OC\Installer::downloadApp()

Complexity

Conditions	19
Paths	94

Size

Total Lines	169
Code Lines	106

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

<?php
	public function downloadApp($appId, $allowUnstable = false) {
		$appId = strtolower($appId);

		$apps = $this->appFetcher->get($allowUnstable);
		foreach ($apps as $app) {
			if ($app['id'] === $appId) {
				// Load the certificate
				$certificate = new X509();
				$rootCrt = file_get_contents(__DIR__ . '/../../resources/codesigning/root.crt');
				$rootCrts = $this->splitCerts($rootCrt);
				foreach ($rootCrts as $rootCrt) {
					$certificate->loadCA($rootCrt);
				}
				$loadedCertificate = $certificate->loadX509($app['certificate']);

				// Verify if the certificate has been revoked
				$crl = new X509();
				foreach ($rootCrts as $rootCrt) {
					$crl->loadCA($rootCrt);
				}
				$crl->loadCRL(file_get_contents(__DIR__ . '/../../resources/codesigning/root.crl'));
				if ($crl->validateSignature() !== true) {
					throw new \Exception('Could not validate CRL signature');
				}
				$csn = $loadedCertificate['tbsCertificate']['serialNumber']->toString();
				$revoked = $crl->getRevoked($csn);
				if ($revoked !== false) {
					throw new \Exception(
						sprintf(
							'Certificate "%s" has been revoked',
							$csn
						)
					);
				}

				// Verify if the certificate has been issued by the Nextcloud Code Authority CA
				if ($certificate->validateSignature() !== true) {
					throw new \Exception(
						sprintf(
							'App with id %s has a certificate not issued by a trusted Code Signing Authority',
							$appId
						)
					);
				}

				// Verify if the certificate is issued for the requested app id
				$certInfo = openssl_x509_parse($app['certificate']);
				if (!isset($certInfo['subject']['CN'])) {
					throw new \Exception(
						sprintf(
							'App with id %s has a cert with no CN',
							$appId
						)
					);
				}
				if ($certInfo['subject']['CN'] !== $appId) {
					throw new \Exception(
						sprintf(
							'App with id %s has a cert issued to %s',
							$appId,
							$certInfo['subject']['CN']
						)
					);
				}

				// Download the release
				$tempFile = $this->tempManager->getTemporaryFile('.tar.gz');
				$timeout = $this->isCLI ? 0 : 120;
				$client = $this->clientService->newClient();
				$client->get($app['releases'][0]['download'], ['sink' => $tempFile, 'timeout' => $timeout]);

				// Check if the signature actually matches the downloaded content
				$certificate = openssl_get_publickey($app['certificate']);
				$verified = (bool)openssl_verify(file_get_contents($tempFile), base64_decode($app['releases'][0]['signature']), $certificate, OPENSSL_ALGO_SHA512);
				openssl_free_key($certificate);

				if ($verified === true) {
					// Seems to match, let's proceed
					$extractDir = $this->tempManager->getTemporaryFolder();
					$archive = new TAR($tempFile);

					if ($archive) {
						if (!$archive->extract($extractDir)) {
							$errorMessage = 'Could not extract app ' . $appId;

							$archiveError = $archive->getError();
							if ($archiveError instanceof \PEAR_Error) {
								$errorMessage .= ': ' . $archiveError->getMessage();
							}

							throw new \Exception($errorMessage);
						}
						$allFiles = scandir($extractDir);
						$folders = array_diff($allFiles, ['.', '..']);
						$folders = array_values($folders);

						if (count($folders) > 1) {
							throw new \Exception(
								sprintf(
									'Extracted app %s has more than 1 folder',
									$appId
								)
							);
						}

						// Check if appinfo/info.xml has the same app ID as well
						$loadEntities = libxml_disable_entity_loader(false);
						$xml = simplexml_load_file($extractDir . '/' . $folders[0] . '/appinfo/info.xml');
						libxml_disable_entity_loader($loadEntities);
						if ((string)$xml->id !== $appId) {
							throw new \Exception(
								sprintf(
									'App for id %s has a wrong app ID in info.xml: %s',
									$appId,
									(string)$xml->id
								)
							);
						}

						// Check if the version is lower than before
						$currentVersion = OC_App::getAppVersion($appId);
						$newVersion = (string)$xml->version;
						if (version_compare($currentVersion, $newVersion) === 1) {
							throw new \Exception(
								sprintf(
									'App for id %s has version %s and tried to update to lower version %s',
									$appId,
									$currentVersion,
									$newVersion
								)
							);
						}

						$baseDir = OC_App::getInstallPath() . '/' . $appId;

Are you sure OC_App::getInstallPath() of type false|string can be used in concatenation?

						// Remove old app with the ID if existent
						OC_Helper::rmdirr($baseDir);
						// Move to app folder
						if (@mkdir($baseDir)) {
							$extractDir .= '/' . $folders[0];
							OC_Helper::copyr($extractDir, $baseDir);
						}
						OC_Helper::copyr($extractDir, $baseDir);
						OC_Helper::rmdirr($extractDir);
						return;
					} else {
						throw new \Exception(
							sprintf(
								'Could not extract app with ID %s to %s',
								$appId,
								$extractDir
							)
						);
					}
				} else {
					// Signature does not match
					throw new \Exception(
						sprintf(
							'App with id %s has invalid signature',
							$appId
						)
					);
				}
			}
		}

		throw new \Exception(
			sprintf(
				'Could not download app %s',
				$appId
			)