources/PackageGet.php on line 476
  13. $packageSection is assigned
    in Sources/PackageGet.php on line 488
  14. $package is assigned
    in Sources/PackageGet.php on line 490
  15. $url . '/' . $package['filename'] is passed to getPackageInfo()
    in Sources/PackageGet.php on line 497
  16. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 533
  17. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  18. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  19. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  20. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  21. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  24. Path: Read from $_REQUEST, and $_REQUEST['filename'] is escaped by basename() for file context(s), and $package_name is assigned in Sources/PackageGet.php on line 576
  1. Read from $_REQUEST, and $_REQUEST['filename'] is escaped by basename() for file context(s), and $package_name is assigned
    in Sources/PackageGet.php on line 576
  2. $package_name is passed to getPackageInfo()
    in Sources/PackageGet.php on line 611
  3. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 533
  4. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  5. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  6. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  7. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  8. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  25. Path: Read from $_REQUEST, and $_REQUEST['package'] is escaped by basename() for file context(s), and $package_name is assigned in Sources/PackageGet.php on line 578
  1. Read from $_REQUEST, and $_REQUEST['package'] is escaped by basename() for file context(s), and $package_name is assigned
    in Sources/PackageGet.php on line 578
  2. $package_name is passed to getPackageInfo()
    in Sources/PackageGet.php on line 611
  3. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 533
  4. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  5. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  6. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  7. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  8. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162
  26. Path: Read from $_FILES, and $_FILES['package']['name'] is passed through strtolower(), and strtolower($_FILES['package']['name']) is passed through strrchr(), and strrchr(strtolower($_FILES['package']['name']), '.') is passed through substr(), and $extension is assigned in Sources/PackageGet.php on line 656
  1. Read from $_FILES, and $_FILES['package']['name'] is passed through strtolower(), and strtolower($_FILES['package']['name']) is passed through strrchr(), and strrchr(strtolower($_FILES['package']['name']), '.') is passed through substr(), and $extension is assigned
    in Sources/PackageGet.php on line 656
  2. $extension is assigned
    in Sources/PackageGet.php on line 663
  3. $packageName is assigned
    in Sources/PackageGet.php on line 664
  4. $packageName is passed to getPackageInfo()
    in Sources/PackageGet.php on line 677
  5. $gzfilename is passed to read_tgz_data()
    in Sources/Subs-Package.php on line 533
  6. $gzfilename is passed to fetch_web_data()
    in Sources/Subs-Package.php on line 75
  7. $url is passed to curl_fetch_web_data::get_url_data()
    in Sources/Subs-Package.php on line 3141
  8. $url is passed through str_replace(), and str_replace(' ', '%20', $url) is passed to curl_fetch_web_data::curl_request()
    in Sources/Class-CurlFetchWeb.php on line 131
  9. curl_fetch_web_data::$options is assigned
    in Sources/Class-CurlFetchWeb.php on line 151
  10. Tainted property curl_fetch_web_data::$options is read
    in Sources/Class-CurlFetchWeb.php on line 162

