wikimedia /
mediawiki
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * |
||
| 4 | * |
||
| 5 | * Created on Sep 19, 2006 |
||
| 6 | * |
||
| 7 | * Copyright © 2006 Yuri Astrakhan "<Firstname><Lastname>@gmail.com" |
||
| 8 | * |
||
| 9 | * This program is free software; you can redistribute it and/or modify |
||
| 10 | * it under the terms of the GNU General Public License as published by |
||
| 11 | * the Free Software Foundation; either version 2 of the License, or |
||
| 12 | * (at your option) any later version. |
||
| 13 | * |
||
| 14 | * This program is distributed in the hope that it will be useful, |
||
| 15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 17 | * GNU General Public License for more details. |
||
| 18 | * |
||
| 19 | * You should have received a copy of the GNU General Public License along |
||
| 20 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
| 21 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
| 22 | * http://www.gnu.org/copyleft/gpl.html |
||
| 23 | * |
||
| 24 | * @file |
||
| 25 | */ |
||
| 26 | |||
| 27 | /** |
||
| 28 | * API XML output formatter |
||
| 29 | * @ingroup API |
||
| 30 | */ |
||
| 31 | class ApiFormatXml extends ApiFormatBase { |
||
| 32 | |||
| 33 | private $mRootElemName = 'api'; |
||
| 34 | public static $namespace = 'http://www.mediawiki.org/xml/api/'; |
||
| 35 | private $mIncludeNamespace = false; |
||
| 36 | private $mXslt = null; |
||
| 37 | |||
| 38 | public function getMimeType() { |
||
| 39 | return 'text/xml'; |
||
| 40 | } |
||
| 41 | |||
| 42 | public function setRootElement( $rootElemName ) { |
||
| 43 | $this->mRootElemName = $rootElemName; |
||
| 44 | } |
||
| 45 | |||
| 46 | public function execute() { |
||
| 47 | $params = $this->extractRequestParams(); |
||
| 48 | $this->mIncludeNamespace = $params['includexmlnamespace']; |
||
| 49 | $this->mXslt = $params['xslt']; |
||
| 50 | |||
| 51 | $this->printText( '<?xml version="1.0"?>' ); |
||
| 52 | if ( !is_null( $this->mXslt ) ) { |
||
| 53 | $this->addXslt(); |
||
| 54 | } |
||
| 55 | |||
| 56 | $result = $this->getResult(); |
||
| 57 | if ( $this->mIncludeNamespace && $result->getResultData( 'xmlns' ) === null ) { |
||
| 58 | // If the result data already contains an 'xmlns' namespace added |
||
| 59 | // for custom XML output types, it will override the one for the |
||
| 60 | // generic API results. |
||
| 61 | // This allows API output of other XML types like Atom, RSS, RSD. |
||
| 62 | $result->addValue( null, 'xmlns', self::$namespace, ApiResult::NO_SIZE_CHECK ); |
||
| 63 | } |
||
| 64 | $data = $result->getResultData( null, [ |
||
|
0 ignored issues
–
show
|
|||
| 65 | 'Custom' => function ( &$data, &$metadata ) { |
||
| 66 | if ( isset( $metadata[ApiResult::META_TYPE] ) ) { |
||
| 67 | // We want to use non-BC for BCassoc to force outputting of _idx. |
||
| 68 | switch ( $metadata[ApiResult::META_TYPE] ) { |
||
| 69 | case 'BCassoc': |
||
| 70 | $metadata[ApiResult::META_TYPE] = 'assoc'; |
||
| 71 | break; |
||
| 72 | } |
||
| 73 | } |
||
| 74 | }, |
||
| 75 | 'BC' => [ 'nobool', 'no*', 'nosub' ], |
