This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * ownCloud - files_antivirus |
||
4 | * |
||
5 | * This file is licensed under the Affero General Public License version 3 or |
||
6 | * later. See the COPYING file. |
||
7 | * |
||
8 | * @author Viktar Dubiniuk <[email protected]> |
||
9 | * |
||
10 | * @copyright Viktar Dubiniuk 2015-2018 |
||
11 | * @license AGPL-3.0 |
||
12 | */ |
||
13 | |||
14 | namespace OCA\Files_Antivirus; |
||
15 | |||
16 | use OCP\IL10N; |
||
17 | use OCA\Files_Antivirus\Status; |
||
18 | use OCA\Files_Antivirus\Activity; |
||
19 | |||
20 | class Item implements IScannable { |
||
21 | /** |
||
22 | * Scanned fileid (optional) |
||
23 | * |
||
24 | * @var int |
||
25 | */ |
||
26 | protected $id; |
||
27 | |||
28 | /** |
||
29 | * File view |
||
30 | * |
||
31 | * @var \OC\Files\View |
||
32 | */ |
||
33 | protected $view; |
||
34 | |||
35 | /** |
||
36 | * Path relative to the view |
||
37 | * |
||
38 | * @var string |
||
39 | */ |
||
40 | protected $path; |
||
41 | |||
42 | /** |
||
43 | * file handle, user to read from the file |
||
44 | * |
||
45 | * @var resource |
||
46 | */ |
||
47 | protected $fileHandle; |
||
48 | |||
49 | /** |
||
50 | * Portion size |
||
51 | * |
||
52 | * @var int |
||
53 | */ |
||
54 | protected $chunkSize; |
||
55 | |||
56 | /** |
||
57 | * Is filesize match the size conditions |
||
58 | * |
||
59 | * @var bool |
||
60 | */ |
||
61 | protected $isValidSize; |
||
62 | |||
63 | /** |
||
64 | * @var IL10N |
||
65 | */ |
||
66 | private $l10n; |
||
67 | |||
68 | 5 | public function __construct(IL10N $l10n, $view, $path, $id = null) { |
|
69 | 5 | $this->l10n = $l10n; |
|
70 | |||
71 | 5 | if (!\is_object($view)) { |
|
72 | $this->logError('Can\'t init filesystem view.', $id, $path); |
||
73 | throw new \RuntimeException(); |
||
74 | } |
||
75 | |||
76 | 5 | if (!$view->file_exists($path)) { |
|
77 | 1 | $this->logError('File does not exist.', $id, $path); |
|
78 | 1 | throw new \RuntimeException(); |
|
79 | } |
||
80 | |||
81 | 5 | if ($id === null) { |
|
82 | 1 | $this->id = $view->getFileInfo($path)->getId(); |
|
83 | } else { |
||
84 | 4 | $this->id = $id; |
|
85 | } |
||
86 | |||
87 | 5 | $this->view = $view; |
|
88 | 5 | $this->path = $path; |
|
89 | |||
90 | 5 | $this->isValidSize = $view->filesize($path) > 0; |
|
91 | |||
92 | 5 | $application = new AppInfo\Application(); |
|
93 | 5 | $config = $application->getContainer()->query('AppConfig'); |
|
94 | 5 | $this->chunkSize = $config->getAvChunkSize(); |
|
95 | 5 | } |
|
96 | |||
97 | /** |
||
98 | * Is this file good for scanning? |
||
99 | * |
||
100 | * @return boolean |
||
101 | */ |
||
102 | 3 | public function isValid() { |
|
103 | 3 | $isValid = !$this->view->is_dir($this->path) && $this->isValidSize; |
|
104 | 3 | return $isValid; |
|
105 | } |
||
106 | |||
107 | /** |
||
108 | * Reads a file portion by portion until the very end |
||
109 | * |
||
110 | * @return string|boolean |
||
111 | */ |
||
112 | 3 | public function fread() { |
|
113 | 3 | if (!$this->isValid()) { |
|
114 | return; |
||
115 | } |
||
116 | 3 | if ($this->fileHandle === null) { |
|
117 | 3 | $this->getFileHandle(); |
|
118 | } |
||
119 | |||
120 | 3 | if ($this->fileHandle !== null && !$this->feof()) { |
|
121 | 3 | $chunk = \fread($this->fileHandle, $this->chunkSize); |
|
122 | 3 | return $chunk; |
|
123 | } |
||
124 | 2 | return false; |
|
125 | } |
||
126 | |||
127 | /** |
||
128 | * Action to take if this item is infected |
||
129 | * |
||
130 | * @param Status $status |
||
131 | * @param boolean $isBackground |
||
132 | */ |
||
133 | public function processInfected(Status $status, $isBackground) { |
||
134 | $application = new AppInfo\Application(); |
||
135 | $appConfig = $application->getContainer()->query('AppConfig'); |
||
136 | $infectedAction = $appConfig->getAvInfectedAction(); |
||
137 | |||
138 | $shouldDelete = !$isBackground || ($isBackground && $infectedAction === 'delete'); |
||
139 | |||
140 | $message = $shouldDelete ? Activity::MESSAGE_FILE_DELETED : ''; |
||
141 | |||
142 | \OC::$server->getActivityManager()->publishActivity( |
||
143 | 'files_antivirus', |
||
144 | Activity::SUBJECT_VIRUS_DETECTED, |
||
145 | [$this->path, $status->getDetails()], |
||
146 | $message, |
||
147 | [], |
||
148 | $this->path, |
||
149 | '', |
||
150 | $this->view->getOwner($this->path), |
||
151 | Activity::TYPE_VIRUS_DETECTED, |
||
152 | Activity::PRIORITY_HIGH |
||
153 | ); |
||
154 | if ($isBackground) { |
||
155 | if ($shouldDelete) { |
