jarednova /
timber
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | class TimberURLHelper { |
||
| 4 | |||
| 5 | /** |
||
| 6 | * |
||
| 7 | * |
||
| 8 | * @return string |
||
| 9 | */ |
||
| 10 | public static function get_current_url() { |
||
| 11 | $pageURL = "http://"; |
||
| 12 | if ( isset( $_SERVER['HTTPS'] ) && $_SERVER["HTTPS"] == "on" ) { |
||
| 13 | $pageURL = "https://";; |
||
| 14 | } |
||
| 15 | if ( isset($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"] && $_SERVER["SERVER_PORT"] != "80" ) { |
||
| 16 | $pageURL .= self::get_host() . ":" . $_SERVER["SERVER_PORT"] . $_SERVER["REQUEST_URI"]; |
||
| 17 | } else { |
||
| 18 | $pageURL .= self::get_host() . $_SERVER["REQUEST_URI"]; |
||
| 19 | } |
||
| 20 | return $pageURL; |
||
| 21 | } |
||
| 22 | |||
| 23 | /** |
||
| 24 | * |
||
| 25 | * |
||
| 26 | * @param string $url |
||
| 27 | * @return bool |
||
| 28 | */ |
||
| 29 | public static function is_url( $url ) { |
||
| 30 | if ( !is_string( $url ) ) { |
||
| 31 | return false; |
||
| 32 | } |
||
| 33 | $url = strtolower( $url ); |
||
| 34 | if ( strstr( $url, '://' ) ) { |
||
| 35 | return true; |
||
| 36 | } |
||
| 37 | return false; |
||
| 38 | } |
||
| 39 | |||
| 40 | /** |
||
| 41 | * |
||
| 42 | * |
||
| 43 | * @return string |
||
| 44 | */ |
||
| 45 | public static function get_path_base() { |
||
| 46 | $struc = get_option( 'permalink_structure' ); |
||
| 47 | $struc = explode( '/', $struc ); |
||
| 48 | $p = '/'; |
||
| 49 | foreach ( $struc as $s ) { |
||
| 50 | if ( !strstr( $s, '%' ) && strlen( $s ) ) { |
||
| 51 | $p .= $s . '/'; |
||
| 52 | } |
||
| 53 | } |
||
| 54 | return $p; |
||
| 55 | } |
||
| 56 | |||
| 57 | /** |
||
| 58 | * |
||
| 59 | * |
||
| 60 | * @param string $url |
||
| 61 | * @param bool $force |
||
| 62 | * @return string |
||
| 63 | */ |
||
| 64 | public static function get_rel_url( $url, $force = false ) { |
||
| 65 | $url_info = parse_url( $url ); |
||
| 66 | if ( isset( $url_info['host'] ) && $url_info['host'] != self::get_host() && !$force ) { |
||
| 67 | return $url; |
||
| 68 | } |
||
| 69 | $link = ''; |
||
| 70 | if ( isset( $url_info['path'] ) ) { |
||
| 71 | $link = $url_info['path']; |
||
| 72 | } |
||
| 73 | if ( isset( $url_info['query'] ) && strlen( $url_info['query'] ) ) { |
||
| 74 | $link .= '?' . $url_info['query']; |
||
| 75 | } |
||
| 76 | if ( isset( $url_info['fragment'] ) && strlen( $url_info['fragment'] ) ) { |
||
| 77 | $link .= '#' . $url_info['fragment']; |
||
| 78 | } |
||
| 79 | $link = TimberURLHelper::remove_double_slashes( $link ); |
||
| 80 | return $link; |
||
| 81 | } |
||
| 82 | |||
| 83 | /** |
||
| 84 | * Some setups like HTTP_HOST, some like SERVER_NAME, it's complicated |
||
| 85 | * @link http://stackoverflow.com/questions/2297403/http-host-vs-server-name |
||
| 86 | * @return string the HTTP_HOST or SERVER_NAME |
||
| 87 | */ |
||
| 88 | public static function get_host() { |
||
| 89 | if (isset($_SERVER['HTTP_HOST'])) { |
||
| 90 | return $_SERVER['HTTP_HOST']; |
||
| 91 | } |
||