||
| 76 | 'Types' => [ 'ArmorKVP' => '_name' ], |
||
| 77 | ] ); |
||
| 78 | |||
| 79 | $this->printText( |
||
| 80 | static::recXmlPrint( $this->mRootElemName, |
||
| 81 | $data, |
||
| 82 | $this->getIsHtml() ? -2 : null |
||
| 83 | ) |
||
| 84 | ); |
||
| 85 | } |
||
| 86 | |||
| 87 | /** |
||
| 88 | * This method takes an array and converts it to XML. |
||
| 89 | * |
||
| 90 | * @param string|null $name Tag name |
||
| 91 | * @param mixed $value Tag value (attributes/content/subelements) |
||
| 92 | * @param int|null $indent Indentation |
||
| 93 | * @param array $attributes Additional attributes |
||
| 94 | * @return string |
||
| 95 | */ |
||
| 96 | public static function recXmlPrint( $name, $value, $indent, $attributes = [] ) { |
||
| 97 | $retval = ''; |
||
| 98 | if ( $indent !== null ) { |
||
| 99 | if ( $name !== null ) { |
||
| 100 | $indent += 2; |
||
| 101 | } |
||
| 102 | $indstr = "\n" . str_repeat( ' ', $indent ); |
||
| 103 | } else { |
||
| 104 | $indstr = ''; |
||
| 105 | } |
||
| 106 | |||
| 107 | if ( is_object( $value ) ) { |
||
| 108 | $value = (array)$value; |
||
| 109 | } |
||
| 110 | if ( is_array( $value ) ) { |
||
| 111 | $contentKey = isset( $value[ApiResult::META_CONTENT] ) |
||
| 112 | ? $value[ApiResult::META_CONTENT] |
||
| 113 | : '*'; |
||
| 114 | $subelementKeys = isset( $value[ApiResult::META_SUBELEMENTS] ) |
||
| 115 | ? $value[ApiResult::META_SUBELEMENTS] |
||
| 116 | : []; |
||
| 117 | if ( isset( $value[ApiResult::META_BC_SUBELEMENTS] ) ) { |
||
| 118 | $subelementKeys = array_merge( |
||
| 119 | $subelementKeys, $value[ApiResult::META_BC_SUBELEMENTS] |
||
| 120 | ); |
||
| 121 | } |
||
| 122 | $preserveKeys = isset( $value[ApiResult::META_PRESERVE_KEYS] ) |
||
| 123 | ? $value[ApiResult::META_PRESERVE_KEYS] |
||
| 124 | : []; |
||
| 125 | $indexedTagName = isset( $value[ApiResult::META_INDEXED_TAG_NAME] ) |
||
| 126 | ? self::mangleName( $value[ApiResult::META_INDEXED_TAG_NAME], $preserveKeys ) |
||
| 127 | : '_v'; |
||
| 128 | $bcBools = isset( $value[ApiResult::META_BC_BOOLS] ) |
||
| 129 | ? $value[ApiResult::META_BC_BOOLS] |
||
| 130 | : []; |
||
| 131 | $indexSubelements = isset( $value[ApiResult::META_TYPE] ) |
||
| 132 | ? $value[ApiResult::META_TYPE] !== 'array' |
||
| 133 | : false; |
||
| 134 | |||
| 135 | $content = null; |
||
| 136 | $subelements = []; |
||
| 137 | $indexedSubelements = []; |
||
| 138 | foreach ( $value as $k => $v ) { |
||
| 139 | if ( ApiResult::isMetadataKey( $k ) && !in_array( $k, $preserveKeys, true ) ) { |
||
| 140 | continue; |
||
| 141 | } |
||
| 142 | |||
| 143 | $oldv = $v; |
||
| 144 | if ( is_bool( $v ) && !in_array( $k, $bcBools, true ) ) { |
||
| 145 | $v = $v ? 'true' : 'false'; |
||
| 146 | } |
||
| 147 | |||
| 148 | if ( $name !== null && $k === $contentKey ) { |
||
| 149 | $content = $v; |
||
| 150 | } elseif ( is_int( $k ) ) { |
||
| 151 | $indexedSubelements[$k] = $v; |
||
| 152 | } elseif ( is_array( $v ) || is_object( $v ) ) { |
||
| 153 | $subelements[self::mangleName( $k, $preserveKeys )] = $v; |
||
