Issues (4122)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/parser/DateFormatter.php (14 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Date formatter
4
 *
5
 * This program is free software; you can redistribute it and/or modify
6
 * it under the terms of the GNU General Public License as published by
7
 * the Free Software Foundation; either version 2 of the License, or
8
 * (at your option) any later version.
9
 *
10
 * This program is distributed in the hope that it will be useful,
11
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
 * GNU General Public License for more details.
14
 *
15
 * You should have received a copy of the GNU General Public License along
16
 * with this program; if not, write to the Free Software Foundation, Inc.,
17
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18
 * http://www.gnu.org/copyleft/gpl.html
19
 *
20
 * @file
21
 * @ingroup Parser
22
 */
23
24
/**
25
 * Date formatter, recognises dates in plain text and formats them according to user preferences.
26
 * @todo preferences, OutputPage
27
 * @ingroup Parser
28
 */
29
class DateFormatter {
30
	public $mSource, $mTarget;
0 ignored issues
show
It is generally advisable to only define one property per statement.

Only declaring a single property per statement allows you to later on add doc comments more easily.

It is also recommended by PSR2, so it is a common style that many people expect.

Loading history...
31
	public $monthNames = '', $rxDM, $rxMD, $rxDMY, $rxYDM, $rxMDY, $rxYMD;
0 ignored issues
show
It is generally advisable to only define one property per statement.

Only declaring a single property per statement allows you to later on add doc comments more easily.

It is also recommended by PSR2, so it is a common style that many people expect.

Loading history...
32
33
	public $regexes, $pDays, $pMonths, $pYears;
0 ignored issues
show
It is generally advisable to only define one property per statement.

Only declaring a single property per statement allows you to later on add doc comments more easily.

It is also recommended by PSR2, so it is a common style that many people expect.

Loading history...
34
	public $rules, $xMonths, $preferences;
0 ignored issues
show
It is generally advisable to only define one property per statement.

Only declaring a single property per statement allows you to later on add doc comments more easily.

It is also recommended by PSR2, so it is a common style that many people expect.

Loading history...
35
36
	protected $lang, $mLinked;
0 ignored issues
show
It is generally advisable to only define one property per statement.

Only declaring a single property per statement allows you to later on add doc comments more easily.

It is also recommended by PSR2, so it is a common style that many people expect.