| 92 | if (isset($_SERVER['SERVER_NAME'])) { |
||
| 93 | return $_SERVER['SERVER_NAME']; |
||
| 94 | } |
||
| 95 | return ''; |
||
| 96 | } |
||
| 97 | |||
| 98 | /** |
||
| 99 | * |
||
| 100 | * |
||
| 101 | * @param string $url |
||
| 102 | * @return bool |
||
| 103 | */ |
||
| 104 | public static function is_local( $url ) { |
||
| 105 | if ( strstr( $url, self::get_host() ) ) { |
||
| 106 | return true; |
||
| 107 | } |
||
| 108 | return false; |
||
| 109 | } |
||
| 110 | |||
| 111 | /** |
||
| 112 | * |
||
| 113 | * |
||
| 114 | * @param string $src |
||
| 115 | * @return string |
||
| 116 | */ |
||
| 117 | public static function get_full_path( $src ) { |
||
| 118 | $root = ABSPATH; |
||
| 119 | $old_root_path = $root . $src; |
||
| 120 | $old_root_path = str_replace( '//', '/', $old_root_path ); |
||
| 121 | return $old_root_path; |
||
| 122 | } |
||
| 123 | |||
| 124 | /** |
||
| 125 | * Takes a url and figures out its place based in the file system based on path |
||
| 126 | * NOTE: Not fool-proof, makes a lot of assumptions about the file path |
||
| 127 | * matching the URL path |
||
| 128 | * |
||
| 129 | * @param string $url |
||
| 130 | * @return string |
||
| 131 | */ |
||
| 132 | public static function url_to_file_system( $url ) { |
||
| 133 | $url_parts = parse_url( $url ); |
||
| 134 | $path = ABSPATH . $url_parts['path']; |
||
| 135 | $path = str_replace( '//', '/', $path ); |
||
| 136 | return $path; |
||
| 137 | } |
||
| 138 | |||
| 139 | public static function file_system_to_url( $fs ) { |
||
| 140 | $relative_path = self::get_rel_path( $fs ); |
||
| 141 | $home = home_url( '/'.$relative_path ); |
||
| 142 | return $home; |
||
| 143 | } |
||
| 144 | |||
| 145 | /** |
||
| 146 | * |
||
| 147 | * |
||
| 148 | * @param string $src |
||
| 149 | * @return string |
||
| 150 | */ |
||
| 151 | public static function get_rel_path( $src ) { |
||
| 152 | if ( strstr( $src, ABSPATH ) ) { |
||
| 153 | return str_replace( ABSPATH, '', $src ); |
||
| 154 | } |
||
| 155 | //its outside the wordpress directory, alternate setups: |
||
| 156 | $src = str_replace( WP_CONTENT_DIR, '', $src ); |
||
| 157 | return WP_CONTENT_SUBDIR . $src; |
||
| 158 | } |
||
| 159 | |||
| 160 | /** |
||
| 161 | * |
||
| 162 | * |
||
| 163 | * @param string $url |
||
| 164 | * @return string |
||
| 165 | */ |
||
| 166 | public static function remove_double_slashes( $url ) { |
||
| 167 | $url = str_replace( '//', '/', $url ); |
||
| 168 | if ( strstr( $url, 'http:' ) && !strstr( $url, 'http://' ) ) { |
||
| 169 | $url = str_replace( 'http:/', 'http://', $url ); |
||
| 170 | } |
||
| 171 | return $url; |
||
| 172 | } |
||
| 173 | |||
| 174 | /** |
||
| 175 | * |
||
| 176 | * |
||
| 177 | * @param string $url |
||
| 178 | * @param string $path |
||
| 179 | * @return string |
||
| 180 | */ |
||
| 181 | public static function prepend_to_url( $url, $path ) { |
||
| 182 | if ( strstr( strtolower( $url ), 'http' ) ) { |
||
| 183 | $url_parts = parse_url( $url ); |
||
| 184 | $url = $url_parts['scheme'] . '://' . $url_parts['host'] . $path . $url_parts['path']; |
