Passed
Push — master ( 95ad9a...5c0637 )
by Joas
12:15 queued 11s
created

Client::preventLocalAddress()   C

Complexity

Conditions 15
Paths 14

Size

Total Lines 43
Code Lines 25

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 15
eloc 25
nc 14
nop 2
dl 0
loc 43
rs 5.9166
c 0
b 0
f 0

How to fix   Complexity   

Long Method

Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.

For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.

Commonly applied refactorings include:

1
<?php
2
3
declare(strict_types=1);
4
5
/**
6
 * @copyright Copyright (c) 2016, ownCloud, Inc.
7
 *
8
 * @author Daniel Kesselberg <[email protected]>
9
 * @author Lukas Reschke <[email protected]>
10
 * @author Mohammed Abdellatif <[email protected]>
11
 * @author Robin Appelman <[email protected]>
12
 * @author Roeland Jago Douma <[email protected]>
13
 * @author Scott Shambarger <[email protected]>
14
 *
15
 * @license AGPL-3.0
16
 *
17
 * This code is free software: you can redistribute it and/or modify
18
 * it under the terms of the GNU Affero General Public License, version 3,
19
 * as published by the Free Software Foundation.
20
 *
21
 * This program is distributed in the hope that it will be useful,
22
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24
 * GNU Affero General Public License for more details.
25
 *
26
 * You should have received a copy of the GNU Affero General Public License, version 3,
27
 * along with this program. If not, see <http://www.gnu.org/licenses/>
28
 *
29
 */
30
31
namespace OC\Http\Client;
32
33
use GuzzleHttp\Client as GuzzleClient;
34
use GuzzleHttp\RequestOptions;
35
use OCP\Http\Client\IClient;
36
use OCP\Http\Client\IResponse;
37
use OCP\Http\Client\LocalServerException;
38
use OCP\ICertificateManager;
39
use OCP\IConfig;
40
use OCP\ILogger;
41
42
/**
43
 * Class Client
44
 *
45
 * @package OC\Http
46
 */
47
class Client implements IClient {
48
	/** @var GuzzleClient */
49
	private $client;
50
	/** @var IConfig */
51
	private $config;
52
	/** @var ILogger */
53
	private $logger;
54
	/** @var ICertificateManager */
55
	private $certificateManager;
56
57
	public function __construct(
58
		IConfig $config,
59
		ILogger $logger,
60
		ICertificateManager $certificateManager,
61
		GuzzleClient $client
62
	) {
63
		$this->config = $config;
64
		$this->logger = $logger;
65
		$this->client = $client;
66
		$this->certificateManager = $certificateManager;
67
	}
68
69
	private function buildRequestOptions(array $options): array {
70
		$proxy = $this->getProxyUri();
71
72
		$defaults = [
73
			RequestOptions::VERIFY => $this->getCertBundle(),
74
			RequestOptions::TIMEOUT => 30,
75
		];
76
77
		// Only add RequestOptions::PROXY if Nextcloud is explicitly
78
		// configured to use a proxy. This is needed in order not to override
79
		// Guzzle default values.
80
		if ($proxy !== null) {
81
			$defaults[RequestOptions::PROXY] = $proxy;
82
		}
83
84
		$options = array_merge($defaults, $options);
85
86
		if (!isset($options[RequestOptions::HEADERS]['User-Agent'])) {
87
			$options[RequestOptions::HEADERS]['User-Agent'] = 'Nextcloud Server Crawler';
88
		}
89
90
		return $options;
91
	}
92
93
	private function getCertBundle(): string {
94
		if ($this->certificateManager->listCertificates() !== []) {
95
			return $this->certificateManager->getAbsoluteBundlePath();
96
		}
97
98
		// If the instance is not yet setup we need to use the static path as
99
		// $this->certificateManager->getAbsoluteBundlePath() tries to instantiiate
100
		// a view
101
		if ($this->config->getSystemValue('installed', false)) {
102
			return $this->certificateManager->getAbsoluteBundlePath(null);
103
		}
104
105
		return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
106
	}
107
108
	/**
109
	 * Returns a null or an associative array specifiying the proxy URI for
110
	 * 'http' and 'https' schemes, in addition to a 'no' key value pair
111
	 * providing a list of host names that should not be proxied to.
112
	 *
113
	 * @return array|null
114
	 *
115