Loading history...
37
38
	const ALL = -1;
39
	const NONE = 0;
40
	const MDY = 1;
41
	const DMY = 2;
42
	const YMD = 3;
43
	const ISO1 = 4;
44
	const LASTPREF = 4;
45
	const ISO2 = 5;
46
	const YDM = 6;
47
	const DM = 7;
48
	const MD = 8;
49
	const LAST = 8;
50
51
	/**
52
	 * @param Language $lang In which language to format the date
53
	 */
54
	public function __construct( Language $lang ) {
55
		$this->lang = $lang;
56
57
		$this->monthNames = $this->getMonthRegex();
58
		for ( $i = 1; $i <= 12; $i++ ) {
59
			$this->xMonths[$this->lang->lc( $this->lang->getMonthName( $i ) )] = $i;
60
			$this->xMonths[$this->lang->lc( $this->lang->getMonthAbbreviation( $i ) )] = $i;
61
		}
62
63
		$this->regexTrail = '(?![a-z])/iu';
0 ignored issues
show
The property regexTrail does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
64
65
		# Partial regular expressions
66
		$this->prxDM = '\[\[(\d{1,2})[ _](' . $this->monthNames . ')\]\]';
0 ignored issues
show
The property prxDM does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
67
		$this->prxMD = '\[\[(' . $this->monthNames . ')[ _](\d{1,2})\]\]';
0 ignored issues
show
The property prxMD does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
68
		$this->prxY = '\[\[(\d{1,4}([ _]BC|))\]\]';
0 ignored issues
show
The property prxY does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
69
		$this->prxISO1 = '\[\[(-?\d{4})]]-\[\[(\d{2})-(\d{2})\]\]';
0 ignored issues
show
The property prxISO1 does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
70
		$this->prxISO2 = '\[\[(-?\d{4})-(\d{2})-(\d{2})\]\]';
0 ignored issues
show
The property prxISO2 does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
71
72
		# Real regular expressions
73
		$this->regexes[self::DMY] = "/{$this->prxDM}(?: *, *| +){$this->prxY}{$this->regexTrail}";
74
		$this->regexes[self::YDM] = "/{$this->prxY}(?: *, *| +){$this->prxDM}{$this->regexTrail}";
75
		$this->regexes[self::MDY] = "/{$this->prxMD}(?: *, *| +){$this->prxY}{$this->regexTrail}";
76
		$this->regexes[self::YMD] = "/{$this->prxY}(?: *, *| +){$this->prxMD}{$this->regexTrail}";
77
		$this->regexes[self::DM] = "/{$this->prxDM}{$this->regexTrail}";
78
		$this->regexes[self::MD] = "/{$this->prxMD}{$this->regexTrail}";
79
		$this->regexes[self::ISO1] = "/{$this->prxISO1}{$this->regexTrail}";
80
		$this->regexes[self::ISO2] = "/{$this->prxISO2}{$this->regexTrail}";
81
82
		# Extraction keys
83
		# See the comments in replace() for the meaning of the letters
84
		$this->keys[self::DMY] = 'jFY';
0 ignored issues
show
The property keys does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
85
		$this->keys[self::YDM] = 'Y jF';
86
		$this->keys[self::MDY] = 'FjY';
87
		$this->keys[self::YMD] = 'Y Fj';
88
		$this->keys[self::DM] = 'jF';
89
		$this->keys[self::MD] = 'Fj';
90
		$this->keys[self::ISO1] = 'ymd'; # y means ISO year
91
		$this->keys[self::ISO2] = 'ymd';
92
93
		# Target date formats
94
		$this->targets[self::DMY] = '[[F j|j F]] [[Y]]';
0 ignored issues
show
The property targets does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
95
		$this->targets[self::YDM] = '[[Y]], [[F j|j F]]';
96
		$this->targets[self::MDY] = '[[F j]], [[Y]]';
97
		$this->targets[self::YMD] = '[[Y]] [[F j]]';
98
		$this->targets[self::DM] = '[[F j|j F]]';
99
		$this->targets[self::MD] = '[[F j]]';
100
		$this->targets[self::ISO1] = '[[Y|y]]-[[F j|m-d]]';
101
		$this->targets[self::ISO2] = '[[y-m-d]]';
102
103
		# Rules
104
		#            pref    source 	  target
105
		$this->rules[self::DMY][self::MD] = self::DM;
106
		$this->rules[self::ALL][self::MD] = self::MD;
107
		$this->rules[self::MDY][self::DM] = self::MD;
108
		$this->rules[self::ALL][self::DM] = self::DM;
109
		$this->rules[self::NONE][self::ISO2] = self::ISO1;
110
111
		$this->preferences = [
112
			'default' => self::NONE,
113
			'dmy' => self::DMY,
114
			'mdy' => self::MDY,
115
			'ymd' => self::YMD,
116
			'ISO 8601' => self::ISO1,
117
		];
118
	}
119
120
	/**
121
	 * Get a DateFormatter object
122
	 *
123
	 * @param Language|string|null $lang In which language to format the date
124
	 * 		Defaults to the site content language
125
	 * @return DateFormatter
126
	 */
127
	public static function getInstance( $lang = null ) {
128
		global $wgContLang, $wgMainCacheType;
129
130
		$lang = $lang ? wfGetLangObj( $lang ) : $wgContLang;
131
		$cache = ObjectCache::getLocalServerInstance( $wgMainCacheType );
132
133
		static $dateFormatter = false;
134
		if ( !$dateFormatter ) {
135
			$dateFormatter = $cache->getWithSetCallback(
136
				$cache->makeKey( 'dateformatter', $lang->getCode() ),
137
				$cache::TTL_HOUR,
138
				function () use ( $lang ) {
139
					return new DateFormatter( $lang );
140
				}
141
			);