||
| 185 | if ( isset( $url_parts['query'] ) ) { |
||
| 186 | $url .= $url_parts['query']; |
||
| 187 | } |
||
| 188 | if ( isset( $url_parts['fragment'] ) ) { |
||
| 189 | $url .= $url_parts['fragment']; |
||
| 190 | } |
||
| 191 | } else { |
||
| 192 | $url = $url . $path; |
||
| 193 | } |
||
| 194 | return self::remove_double_slashes( $url ); |
||
| 195 | } |
||
| 196 | |||
| 197 | /** |
||
| 198 | * |
||
| 199 | * |
||
| 200 | * @param string $path |
||
| 201 | * @return string |
||
| 202 | */ |
||
| 203 | public static function preslashit( $path ) { |
||
| 204 | if ( strpos( $path, '/' ) != 0 ) { |
||
| 205 | $path = '/' . $path; |
||
| 206 | } |
||
| 207 | return $path; |
||
| 208 | } |
||
| 209 | |||
| 210 | /** |
||
| 211 | * This will evaluate wheter a URL is at an aboslute location (like http://example.org/whatever) |
||
| 212 | * |
||
| 213 | * @return boolean true if $path is an absolute url, false if relative. |
||
| 214 | */ |
||
| 215 | public static function is_absolute( $path ) { |
||
| 216 | return (boolean) ( strstr( $path, 'http' ) ); |
||
| 217 | } |
||
| 218 | |||
| 219 | /** |
||
| 220 | * This function is slightly different from the one below in the case of: |
||
| 221 | * an image hosted on the same domain BUT on a different site than the |
||
| 222 | * Wordpress install will be reported as external content. |
||
| 223 | * |
||
| 224 | * @param string $url a URL to evaluate against |
||
| 225 | * @return boolean if $url points to an external location returns true |
||
| 226 | */ |
||
| 227 | public static function is_external_content( $url ) { |
||
| 228 | $is_external = TimberURLHelper::is_absolute( $url ) && ! TimberURLHelper::is_internal_content( $url ); |
||
| 229 | |||
| 230 | return $is_external; |
||
| 231 | } |
||
| 232 | |||
| 233 | private static function is_internal_content($url) { |
||
| 234 | // using content_url() instead of site_url or home_url is IMPORTANT |
||
| 235 | // otherwise you run into errors with sites that: |
||
| 236 | // 1. use WPML plugin |
||
| 237 | // 2. or redefine content directory |
||
| 238 | $is_content_url = strstr( $url, content_url() ); |
||
| 239 | |||
| 240 | // this case covers when the upload directory has been redefined |
||
| 241 | $upload_dir = wp_upload_dir(); |
||
| 242 | $is_upload_url = strstr( $url, $upload_dir['baseurl'] ); |
||
| 243 | |||
| 244 | return $is_content_url || $is_upload_url; |
||
| 245 | } |
||
| 246 | |||
| 247 | /** |
||
| 248 | * |
||
| 249 | * |
||
| 250 | * @param string $url |
||
| 251 | * @return bool true if $path is an external url, false if relative or local. |
||
| 252 | * true if it's a subdomain (http://cdn.example.org = true) |
||
| 253 | */ |
||
| 254 | public static function is_external( $url ) { |
||
| 255 | $has_http = strstr( strtolower( $url ), 'http' ); |
||
| 256 | $on_domain = strstr( $url, self::get_host() ); |
||
| 257 | if ( $has_http && !$on_domain ) { |
||
| 258 | return true; |
||
| 259 | } |
||
| 260 | return false; |
||
| 261 | } |
||
| 262 | |||
| 263 | /** |