	 * The return array looks like:
116
	 * [
117
	 *   'http' => 'username:[email protected]',
118
	 *   'https' => 'username:[email protected]',
119
	 *   'no' => ['foo.com', 'bar.com']
120
	 * ]
121
	 *
122
	 */
123
	private function getProxyUri(): ?array {
124
		$proxyHost = $this->config->getSystemValue('proxy', '');
125
126
		if ($proxyHost === '' || $proxyHost === null) {
127
			return null;
128
		}
129
130
		$proxyUserPwd = $this->config->getSystemValue('proxyuserpwd', '');
131
		if ($proxyUserPwd !== '' && $proxyUserPwd !== null) {
132
			$proxyHost = $proxyUserPwd . '@' . $proxyHost;
133
		}
134
135
		$proxy = [
136
			'http' => $proxyHost,
137
			'https' => $proxyHost,
138
		];
139
140
		$proxyExclude = $this->config->getSystemValue('proxyexclude', []);
141
		if ($proxyExclude !== [] && $proxyExclude !== null) {
142
			$proxy['no'] = $proxyExclude;
143
		}
144
145
		return $proxy;
146
	}
147
148
	protected function preventLocalAddress(string $uri, array $options): void {
149
		if (($options['nextcloud']['allow_local_address'] ?? false) ||
150
			$this->config->getSystemValueBool('allow_local_remote_servers', false)) {
151
			return;
152
		}
153
154
		$host = parse_url($uri, PHP_URL_HOST);
155
		if ($host === false) {
156
			$this->logger->warning("Could not detect any host in $uri");
157
			throw new LocalServerException('Could not detect any host');
158
		}
159
160
		$host = strtolower($host);
161
		// remove brackets from IPv6 addresses
162
		if (strpos($host, '[') === 0 && substr($host, -1) === ']') {
163
			$host = substr($host, 1, -1);
164
		}
165
166
		// Disallow localhost and local network
167
		if ($host === 'localhost' || substr($host, -6) === '.local' || substr($host, -10) === '.localhost') {
168
			$this->logger->warning("Host $host was not connected to because it violates local access rules");
169
			throw new LocalServerException('Host violates local access rules');
170
		}
171
172
		// Disallow hostname only
173
		if (substr_count($host, '.') === 0) {
174
			$this->logger->warning("Host $host was not connected to because it violates local access rules");
175
			throw new LocalServerException('Host violates local access rules');
176
		}
177
178
		if ((bool)filter_var($host, FILTER_VALIDATE_IP) && !filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
179
			$this->logger->warning("Host $host was not connected to because it violates local access rules");
180
			throw new LocalServerException('Host violates local access rules');
181
		}
182
183
		// Also check for IPv6 IPv4 nesting, because that's not covered by filter_var
184
		if ((bool)filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) && substr_count($host, '.') > 0) {
185
			$delimiter = strrpos($host, ':'); // Get last colon
186
			$ipv4Address = substr($host, $delimiter + 1);
187
188
			if (!filter_var($ipv4Address, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
189
				$this->logger->warning("Host $host was not connected to because it violates local access rules");
190
				throw new LocalServerException('Host violates local access rules');
191
			}
192
		}
193
	}
194
195
	/**
196
	 * Sends a GET request
197
	 *
198
	 * @param string $uri
199
	 * @param array $options Array such as
200
	 *              'query' => [
201
	 *                  'field' => 'abc',
202
	 *                  'other_field' => '123',
203
	 *                  'file_name' => fopen('/path/to/file', 'r'),
204
	 *              ],
205
	 *              'headers' => [
206
	 *                  'foo' => 'bar',
207
	 *              ],
208
	 *              'cookies' => ['
209
	 *                  'foo' => 'bar',
210
	 *              ],
211
	 *              'allow_redirects' => [
212
	 *                   'max'       => 10,  // allow at most 10 redirects.
213
	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
214
	 *                   'referer'   => true,     // add a Referer header
215
	 *                   'protocols' => ['https'] // only allow https URLs
216
	 *              ],
217