142
		}
143
144
		return $dateFormatter;
145
	}
146
147
	/**
148
	 * @param string $preference User preference
149
	 * @param string $text Text to reformat
150
	 * @param array $options Array can contain 'linked' and/or 'match-whole'
151
	 *
152
	 * @return string
153
	 */
154
	public function reformat( $preference, $text, $options = [ 'linked' ] ) {
155
		$linked = in_array( 'linked', $options );
156
		$match_whole = in_array( 'match-whole', $options );
157
158
		if ( isset( $this->preferences[$preference] ) ) {
159
			$preference = $this->preferences[$preference];
160
		} else {
161
			$preference = self::NONE;
162
		}
163
		for ( $i = 1; $i <= self::LAST; $i++ ) {
164
			$this->mSource = $i;
165
			if ( isset( $this->rules[$preference][$i] ) ) {
166
				# Specific rules
167
				$this->mTarget = $this->rules[$preference][$i];
168
			} elseif ( isset( $this->rules[self::ALL][$i] ) ) {
169
				# General rules
170
				$this->mTarget = $this->rules[self::ALL][$i];
171
			} elseif ( $preference ) {
172
				# User preference
173
				$this->mTarget = $preference;
174
			} else {
175
				# Default
176
				$this->mTarget = $i;
177
			}
178
			$regex = $this->regexes[$i];
179
180
			// Horrible hack
181
			if ( !$linked ) {
182
				$regex = str_replace( [ '\[\[', '\]\]' ], '', $regex );
183
			}
184
185
			if ( $match_whole ) {
186
				// Let's hope this works
187
				$regex = preg_replace( '!^/!', '/^', $regex );
188
				$regex = str_replace( $this->regexTrail,
189
					'$' . $this->regexTrail, $regex );
190
			}
191
192
			// Another horrible hack
193
			$this->mLinked = $linked;
194
			$text = preg_replace_callback( $regex, [ &$this, 'replace' ], $text );
195
			unset( $this->mLinked );
196
		}
197
		return $text;
198
	}
199
200
	/**
201
	 * @param array $matches
202
	 * @return string
203
	 */
204
	public function replace( $matches ) {
205
		# Extract information from $matches
206
		$linked = true;
207
		if ( isset( $this->mLinked ) ) {
208
			$linked = $this->mLinked;
209
		}
210
211
		$bits = [];
212
		$key = $this->keys[$this->mSource];
213
		$keyLength = strlen( $key );
214
		for ( $p = 0; $p < $keyLength; $p++ ) {
215
			if ( $key[$p] != ' ' ) {
216
				$bits[$key[$p]] = $matches[$p + 1];
217
			}
218
		}
219
220
		return $this->formatDate( $bits, $linked );
221
	}
222
223
	/**
224
	 * @param array $bits
225
	 * @param bool $link
226
	 * @return string
227
	 */
228
	public function formatDate( $bits, $link = true ) {
229
		$format = $this->targets[$this->mTarget];
230
231
		if ( !$link ) {
232
			// strip piped links
233
			$format = preg_replace( '/\[\[[^|]+\|([^\]]+)\]\]/', '$1', $format );
234
			// strip remaining links
235
			$format = str_replace( [ '[[', ']]' ], '', $format );
236
		}
237
238
		# Construct new date
239
		$text = '';
240
		$fail = false;
241
242
		// Pre-generate y/Y stuff because we need the year for the <span> title.
243
		if ( !isset( $bits['y'] ) && isset( $bits['Y'] ) ) {
244
			$bits['y'] = $this->makeIsoYear( $bits['Y'] );
245
		}
246
		if ( !isset( $bits['Y'] ) && isset( $bits['y'] ) ) {
247
			$bits['Y'] = $this->makeNormalYear( $bits['y'] );
248
		}
249
250
		if ( !isset( $bits['m'] ) ) {
251
			$m = $this->makeIsoMonth( $bits['F'] );
252
			if ( !$m || $m == '00' ) {
253
				$fail = true;
254
			} else {
255
				$bits['m'] = $m;
256
			}
257
		}
258
259
		if ( !isset( $bits['d'] ) ) {
260
			$bits['d'] = sprintf( '%02d', $bits['j'] );
261
		}
262
263
		$formatLength = strlen( $format );
264
		for ( $p = 0; $p < $formatLength; $p++ ) {
265
			$char = $format[$p];
266
			switch ( $char ) {
267
				case 'd': # ISO day of month
268
					$text .= $bits['d'];
269
					break;
270
				case 'm': # ISO month
271
					$text .= $bits['m'];
272
					break;
273
				case 'y': # ISO year
274
					$text .= $bits['y'];
275
					break;
276
				case 'j': # ordinary day of month
277
					if ( !isset( $bits['j'] ) ) {
278
						$text .= intval( $bits['d'] );
279
					} else {
280
						$text .= $bits['j'];
281
					}
282
					break;
283
				case 'F': # long month
284
					if ( !isset( $bits['F'] ) ) {
285
						$m = intval( $bits['m'] );
286
						if ( $m > 12 || $m < 1 ) {
287
							$fail = true;
288
						} else {
289
							$text .= $this->lang->getMonthName( $m );
290
						}
291
					} else {
292
						$text .= ucfirst( $bits['F'] );
293
					}
294
					break;
295
				case 'Y': # ordinary (optional BC) year
296
					$text .= $bits['Y'];
297
					break;
298
				default:
299
					$text .= $char;
300
			}
301
		}
302
		if ( $fail ) {
303
			/** @todo FIXME: $matches doesn't exist here, what's expected? */
304
			$text = $matches[0];
0 ignored issues
show
The variable $matches does not exist. Did you forget to declare it?