||
| 264 | * Pass links through untrailingslashit unless they are a single / |
||
| 265 | * |
||
| 266 | * @param string $link |
||
| 267 | * @return string |
||
| 268 | */ |
||
| 269 | public static function remove_trailing_slash( $link ) { |
||
| 270 | if ( $link != "/" ) |
||
| 271 | $link = untrailingslashit( $link ); |
||
| 272 | return $link; |
||
| 273 | } |
||
| 274 | |||
| 275 | /** |
||
| 276 | * Download an external file via a URL |
||
| 277 | * |
||
| 278 | * @param string $url |
||
| 279 | * @param int $timeout |
||
| 280 | * @return string|WP_Error the location of the temporay file name or an error |
||
| 281 | * @deprecated since 0.20.0 |
||
| 282 | */ |
||
| 283 | static function download_url( $url, $timeout = 300 ) { |
||
| 284 | if ( !$url ) { |
||
| 285 | return new WP_Error( 'http_no_url', __( 'Invalid URL Provided.' ) ); |
||
| 286 | } |
||
| 287 | |||
| 288 | $tmpfname = wp_tempnam( $url ); |
||
| 289 | if ( !$tmpfname ) { |
||
| 290 | return new WP_Error( 'http_no_file', __( 'Could not create Temporary file.' ) ); |
||
| 291 | } |
||
| 292 | |||
| 293 | $response = wp_remote_get( $url, array( 'timeout' => $timeout, 'stream' => true, 'filename' => $tmpfname ) ); |
||
| 294 | |||
| 295 | if ( is_wp_error( $response ) ) { |
||
| 296 | unlink( $tmpfname ); |
||
| 297 | return $response; |
||
| 298 | } |
||
| 299 | if ( 200 != wp_remote_retrieve_response_code( $response ) ) { |
||
| 300 | unlink( $tmpfname ); |
||
| 301 | return new WP_Error( 'http_404', trim( wp_remote_retrieve_response_message( $response ) ) ); |
||
| 302 | } |
||
| 303 | return $tmpfname; |
||
| 304 | } |
||
| 305 | |||
| 306 | /** |
||
| 307 | * Returns the url parameters, for example for url http://example.org/blog/post/news/2014/whatever |
||
| 308 | * this will return array('blog', 'post', 'news', '2014', 'whatever'); |
||
| 309 | * OR if sent an integer like: TimberUrlHelper::get_params(2); this will return 'news'; |
||
| 310 | * |
||
| 311 | * @param int $i the position of the parameter to grab. |
||
|
0 ignored issues
–
show
|
|||
| 312 | * @return array|string |
||
| 313 | */ |
||
| 314 | public static function get_params( $i = false ) { |
||
| 315 | $args = explode( '/', trim( strtolower( $_SERVER['REQUEST_URI'] ) ) ); |
||
| 316 | $newargs = array(); |
||
| 317 | foreach ( $args as $arg ) { |
||
| 318 | if ( strlen( $arg ) ) { |
||
| 319 | $newargs[] = $arg; |
||
| 320 | } |
||
| 321 | } |
||
| 322 | if ( $i === false ) { |
||
| 323 | return $newargs; |
||
| 324 | } |
||
| 325 | if ( $i < 0 ) { |
||
| 326 | //count from end |
||
| 327 | $i = count( $newargs ) + $i; |
||
| 328 | } |
||
| 329 | if ( isset( $newargs[$i] ) ) { |
||
| 330 | return $newargs[$i]; |
||
| 331 | } |
||
| 332 | } |
||
| 333 | |||
| 334 | } |
||
| 335 |
This check looks for
@paramannotations where the type inferred by our type inference engine differs from the declared type.It makes a suggestion as to what type it considers more descriptive.
Most often this is a case of a parameter that can be null in addition to its declared types.