	 *              'save_to' => '/path/to/file', // save to a file or a stream
218
	 *              'verify' => true, // bool or string to CA file
219
	 *              'debug' => true,
220
	 *              'timeout' => 5,
221
	 * @return IResponse
222
	 * @throws \Exception If the request could not get completed
223
	 */
224
	public function get(string $uri, array $options = []): IResponse {
225
		$this->preventLocalAddress($uri, $options);
226
		$response = $this->client->request('get', $uri, $this->buildRequestOptions($options));
227
		$isStream = isset($options['stream']) && $options['stream'];
228
		return new Response($response, $isStream);
229
	}
230
231
	/**
232
	 * Sends a HEAD request
233
	 *
234
	 * @param string $uri
235
	 * @param array $options Array such as
236
	 *              'headers' => [
237
	 *                  'foo' => 'bar',
238
	 *              ],
239
	 *              'cookies' => ['
240
	 *                  'foo' => 'bar',
241
	 *              ],
242
	 *              'allow_redirects' => [
243
	 *                   'max'       => 10,  // allow at most 10 redirects.
244
	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
245
	 *                   'referer'   => true,     // add a Referer header
246
	 *                   'protocols' => ['https'] // only allow https URLs
247
	 *              ],
248
	 *              'save_to' => '/path/to/file', // save to a file or a stream
249
	 *              'verify' => true, // bool or string to CA file
250
	 *              'debug' => true,
251
	 *              'timeout' => 5,
252
	 * @return IResponse
253
	 * @throws \Exception If the request could not get completed
254
	 */
255
	public function head(string $uri, array $options = []): IResponse {
256
		$this->preventLocalAddress($uri, $options);
257
		$response = $this->client->request('head', $uri, $this->buildRequestOptions($options));
258
		return new Response($response);
259
	}
260
261
	/**
262
	 * Sends a POST request
263
	 *
264
	 * @param string $uri
265
	 * @param array $options Array such as
266
	 *              'body' => [
267
	 *                  'field' => 'abc',
268
	 *                  'other_field' => '123',
269
	 *                  'file_name' => fopen('/path/to/file', 'r'),
270
	 *              ],
271
	 *              'headers' => [
272
	 *                  'foo' => 'bar',
273
	 *              ],
274
	 *              'cookies' => ['
275
	 *                  'foo' => 'bar',
276
	 *              ],
277
	 *              'allow_redirects' => [
278
	 *                   'max'       => 10,  // allow at most 10 redirects.
279
	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
280
	 *                   'referer'   => true,     // add a Referer header
281
	 *                   'protocols' => ['https'] // only allow https URLs
282
	 *              ],
283
	 *              'save_to' => '/path/to/file', // save to a file or a stream
284
	 *              'verify' => true, // bool or string to CA file
285
	 *              'debug' => true,
286
	 *              'timeout' => 5,
287
	 * @return IResponse
288
	 * @throws \Exception If the request could not get completed
289
	 */
290
	public function post(string $uri, array $options = []): IResponse {
291
		$this->preventLocalAddress($uri, $options);
292
293
		if (isset($options['body']) && is_array($options['body'])) {
294
			$options['form_params'] = $options['body'];
295
			unset($options['body']);
296
		}
297
		$response = $this->client->request('post', $uri, $this->buildRequestOptions($options));
298
		return new Response($response);
299
	}
300
301
	/**
302
	 * Sends a PUT request
303
	 *
304
	 * @param string $uri
305
	 * @param array $options Array such as
306
	 *              'body' => [
307
	 *                  'field' => 'abc',
308
	 *                  'other_field' => '123',
309
	 *                  'file_name' => fopen('/path/to/file', 'r'),
310
	 *              ],
311
	 *              'headers' => [
312
	 *                  'foo' => 'bar',
313
	 *              ],
314