This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug.

Loading history...
305
		}
306
307
		$isoBits = [];
308
		if ( isset( $bits['y'] ) ) {
309
			$isoBits[] = $bits['y'];
310
		}
311
		$isoBits[] = $bits['m'];
312
		$isoBits[] = $bits['d'];
313
		$isoDate = implode( '-', $isoBits );
314
315
		// Output is not strictly HTML (it's wikitext), but <span> is whitelisted.
316
		$text = Html::rawElement( 'span',
317
					[ 'class' => 'mw-formatted-date', 'title' => $isoDate ], $text );
318
319
		return $text;
320
	}
321
322
	/**
323
	 * Return a regex that can be used to find month names in string
324
	 * @return string regex to find the months with
325
	 */
326
	public function getMonthRegex() {
327
		$names = [];
328
		for ( $i = 1; $i <= 12; $i++ ) {
329
			$names[] = $this->lang->getMonthName( $i );
330
			$names[] = $this->lang->getMonthAbbreviation( $i );
331
		}
332
		return implode( '|', $names );
333
	}
334
335
	/**
336
	 * Makes an ISO month, e.g. 02, from a month name
337
	 * @param string $monthName Month name
338
	 * @return string ISO month name
339
	 */
340
	public function makeIsoMonth( $monthName ) {
341
		$n = $this->xMonths[$this->lang->lc( $monthName )];
342
		return sprintf( '%02d', $n );
343
	}
344
345
	/**
346
	 * Make an ISO year from a year name, for instance: '-1199' from '1200 BC'
347
	 * @param string $year Year name
348
	 * @return string ISO year name
349
	 */
350
	public function makeIsoYear( $year ) {
351
		# Assumes the year is in a nice format, as enforced by the regex
352
		if ( substr( $year, -2 ) == 'BC' ) {
353
			$num = intval( substr( $year, 0, -3 ) ) - 1;
354
			# PHP bug note: sprintf( "%04d", -1 ) fails poorly
355
			$text = sprintf( '-%04d', $num );
356
357
		} else {
358
			$text = sprintf( '%04d', $year );
359
		}
360
		return $text;
361
	}
362
363
	/**
364
	 * Make a year one from an ISO year, for instance: '400 BC' from '-0399'.
365
	 * @param string $iso ISO year
366
	 * @return int|string int representing year number in case of AD dates, or string containing
367
	 *   year number and 'BC' at the end otherwise.
368
	 */
369
	public function makeNormalYear( $iso ) {
370
		if ( $iso[0] == '-' ) {
371
			$text = ( intval( substr( $iso, 1 ) ) + 1 ) . ' BC';
372
		} else {
373
			$text = intval( $iso );
374
		}
375
		return $text;
376
	}
377
}
378