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
163
		curl_exec($cr);
164
165
		// Get what was returned
166
		$curl_info = curl_getinfo($cr);
167
		$curl_content = curl_multi_getcontent($cr);
168
		$url = $curl_info['url']; // Last effective URL
169
		$http_code = $curl_info['http_code']; // Last HTTP code
170
		$body = (!curl_error($cr)) ? substr($curl_content, $curl_info['header_size']) : false;
171
		$error = (curl_error($cr)) ? curl_error($cr) : false;
172
173
		// close this request
174
		curl_close($cr);
175
176
		// store this 'loops' data, someone may want all of these :O
177
		$this->response[] = array(
178
			'url' => $url,
179
			'code' => $http_code,
180
			'error' => $error,
181
			'headers' => isset($this->headers) ? $this->headers : false,
182
			'body' => $body,
183
			'size' => $curl_info['download_content_length'],
184
		);
185
186
		// If this a redirect with a location header and we have not given up, then do it again
187
		if (preg_match('~30[127]~i', $http_code) === 1 && $this->headers['location'] != '' && $this->current_redirect <= $this->max_redirect)
188
		{
189
			$this->current_redirect++;
190
			$header_location = $this->get_redirect_url($url, $this->headers['location']);
191
			$this->redirect($header_location, $url);
192
		}
193
	}
194
195
	/**
196
	* Used if being redirected to ensure we have a fully qualified address
197
	*
198
	* @param string $last_url The URL we went to
199
	* @param string $new_url The URL we were redirected to
200
	* @return string The new URL that was in the HTTP header
201
	*/
202
	private function get_redirect_url($last_url = '', $new_url = '')
203
	{
204
		// Get the elements for these urls
205
		$last_url_parse = parse_url($last_url);
206
		$new_url_parse  = parse_url($new_url);
207
208
		// redirect headers are often incomplete or relative so we need to make sure they are fully qualified
209
		$new_url_parse['scheme'] = isset($new_url_parse['scheme']) ? $new_url_parse['scheme'] : $last_url_parse['scheme'];
210
		$new_url_parse['host'] = isset($new_url_parse['host']) ? $new_url_parse['host'] : $last_url_parse['host'];
211
		$new_url_parse['path'] = isset($new_url_parse['path']) ? $new_url_parse['path'] : $last_url_parse['path'];
212
		$new_url_parse['query'] = isset($new_url_parse['query']) ? $new_url_parse['query'] : '';
213
214
		// Build the new URL that was in the http header
215
		return $new_url_parse['scheme'] . '://' . $new_url_parse['host'] . $new_url_parse['path'] . (!empty($new_url_parse['query']) ? '?' . $new_url_parse['query'] : '');
216
	}
217
218
	/**
219
	* Used to return the results to the calling program
220
	*  - called as ->result() will return the full final array
221
	*  - called as ->result('body') to just return the page source of the result
222
	*
223
	* @param string $area Used to return an area such as body, header, error
224
	* @return string The response
225
	*/
226
	public function result($area = '')
227
	{
228
		$max_result = count($this->response) - 1;
229
230
		// just return a specifed area or the entire result?
231
		if ($area == '')
232
			return $this->response[$max_result];
233
		else
234
			return isset($this->response[$max_result][$area]) ? $this->response[$max_result][$area] : $this->response[$max_result];
235
	}
236
237
	/**
238
	* Will return all results from all loops (redirects)
239
	*  - Can be called as ->result_raw(x) where x is a specific loop results.
240
	*  - Call as ->result_raw() for everything.
241
	*
242
	* @param string $response_number Which response we want to get
243
	* @return array|string The entire response array or just the specified response
244
	*/
245
	public function result_raw($response_number = '')
246
	{
247
		if (!is_numeric($response_number))
248
			return $this->response;
249
		else
250
		{
251
			$response_number = min($response_number, count($this->response) - 1);
252
			return $this->response[$response_number];
253
		}
254
	}
255
256
	/**
257
	* Takes supplied POST data and url encodes it
258
	*  - forms the date (for post) in to a string var=xyz&var2=abc&var3=123
259
	*  - drops vars with @ since we don't support sending files (uploading)
260
	*
261
	* @param array|string $post_data The raw POST data
262
	* @return string A string of post data
263
	*/
264
	private function build_post_data($post_data)
265
	{
266
		if (is_array($post_data))
267
		{
268
			$postvars = array();
269
270
			// build the post data, drop ones with leading @'s since those can be used to send files, we don't support that.
271
			foreach ($post_data as $name => $value)
272
				$postvars[] = $name . '=' . urlencode($value[0] == '@' ? '' : $value);
273
274
			return implode('&', $postvars);
275
		}
276
		else
277
			return $post_data;
278
279
	}
280
281
	/**
282
	* Sets the final cURL options for the current call
283
	*  - overwrites our default values with user supplied ones or appends new user ones to what we have
284
	*  - sets the callback function now that $this is existing
285
	* @return void
286
	*/
287
	private function set_options()
288
	{
289
		// Callback to parse the returned headers, if any
290
		$this->default_options[CURLOPT_HEADERFUNCTION] = array($this, 'header_callback');
291
292
		// Any user options to account for
293
		if (is_array($this->user_options))
294
		{
295
			$keys = array_merge(array_keys($this->default_options), array_keys($this->user_options));
296
			$vals = array_merge($this->default_options, $this->user_options);
297
			$this->options = array_combine($keys, $vals);
298
		}
299
		else
300
			$this->options = $this->default_options;
301
302
		// POST data options, here we don't allow any overide
303
		if (isset($this->post_data))
304
		{
305
			$this->options[CURLOPT_POST] = 1;
306
			$this->options[CURLOPT_POSTFIELDS] = $this->post_data;
307
		}
308
	}
309
310
	/**
311
	* Called to initiate a redirect from a 301, 302 or 307 header
312
	*  - resets the cURL options for the loop, sets the referrer flag
313
	*
314
	* @param string $target_url The URL we want to redirect to
315
	* @param string $referer_url The URL that we're redirecting from
316
	*/
317
	private function redirect($target_url, $referer_url)
318
	{
319
		// no no I last saw that over there ... really, 301, 302, 307
320
		$this->set_options();
321
		$this->options[CURLOPT_REFERER] = $referer_url;
322
		$this->curl_request($target_url, true);
323
	}
324
}
325
326
?>
0 ignored issues
show
Best Practice introduced by
It is not recommended to use PHP's closing tag ?> in files other than templates.

Using a closing tag in PHP files that only contain PHP code is not recommended as you might accidentally add whitespace after the closing tag which would then be output by PHP. This can cause severe problems, for example headers cannot be sent anymore.

A simple precaution is to leave off the closing tag as it is not required, and it also has no negative effects whatsoever.

Loading history...