This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * HTTP API: WP_Http_Encoding class |
||
| 4 | * |
||
| 5 | * @package WordPress |
||
| 6 | * @subpackage HTTP |
||
| 7 | * @since 4.4.0 |
||
| 8 | */ |
||
| 9 | |||
| 10 | /** |
||
| 11 | * Core class used to implement deflate and gzip transfer encoding support for HTTP requests. |
||
| 12 | * |
||
| 13 | * Includes RFC 1950, RFC 1951, and RFC 1952. |
||
| 14 | * |
||
| 15 | * @since 2.8.0 |
||
| 16 | */ |
||
| 17 | class WP_Http_Encoding { |
||
| 18 | |||
| 19 | /** |
||
| 20 | * Compress raw string using the deflate format. |
||
| 21 | * |
||
| 22 | * Supports the RFC 1951 standard. |
||
| 23 | * |
||
| 24 | * @since 2.8.0 |
||
| 25 | * |
||
| 26 | * @static |
||
| 27 | * |
||
| 28 | * @param string $raw String to compress. |
||
| 29 | * @param int $level Optional, default is 9. Compression level, 9 is highest. |
||
| 30 | * @param string $supports Optional, not used. When implemented it will choose the right compression based on what the server supports. |
||
| 31 | * @return string|false False on failure. |
||
| 32 | */ |
||
| 33 | public static function compress( $raw, $level = 9, $supports = null ) { |
||
|
0 ignored issues
–
show
|
|||
| 34 | return gzdeflate( $raw, $level ); |
||
| 35 | } |
||
| 36 | |||
| 37 | /** |
||
| 38 | * Decompression of deflated string. |
||
| 39 | * |
||
| 40 | * Will attempt to decompress using the RFC 1950 standard, and if that fails |
||
| 41 | * then the RFC 1951 standard deflate will be attempted. Finally, the RFC |
||
| 42 | * 1952 standard gzip decode will be attempted. If all fail, then the |
||
| 43 | * original compressed string will be returned. |
||
| 44 | * |
||
| 45 | * @since 2.8.0 |
||
| 46 | * |
||
| 47 | * @static |
||
| 48 | * |
||
| 49 | * @param string $compressed String to decompress. |
||
| 50 | * @param int $length The optional length of the compressed data. |
||
| 51 | * @return string|bool False on failure. |
||
| 52 | */ |
||
| 53 | public static function decompress( $compressed, $length = null ) { |
||
|
0 ignored issues
–
show
|
|||
| 54 | |||
| 55 | if ( empty($compressed) ) |
||
| 56 | return $compressed; |
||
| 57 | |||
| 58 | if ( false !== ( $decompressed = @gzinflate( $compressed ) ) ) |
||
| 59 | return $decompressed; |
||
| 60 | |||
| 61 | if ( false !== ( $decompressed = self::compatible_gzinflate( $compressed ) ) ) |
||
| 62 | return $decompressed; |
||
| 63 | |||
| 64 | if ( false !== ( $decompressed = @gzuncompress( $compressed ) ) ) |
||
| 65 | return $decompressed; |
||
| 66 | |||
| 67 | if ( function_exists('gzdecode') ) { |
||
| 68 | $decompressed = @gzdecode( $compressed ); |
||
| 69 | |||
| 70 | if ( false !== $decompressed ) |
||
| 71 | return $decompressed; |
||
| 72 | } |
||
| 73 | |||
| 74 | return $compressed; |
||
| 75 | } |
||
| 76 | |||
| 77 | /** |
||
| 78 | * Decompression of deflated string while staying compatible with the majority of servers. |
||
| 79 | * |
||
| 80 | * Certain Servers will return deflated data with headers which PHP's gzinflate() |
||
| 81 | * function cannot handle out of the box. The following function has been created from |
||
| 82 | * various snippets on the gzinflate() PHP documentation. |
||
| 83 | * |
||
| 84 | * Warning: Magic numbers within. Due to the potential different formats that the compressed |
||
| 85 | * data may be returned in, some "magic offsets" are needed to ensure proper decompression |
||
| 86 | * takes place. For a simple progmatic way to determine the magic offset in use, see: |
||
| 87 | * https://core.trac.wordpress.org/ticket/18273 |
||
| 88 | * |
||
| 89 | * @since 2.8.1 |
||
| 90 | * @link https://core.trac.wordpress.org/ticket/18273 |
||
| 91 | * @link https://secure.php.net/manual/en/function.gzinflate.php#70875 |
||
| 92 | * @link https://secure.php.net/manual/en/function.gzinflate.php#77336 |
||
| 93 | * |
||
| 94 | * @static |
||
| 95 | * |
||
| 96 | * @param string $gzData String to decompress. |
||
| 97 | * @return string|bool False on failure. |
||
| 98 | */ |
||
| 99 | public static function compatible_gzinflate($gzData) { |
||
| 100 | |||
| 101 | // Compressed data might contain a full header, if so strip it for gzinflate(). |
||
| 102 | View Code Duplication | if ( substr($gzData, 0, 3) == "\x1f\x8b\x08" ) { |
|
| 103 | $i = 10; |
||
| 104 | $flg = ord( substr($gzData, 3, 1) ); |
||
| 105 | if ( $flg > 0 ) { |
||
| 106 | if ( $flg & 4 ) { |
||
| 107 | list($xlen) = unpack('v', substr($gzData, $i, 2) ); |