| 154 | } elseif ( in_array( $k, $subelementKeys, true ) || $name === null ) { |
||
| 155 | $subelements[self::mangleName( $k, $preserveKeys )] = [ |
||
| 156 | 'content' => $v, |
||
| 157 | ApiResult::META_CONTENT => 'content', |
||
| 158 | ApiResult::META_TYPE => 'assoc', |
||
| 159 | ]; |
||
| 160 | } elseif ( is_bool( $oldv ) ) { |
||
| 161 | if ( $oldv ) { |
||
| 162 | $attributes[self::mangleName( $k, $preserveKeys )] = ''; |
||
| 163 | } |
||
| 164 | } elseif ( $v !== null ) { |
||
| 165 | $attributes[self::mangleName( $k, $preserveKeys )] = $v; |
||
| 166 | } |
||
| 167 | } |
||
| 168 | |||
| 169 | if ( $content !== null ) { |
||
| 170 | if ( $subelements || $indexedSubelements ) { |
||
| 171 | $subelements[self::mangleName( $contentKey, $preserveKeys )] = [ |
||
| 172 | 'content' => $content, |
||
| 173 | ApiResult::META_CONTENT => 'content', |
||
| 174 | ApiResult::META_TYPE => 'assoc', |
||
| 175 | ]; |
||
| 176 | $content = null; |
||
| 177 | } elseif ( is_scalar( $content ) ) { |
||
| 178 | // Add xml:space="preserve" to the element so XML parsers |
||
| 179 | // will leave whitespace in the content alone |
||
| 180 | $attributes += [ 'xml:space' => 'preserve' ]; |
||
| 181 | } |
||
| 182 | } |
||
| 183 | |||
| 184 | if ( $content !== null ) { |
||
| 185 | if ( is_scalar( $content ) ) { |
||
| 186 | $retval .= $indstr . Xml::element( $name, $attributes, $content ); |
||
| 187 | } else { |
||
| 188 | if ( $name !== null ) { |
||
| 189 | $retval .= $indstr . Xml::element( $name, $attributes, null ); |
||
| 190 | } |
||
| 191 | $retval .= static::recXmlPrint( null, $content, $indent ); |
||
| 192 | if ( $name !== null ) { |
||
| 193 | $retval .= $indstr . Xml::closeElement( $name ); |
||
| 194 | } |
||
| 195 | } |
||
| 196 | } elseif ( !$indexedSubelements && !$subelements ) { |
||
| 197 | if ( $name !== null ) { |
||
| 198 | $retval .= $indstr . Xml::element( $name, $attributes ); |
||
| 199 | } |
||
| 200 | } else { |
||
| 201 | if ( $name !== null ) { |
||
| 202 | $retval .= $indstr . Xml::element( $name, $attributes, null ); |
||
| 203 | } |
||
| 204 | foreach ( $subelements as $k => $v ) { |
||
| 205 | $retval .= static::recXmlPrint( $k, $v, $indent ); |
||
| 206 | } |
||
| 207 | foreach ( $indexedSubelements as $k => $v ) { |
||
| 208 | $retval .= static::recXmlPrint( $indexedTagName, $v, $indent, |
||
| 209 | $indexSubelements ? [ '_idx' => $k ] : [] |
||
| 210 | ); |
||
| 211 | } |
||
| 212 | if ( $name !== null ) { |
||
| 213 | $retval .= $indstr . Xml::closeElement( $name ); |
||
| 214 | } |
||
| 215 | } |
||
| 216 | } else { |
||
| 217 | // to make sure null value doesn't produce unclosed element, |
||
| 218 | // which is what Xml::element( $name, null, null ) returns |
||
| 219 | if ( $value === null ) { |
||
| 220 | $retval .= $indstr . Xml::element( $name, $attributes ); |
||
| 221 | } else { |
||
| 222 | $retval .= $indstr . Xml::element( $name, $attributes, $value ); |
||
| 223 | } |
||
| 224 | } |
||
| 225 | |||
| 226 | return $retval; |
||
| 227 | } |
||
| 228 | |||
| 229 | /** |
||
| 230 | * Mangle XML-invalid names to be valid in XML |