	 *              'cookies' => ['
315
	 *                  'foo' => 'bar',
316
	 *              ],
317
	 *              'allow_redirects' => [
318
	 *                   'max'       => 10,  // allow at most 10 redirects.
319
	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
320
	 *                   'referer'   => true,     // add a Referer header
321
	 *                   'protocols' => ['https'] // only allow https URLs
322
	 *              ],
323
	 *              'save_to' => '/path/to/file', // save to a file or a stream
324
	 *              'verify' => true, // bool or string to CA file
325
	 *              'debug' => true,
326
	 *              'timeout' => 5,
327
	 * @return IResponse
328
	 * @throws \Exception If the request could not get completed
329
	 */
330
	public function put(string $uri, array $options = []): IResponse {
331
		$this->preventLocalAddress($uri, $options);
332
		$response = $this->client->request('put', $uri, $this->buildRequestOptions($options));
333
		return new Response($response);
334
	}
335
336
	/**
337
	 * Sends a DELETE request
338
	 *
339
	 * @param string $uri
340
	 * @param array $options Array such as
341
	 *              'body' => [
342
	 *                  'field' => 'abc',
343
	 *                  'other_field' => '123',
344
	 *                  'file_name' => fopen('/path/to/file', 'r'),
345
	 *              ],
346
	 *              'headers' => [
347
	 *                  'foo' => 'bar',
348
	 *              ],
349
	 *              'cookies' => ['
350
	 *                  'foo' => 'bar',
351
	 *              ],
352
	 *              'allow_redirects' => [
353
	 *                   'max'       => 10,  // allow at most 10 redirects.
354
	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
355
	 *                   'referer'   => true,     // add a Referer header
356
	 *                   'protocols' => ['https'] // only allow https URLs
357
	 *              ],
358
	 *              'save_to' => '/path/to/file', // save to a file or a stream
359
	 *              'verify' => true, // bool or string to CA file
360
	 *              'debug' => true,
361
	 *              'timeout' => 5,
362
	 * @return IResponse
363
	 * @throws \Exception If the request could not get completed
364
	 */
365
	public function delete(string $uri, array $options = []): IResponse {
366
		$this->preventLocalAddress($uri, $options);
367
		$response = $this->client->request('delete', $uri, $this->buildRequestOptions($options));
368
		return new Response($response);
369
	}
370
371
	/**
372
	 * Sends a options request
373
	 *
374
	 * @param string $uri
375
	 * @param array $options Array such as
376
	 *              'body' => [
377
	 *                  'field' => 'abc',
378
	 *                  'other_field' => '123',
379
	 *                  'file_name' => fopen('/path/to/file', 'r'),
380
	 *              ],
381
	 *              'headers' => [
382
	 *                  'foo' => 'bar',
383
	 *              ],
384
	 *              'cookies' => ['
385
	 *                  'foo' => 'bar',
386
	 *              ],
387
	 *              'allow_redirects' => [
388
	 *                   'max'       => 10,  // allow at most 10 redirects.
389
	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
390
	 *                   'referer'   => true,     // add a Referer header
391
	 *                   'protocols' => ['https'] // only allow https URLs
392
	 *              ],
393
	 *              'save_to' => '/path/to/file', // save to a file or a stream
394
	 *              'verify' => true, // bool or string to CA file
395
	 *              'debug' => true,
396
	 *              'timeout' => 5,
397
	 * @return IResponse
398
	 * @throws \Exception If the request could not get completed
399
	 */
400
	public function options(string $uri, array $options = []): IResponse {
401
		$this->preventLocalAddress($uri, $options);
402
		$response = $this->client->request('options', $uri, $this->buildRequestOptions($options));
403
		return new Response($response);
404
	}
405
}
406