||
156 | $this->logError('Infected file deleted. ' . $status->getDetails()); |
||
157 | $this->view->unlink($this->path); |
||
158 | } else { |
||
159 | $this->logError('File is infected. ' . $status->getDetails()); |
||
160 | } |
||
161 | } else { |
||
162 | $this->logError('Virus(es) found: ' . $status->getDetails()); |
||
163 | //remove file |
||
164 | $this->view->unlink($this->path); |
||
165 | Notification::sendMail($this->path); |
||
166 | $message = $this->l10n->t( |
||
167 | "Virus detected! Can't upload the file %s", |
||
168 | [\basename($this->path)] |
||
169 | ); |
||
170 | \OCP\JSON::error(["data" => ["message" => $message]]); |
||
171 | exit(); |
||
172 | } |
||
173 | } |
||
174 | |||
175 | /** |
||
176 | * Action to take if this item status is unclear |
||
177 | * |
||
178 | * @param Status $status |
||
179 | * @param boolean $isBackground |
||
180 | */ |
||
181 | public function processUnchecked(Status $status, $isBackground) { |
||
0 ignored issues
–
show
|
|||
182 | //TODO: Show warning to the user: The file can not be checked |
||
183 | $this->logError('Not Checked. ' . $status->getDetails()); |
||
184 | } |
||
185 | |||
186 | /** |
||
187 | * Action to take if this item status is not infected |
||
188 | * |
||
189 | * @param Status $status |
||
190 | * @param boolean $isBackground |
||
191 | */ |
||
192 | public function processClean(Status $status, $isBackground) { |
||
0 ignored issues
–
show
|
|||
193 | if (!$isBackground) { |
||
194 | return; |
||
195 | } |
||
196 | try { |
||
197 | $stmt = \OCP\DB::prepare('DELETE FROM `*PREFIX*files_antivirus` WHERE `fileid` = ?'); |
||
198 | $result = $stmt->execute([$this->id]); |
||
199 | if (\OCP\DB::isError($result)) { |
||
200 | //TODO: Use logger |
||
201 | $this->logError(__METHOD__. ', DB error: ' . \OCP\DB::getErrorMessage()); |
||
202 | } |
||
203 | $stmt = \OCP\DB::prepare( |
||
204 | 'INSERT INTO `*PREFIX*files_antivirus` (`fileid`, `check_time`) VALUES (?, ?)' |
||
205 | ); |
||
206 | $result = $stmt->execute([$this->id, \time()]); |
||
207 | if (\OCP\DB::isError($result)) { |
||
208 | $this->logError(__METHOD__. ', DB error: ' . \OCP\DB::getErrorMessage()); |
||
209 | } |
||
210 | } catch (\Exception $e) { |
||
211 | \OCP\Util::writeLog( |
||
212 | 'files_antivirus', |
||
213 | __METHOD__ . ', exception: ' . $e->getMessage(), |
||
214 | \OCP\Util::ERROR |
||
215 | ); |
||
216 | } |
||
217 | } |
||
218 | |||
219 | /** |
||
220 | * Check if the end of file is reached |
||
221 | * |
||
222 | * @return boolean |
||
223 | */ |
||
224 | 3 | private function feof() { |
|
225 | 3 | $isDone = \feof($this->fileHandle); |
|
226 | 3 | if ($isDone) { |
|
227 | 2 | $this->logDebug('Scan is done'); |
|
228 | 2 | \fclose($this->fileHandle); |
|
229 | 2 | $this->fileHandle = null; |
|
230 | } |
||
231 | 3 | return $isDone; |
|
232 | } |
||
233 | |||
234 | /** |
||
235 | * Opens a file for reading |
||
236 | * |
||
237 | * @throws \RuntimeException |
||
238 | */ |
||
239 | 3 | private function getFileHandle() { |
|
240 | 3 | $fileHandle = $this->view->fopen($this->path, "r"); |
|
241 | 3 | if ($fileHandle === false) { |
|
242 | $this->logError('Can not open for reading.', $this->id, $this->path); |
||
243 | throw new \RuntimeException(); |
||
244 | } else { |
||
245 | 3 | $this->logDebug('Scan started'); |
|
246 | 3 | $this->fileHandle = $fileHandle; |
|
247 | } |
||
248 | 3 | } |
|
249 | |||
250 | /** |
||
251 | * @param string $message |
||
252 | */ |
||
253 | 3 | public function logDebug($message) { |
|
254 | 3 | $extra = ' File: ' . $this->id |
|
255 | 3 | . ' Account: ' . $this->view->getOwner($this->path) |
|
256 | 3 | . ' Path: ' . $this->path; |
|
257 | 3 | \OCP\Util::writeLog('files_antivirus', $message . $extra, \OCP\Util::DEBUG); |
|
258 | 3 | } |
|
259 | |||
260 | /** |
||
261 | * @param string $message |
||
262 | * @param int $id optional |
||
263 | * @param string $path optional |
||
264 | */ |
||
265 | 1 | public function logError($message, $id=null, $path=null) { |
|
266 | 1 | $ownerInfo = $this->view === null ? '' : ' Account: ' . $this->view->getOwner($path); |
|
267 | 1 | $extra = ' File: ' . ($id === null ? $this->id : $id) |
|
268 | 1 | . $ownerInfo |
|
269 | 1 | . ' Path: ' . ($path === null ? $this->path : $path); |
|
270 | 1 | \OCP\Util::writeLog( |
|
271 | 1 | 'files_antivirus', |
|
272 | 1 | $message . $extra, |
|
273 | 1 | \OCP\Util::ERROR |
|
274 | ); |
||
275 | 1 | } |
|
276 | } |
||
277 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.