||
| 108 | $i = $i + 2 + $xlen; |
||
| 109 | } |
||
| 110 | if ( $flg & 8 ) |
||
| 111 | $i = strpos($gzData, "\0", $i) + 1; |
||
| 112 | if ( $flg & 16 ) |
||
| 113 | $i = strpos($gzData, "\0", $i) + 1; |
||
| 114 | if ( $flg & 2 ) |
||
| 115 | $i = $i + 2; |
||
| 116 | } |
||
| 117 | $decompressed = @gzinflate( substr($gzData, $i, -8) ); |
||
| 118 | if ( false !== $decompressed ) |
||
| 119 | return $decompressed; |
||
| 120 | } |
||
| 121 | |||
| 122 | // Compressed data from java.util.zip.Deflater amongst others. |
||
| 123 | $decompressed = @gzinflate( substr($gzData, 2) ); |
||
| 124 | if ( false !== $decompressed ) |
||
| 125 | return $decompressed; |
||
| 126 | |||
| 127 | return false; |
||
| 128 | } |
||
| 129 | |||
| 130 | /** |
||
| 131 | * What encoding types to accept and their priority values. |
||
| 132 | * |
||
| 133 | * @since 2.8.0 |
||
| 134 | * |
||
| 135 | * @static |
||
| 136 | * |
||
| 137 | * @param string $url |
||
| 138 | * @param array $args |
||
| 139 | * @return string Types of encoding to accept. |
||
| 140 | */ |
||
| 141 | public static function accept_encoding( $url, $args ) { |
||
| 142 | $type = array(); |
||
| 143 | $compression_enabled = self::is_available(); |
||
| 144 | |||
| 145 | if ( ! $args['decompress'] ) // Decompression specifically disabled. |
||
| 146 | $compression_enabled = false; |
||
| 147 | elseif ( $args['stream'] ) // Disable when streaming to file. |
||
| 148 | $compression_enabled = false; |
||
| 149 | elseif ( isset( $args['limit_response_size'] ) ) // If only partial content is being requested, we won't be able to decompress it. |
||
| 150 | $compression_enabled = false; |
||
| 151 | |||
| 152 | if ( $compression_enabled ) { |
||
| 153 | if ( function_exists( 'gzinflate' ) ) |
||
| 154 | $type[] = 'deflate;q=1.0'; |
||
| 155 | |||
| 156 | if ( function_exists( 'gzuncompress' ) ) |
||
| 157 | $type[] = 'compress;q=0.5'; |
||
| 158 | |||
| 159 | if ( function_exists( 'gzdecode' ) ) |
||
| 160 | $type[] = 'gzip;q=0.5'; |
||
| 161 | } |
||
| 162 | |||
| 163 | /** |
||
| 164 | * Filters the allowed encoding types. |
||
| 165 | * |
||
| 166 | * @since 3.6.0 |
||
| 167 | * |
||
| 168 | * @param array $type Encoding types allowed. Accepts 'gzinflate', |
||
| 169 | * 'gzuncompress', 'gzdecode'. |
||
| 170 | * @param string $url URL of the HTTP request. |
||
| 171 | * @param array $args HTTP request arguments. |
||
| 172 | */ |
||
| 173 | $type = apply_filters( 'wp_http_accept_encoding', $type, $url, $args ); |
||
| 174 | |||
| 175 | return implode(', ', $type); |
||
| 176 | } |
||
| 177 | |||
| 178 | /** |
||
| 179 | * What encoding the content used when it was compressed to send in the headers. |
||
| 180 | * |
||
| 181 | * @since 2.8.0 |
||
| 182 | * |
||
| 183 | * @static |
||
| 184 | * |
||
| 185 | * @return string Content-Encoding string to send in the header. |
||
| 186 | */ |
||
| 187 | public static function content_encoding() { |
||
| 188 | return 'deflate'; |
||
| 189 | } |
||
| 190 | |||
| 191 | /** |
||
| 192 | * Whether the content be decoded based on the headers. |
||
| 193 | * |
||
| 194 | * @since 2.8.0 |
||
| 195 | * |
||
| 196 | * @static |
||
| 197 | * |
||
| 198 | * @param array|string $headers All of the available headers. |
||
| 199 | * @return bool |
||
| 200 | */ |
||
| 201 | public static function should_decode($headers) { |
||
| 202 | if ( is_array( $headers ) ) { |
||
| 203 | if ( array_key_exists('content-encoding', $headers) && ! empty( $headers['content-encoding'] ) ) |
||
| 204 | return true; |
||
| 205 | } elseif ( is_string( $headers ) ) { |
||
| 206 | return ( stripos($headers, 'content-encoding:') !== false ); |
||
| 207 | } |
||
| 208 | |||
| 209 | return false; |
||
| 210 | } |
||
| 211 | |||
| 212 | /** |
||
| 213 | * Whether decompression and compression are supported by the PHP version. |
||
| 214 | * |
||
| 215 | * Each function is tested instead of checking for the zlib extension, to |
||
| 216 | * ensure that the functions all exist in the PHP version and aren't |
||
| 217 | * disabled. |
||
| 218 | * |
||
| 219 | * @since 2.8.0 |
||
| 220 | * |
||
| 221 | * @static |
||
| 222 | * |
||
| 223 | * @return bool |
||
| 224 | */ |
||
| 225 | public static function is_available() { |
||
| 226 | return ( function_exists('gzuncompress') || function_exists('gzdeflate') || function_exists('gzinflate') ); |
||
| 227 | } |
||
| 228 | } |
||
| 229 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.