Extract_Phar::go()

Complexity

Conditions	17
Paths	96

Size

Total Lines	80
Code Lines	54

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    static function go($return = false)

It is generally recommended to explicitly declare the visibility for methods.

    {
        $fp = fopen(__FILE__, 'rb');
        fseek($fp, self::LEN);

It seems like $fp can also be of type false; however, parameter $handle of fseek() does only seem to accept resource, maybe add an additional type check?

        $L = unpack('V', $a = fread($fp, 4));

It seems like $fp can also be of type false; however, parameter $handle of fread() does only seem to accept resource, maybe add an additional type check?

        $m = '';

        do {
            $read = 8192;
            if ($L[1] - strlen($m) < 8192) {
                $read = $L[1] - strlen($m);
            }
            $last = fread($fp, $read);
            $m .= $last;
        } while (strlen($last) && strlen($m) < $L[1]);

        if (strlen($m) < $L[1]) {
            die('ERROR: manifest length read was "' .

Using exit here is not recommended.

                strlen($m) .'" should be "' .
                $L[1] . '"');
        }

        $info = self::_unpack($m);
        $f = $info['c'];

        if ($f & self::GZ) {
            if (!function_exists('gzinflate')) {
                die('Error: zlib extension is not enabled -' .

Using exit here is not recommended.

                    ' gzinflate() function needed for zlib-compressed .phars');
            }
        }

        if ($f & self::BZ2) {
            if (!function_exists('bzdecompress')) {
                die('Error: bzip2 extension is not enabled -' .

Using exit here is not recommended.

                    ' bzdecompress() function needed for bz2-compressed .phars');
            }
        }

        $temp = self::tmpdir();

        if (!$temp || !is_writable($temp)) {

It seems like $temp can also be of type array; however, parameter $filename of is_writable() does only seem to accept string, maybe add an additional type check?

            $sessionpath = session_save_path();
            if (strpos ($sessionpath, ";") !== false)
                $sessionpath = substr ($sessionpath, strpos ($sessionpath, ";")+1);
            if (!file_exists($sessionpath) || !is_dir($sessionpath)) {
                die('Could not locate temporary directory to extract phar');

Using exit here is not recommended.

            }
            $temp = $sessionpath;
        }

        $temp .= '/pharextract/'.basename(__FILE__, '.phar');
        self::$temp = $temp;
        self::$origdir = getcwd();
        @mkdir($temp, 0777, true);

It seems like you do not handle an error condition for mkdir(). This can introduce security issues, and is generally not recommended.

        $temp = realpath($temp);

        if (!file_exists($temp . DIRECTORY_SEPARATOR . md5_file(__FILE__))) {
            self::_removeTmpFiles($temp, getcwd());
            @mkdir($temp, 0777, true);
            @file_put_contents($temp . '/' . md5_file(__FILE__), '');

It seems like you do not handle an error condition for file_put_contents(). This can introduce security issues, and is generally not recommended.

            foreach ($info['m'] as $path => $file) {
                $a = !file_exists(dirname($temp . '/' . $path));
                @mkdir(dirname($temp . '/' . $path), 0777, true);
                clearstatcache();

                if ($path[strlen($path) - 1] == '/') {
                    @mkdir($temp . '/' . $path, 0777);
                } else {
                    file_put_contents($temp . '/' . $path, self::extractFile($path, $file, $fp));
                    @chmod($temp . '/' . $path, 0666);

It seems like you do not handle an error condition for chmod(). This can introduce security issues, and is generally not recommended.

                }
            }
        }

        chdir($temp);

        if (!$return) {
            include self::START;
        }