||
| 231 | * @param string $name |
||
| 232 | * @param array $preserveKeys Names to not mangle |
||
| 233 | * @return string Mangled name |
||
| 234 | */ |
||
| 235 | private static function mangleName( $name, $preserveKeys = [] ) { |
||
| 236 | static $nsc = null, $nc = null; |
||
| 237 | |||
| 238 | if ( in_array( $name, $preserveKeys, true ) ) { |
||
| 239 | return $name; |
||
| 240 | } |
||
| 241 | |||
| 242 | if ( $name === '' ) { |
||
| 243 | return '_'; |
||
| 244 | } |
||
| 245 | |||
| 246 | if ( $nsc === null ) { |
||
| 247 | // Note we omit ':' from $nsc and $nc because it's reserved for XML |
||
| 248 | // namespacing, and we omit '_' from $nsc (but not $nc) because we |
||
| 249 | // reserve it. |
||
| 250 | $nsc = 'A-Za-z\x{C0}-\x{D6}\x{D8}-\x{F6}\x{F8}-\x{2FF}\x{370}-\x{37D}\x{37F}-\x{1FFF}' . |
||
| 251 | '\x{200C}-\x{200D}\x{2070}-\x{218F}\x{2C00}-\x{2FEF}\x{3001}-\x{D7FF}' . |
||
| 252 | '\x{F900}-\x{FDCF}\x{FDF0}-\x{FFFD}\x{10000}-\x{EFFFF}'; |
||
| 253 | $nc = $nsc . '_\-.0-9\x{B7}\x{300}-\x{36F}\x{203F}-\x{2040}'; |
||
| 254 | } |
||
| 255 | |||
| 256 | if ( preg_match( "/^[$nsc][$nc]*$/uS", $name ) ) { |
||
| 257 | return $name; |
||
| 258 | } |
||
| 259 | |||
| 260 | return '_' . preg_replace_callback( |
||
| 261 | "/[^$nc]/uS", |
||
| 262 | function ( $m ) { |
||
| 263 | return sprintf( '.%X.', UtfNormal\Utils::utf8ToCodepoint( $m[0] ) ); |
||
| 264 | }, |
||
| 265 | str_replace( '.', '.2E.', $name ) |
||
| 266 | ); |
||
| 267 | } |
||
| 268 | |||
| 269 | protected function addXslt() { |
||
| 270 | $nt = Title::newFromText( $this->mXslt ); |
||
| 271 | if ( is_null( $nt ) || !$nt->exists() ) { |
||
| 272 | $this->setWarning( 'Invalid or non-existent stylesheet specified' ); |
||
| 273 | |||
| 274 | return; |
||
| 275 | } |
||
| 276 | if ( $nt->getNamespace() != NS_MEDIAWIKI ) { |
||
| 277 | $this->setWarning( 'Stylesheet should be in the MediaWiki namespace.' ); |
||
| 278 | |||
| 279 | return; |
||
| 280 | } |
||
| 281 | if ( substr( $nt->getText(), -4 ) !== '.xsl' ) { |
||
| 282 | $this->setWarning( 'Stylesheet should have .xsl extension.' ); |
||
| 283 | |||
| 284 | return; |
||
| 285 | } |
||
| 286 | $this->printText( '<?xml-stylesheet href="' . |
||
| 287 | htmlspecialchars( $nt->getLocalURL( 'action=raw' ) ) . '" type="text/xsl" ?>' ); |
||
| 288 | } |
||
| 289 | |||
| 290 | public function getAllowedParams() { |
||
| 291 | return parent::getAllowedParams() + [ |
||
| 292 | 'xslt' => [ |
||
| 293 | ApiBase::PARAM_HELP_MSG => 'apihelp-xml-param-xslt', |
||
| 294 | ], |
||
| 295 | 'includexmlnamespace' => [ |
||
| 296 | ApiBase::PARAM_DFLT => false, |
||
| 297 | ApiBase::PARAM_HELP_MSG => 'apihelp-xml-param-includexmlnamespace', |
||
| 298 | ], |
||
| 299 | ]; |
||
| 300 | } |
||
| 301 | } |
||
| 302 |
This check looks for function or method calls that always return null and whose return value is assigned to a variable.
The method
getObject()can return nothing but null, so it makes no sense to assign that value to a variable.The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes.