Issues in ResourceLoaderImage.php (master) - Issues in master - wikimedia/mediawiki - Measure and Improve Code Quality continuously with Scrutinizer

Issues (4122)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/resourceloader/ResourceLoaderImage.php (9 issues)

Labels

Severity

Major 9

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/**
 * Class encapsulating an image used in a ResourceLoaderImageModule.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; if not, write to the Free Software Foundation, Inc.,
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 * http://www.gnu.org/copyleft/gpl.html
 *
 * @file
 */

/**
 * Class encapsulating an image used in a ResourceLoaderImageModule.
 *
 * @since 1.25
 */
class ResourceLoaderImage {

	/**
	 * Map of allowed file extensions to their MIME types.
	 * @var array
	 */
	protected static $fileTypes = [
		'svg' => 'image/svg+xml',
		'png' => 'image/png',
		'gif' => 'image/gif',
		'jpg' => 'image/jpg',
	];

	/**
	 * @param string $name Image name
	 * @param string $module Module name
	 * @param string|array $descriptor Path to image file, or array structure containing paths
	 * @param string $basePath Directory to which paths in descriptor refer
	 * @param array $variants
	 * @throws InvalidArgumentException
	 */
	public function __construct( $name, $module, $descriptor, $basePath, $variants ) {
		$this->name = $name;
class MyClass { }

$x = new MyClass();
$x->foo = true;
		$this->module = $module;
class MyClass { }

$x = new MyClass();
$x->foo = true;
		$this->descriptor = $descriptor;
class MyClass { }

$x = new MyClass();
$x->foo = true;
		$this->basePath = $basePath;
class MyClass { }

$x = new MyClass();
$x->foo = true;
		$this->variants = $variants;
class MyClass { }

$x = new MyClass();
$x->foo = true;

		// Expand shorthands:
		// [ "en,de,fr" => "foo.svg" ]
		// → [ "en" => "foo.svg", "de" => "foo.svg", "fr" => "foo.svg" ]
		if ( is_array( $this->descriptor ) && isset( $this->descriptor['lang'] ) ) {
			foreach ( array_keys( $this->descriptor['lang'] ) as $langList ) {
				if ( strpos( $langList, ',' ) !== false ) {
					$this->descriptor['lang'] += array_fill_keys(
						explode( ',', $langList ),
						$this->descriptor['lang'][$langList]
					);
					unset( $this->descriptor['lang'][$langList] );
				}
			}
		}

		// Ensure that all files have common extension.
		$extensions = [];
		$descriptor = (array)$descriptor;
		array_walk_recursive( $descriptor, function ( $path ) use ( &$extensions ) {
			$extensions[] = pathinfo( $path, PATHINFO_EXTENSION );
		} );
		$extensions = array_unique( $extensions );
		if ( count( $extensions ) !== 1 ) {
			throw new InvalidArgumentException(
				"File type for different image files of '$name' not the same"
			);
		}
		$ext = $extensions[0];
		if ( !isset( self::$fileTypes[$ext] ) ) {
			throw new InvalidArgumentException(
				"Invalid file type for image files of '$name' (valid: svg, png, gif, jpg)"
			);
		}
		$this->extension = $ext;
class MyClass { }

$x = new MyClass();
$x->foo = true;
	}

	/**
	 * Get name of this image.
	 *
	 * @return string
	 */
	public function getName() {
		return $this->name;
	}

	/**
	 * Get name of the module this image belongs to.
	 *
	 * @return string
	 */
	public function getModule() {
		return $this->module;
	}

	/**
	 * Get the list of variants this image can be converted to.
	 *
	 * @return string[]
	 */
	public function getVariants() {
		return array_keys( $this->variants );
	}

	/**
	 * Get the path to image file for given context.
	 *
	 * @param ResourceLoaderContext $context Any context
	 * @return string
	 */
	public function getPath( ResourceLoaderContext $context ) {
		$desc = $this->descriptor;
		if ( is_string( $desc ) ) {
			return $this->basePath . '/' . $desc;
		} elseif ( isset( $desc['lang'][$context->getLanguage()] ) ) {
			return $this->basePath . '/' . $desc['lang'][$context->getLanguage()];
		} elseif ( isset( $desc[$context->getDirection()] ) ) {
			return $this->basePath . '/' . $desc[$context->getDirection()];
		} else {
			return $this->basePath . '/' . $desc['default'];
		}
	}

	/**
	 * Get the extension of the image.
	 *
	 * @param string $format Format to get the extension for, 'original' or 'rasterized'
	 * @return string Extension without leading dot, e.g. 'png'
	 */
	public function getExtension( $format = 'original' ) {
		if ( $format === 'rasterized' && $this->extension === 'svg' ) {
			return 'png';
		} else {
			return $this->extension;
		}
	}

	/**
	 * Get the MIME type of the image.
	 *
	 * @param string $format Format to get the MIME type for, 'original' or 'rasterized'
	 * @return string
	 */
	public function getMimeType( $format = 'original' ) {
		$ext = $this->getExtension( $format );
		return self::$fileTypes[$ext];
	}

	/**
	 * Get the load.php URL that will produce this image.
	 *
	 * @param ResourceLoaderContext $context Any context
	 * @param string $script URL to load.php
	 * @param string|null $variant Variant to get the URL for
	 * @param string $format Format to get the URL for, 'original' or 'rasterized'
	 * @return string
	 */
	public function getUrl( ResourceLoaderContext $context, $script, $variant, $format ) {
		$query = [
			'modules' => $this->getModule(),
			'image' => $this->getName(),
			'variant' => $variant,
			'format' => $format,
			'lang' => $context->getLanguage(),
			'version' => $context->getVersion(),
		];

		return wfAppendQuery( $script, $query );
	}

	/**
	 * Get the data: URI that will produce this image.
	 *
	 * @param ResourceLoaderContext $context Any context
	 * @param string|null $variant Variant to get the URI for
	 * @param string $format Format to get the URI for, 'original' or 'rasterized'
	 * @return string
	 */
	public function getDataUri( ResourceLoaderContext $context, $variant, $format ) {
		$type = $this->getMimeType( $format );
		$contents = $this->getImageData( $context, $variant, $format );
		return CSSMin::encodeStringAsDataURI( $contents, $type );
<?php

function getDate($date)
{
    if ($date !== null) {
        return new DateTime($date);
    }

    return false;
}
	}

	/**
	 * Get actual image data for this image. This can be saved to a file or sent to the browser to
	 * produce the converted image.
	 *
	 * Call getExtension() or getMimeType() with the same $format argument to learn what file type the
	 * returned data uses.
	 *
	 * @param ResourceLoaderContext $context Image context, or any context if $variant and $format
	 *     given.
	 * @param string|null $variant Variant to get the data for. Optional; if given, overrides the data
	 *     from $context.
	 * @param string $format Format to get the data for, 'original' or 'rasterized'. Optional; if
	 *     given, overrides the data from $context.
	 * @return string|false Possibly binary image data, or false on failure
	 * @throws MWException If the image file doesn't exist
	 */
	public function getImageData( ResourceLoaderContext $context, $variant = false, $format = false ) {
		if ( $variant === false ) {
			$variant = $context->getVariant();
		}
		if ( $format === false ) {
			$format = $context->getFormat();
		}

		$path = $this->getPath( $context );
		if ( !file_exists( $path ) ) {
			throw new MWException( "File '$path' does not exist" );
		}

		if ( $this->getExtension() !== 'svg' ) {
			return file_get_contents( $path );
		}

		if ( $variant && isset( $this->variants[$variant] ) ) {
''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
			$data = $this->variantize( $this->variants[$variant], $context );
		} else {
			$data = file_get_contents( $path );
		}

		if ( $format === 'rasterized' ) {
			$data = $this->rasterize( $data );
			if ( !$data ) {
''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
				wfDebugLog( 'ResourceLoaderImage', __METHOD__ . " failed to rasterize for $path" );
			}
		}

		return $data;
	}

	/**
	 * Send response headers (using the header() function) that are necessary to correctly serve the
	 * image data for this image, as returned by getImageData().
	 *
	 * Note that the headers are independent of the language or image variant.
	 *
	 * @param ResourceLoaderContext $context Image context
	 */
	public function sendResponseHeaders( ResourceLoaderContext $context ) {
		$format = $context->getFormat();
		$mime = $this->getMimeType( $format );
		$filename = $this->getName() . '.' . $this->getExtension( $format );

		header( 'Content-Type: ' . $mime );
		header( 'Content-Disposition: ' .
			FileBackend::makeContentDisposition( 'inline', $filename ) );
	}

	/**
	 * Convert this image, which is assumed to be SVG, to given variant.
	 *
	 * @param array $variantConf Array with a 'color' key, its value will be used as fill color
	 * @param ResourceLoaderContext $context Image context
	 * @return string New SVG file data
	 */
	protected function variantize( $variantConf, ResourceLoaderContext $context ) {
		$dom = new DomDocument;
		$dom->loadXML( file_get_contents( $this->getPath( $context ) ) );
		$root = $dom->documentElement;
		$wrapper = $dom->createElement( 'g' );
		while ( $root->firstChild ) {
			$wrapper->appendChild( $root->firstChild );
		}
		$root->appendChild( $wrapper );
		$wrapper->setAttribute( 'fill', $variantConf['color'] );
		return $dom->saveXML();
	}

	/**
	 * Massage the SVG image data for converters which don't understand some path data syntax.
	 *
	 * This is necessary for rsvg and ImageMagick when compiled with rsvg support.
	 * Upstream bug is https://bugzilla.gnome.org/show_bug.cgi?id=620923, fixed 2014-11-10, so
	 * this will be needed for a while. (T76852)
	 *
	 * @param string $svg SVG image data
	 * @return string Massaged SVG image data
	 */
	protected function massageSvgPathdata( $svg ) {
		$dom = new DomDocument;
		$dom->loadXML( $svg );
		foreach ( $dom->getElementsByTagName( 'path' ) as $node ) {
			$pathData = $node->getAttribute( 'd' );
			// Make sure there is at least one space between numbers, and that leading zero is not omitted.
			// rsvg has issues with syntax like "M-1-2" and "M.445.483" and especially "M-.445-.483".
			$pathData = preg_replace( '/(-?)(\d*\.\d+|\d+)/', ' ${1}0$2 ', $pathData );
			// Strip unnecessary leading zeroes for prettiness, not strictly necessary
			$pathData = preg_replace( '/([ -])0(\d)/', '$1$2', $pathData );
			$node->setAttribute( 'd', $pathData );
		}
		return $dom->saveXML();
	}

	/**
	 * Convert passed image data, which is assumed to be SVG, to PNG.
	 *
	 * @param string $svg SVG image data
	 * @return string|bool PNG image data, or false on failure
	 */
	protected function rasterize( $svg ) {
		/**
		 * This code should be factored out to a separate method on SvgHandler, or perhaps a separate
		 * class, with a separate set of configuration settings.
		 *
		 * This is a distinct use case from regular SVG rasterization:
		 * * We can skip many sanity and security checks (as the images come from a trusted source,
		 *   rather than from the user).
		 * * We need to provide extra options to some converters to achieve acceptable quality for very
		 *   small images, which might cause performance issues in the general case.
		 * * We want to directly pass image data to the converter, rather than a file path.
		 *
		 * See https://phabricator.wikimedia.org/T76473#801446 for examples of what happens with the
		 * default settings.
		 *
		 * For now, we special-case rsvg (used in WMF production) and do a messy workaround for other
		 * converters.
		 */

		global $wgSVGConverter, $wgSVGConverterPath;

		$svg = $this->massageSvgPathdata( $svg );

		// Sometimes this might be 'rsvg-secure'. Long as it's rsvg.
		if ( strpos( $wgSVGConverter, 'rsvg' ) === 0 ) {
			$command = 'rsvg-convert';
			if ( $wgSVGConverterPath ) {
				$command = wfEscapeShellArg( "$wgSVGConverterPath/" ) . $command;
			}

			$process = proc_open(
				$command,
				[ 0 => [ 'pipe', 'r' ], 1 => [ 'pipe', 'w' ] ],
				$pipes
			);

			if ( is_resource( $process ) ) {
				fwrite( $pipes[0], $svg );
				fclose( $pipes[0] );
				$png = stream_get_contents( $pipes[1] );
				fclose( $pipes[1] );
				proc_close( $process );

				return $png ?: false;
			}
			return false;

		} else {
			// Write input to and read output from a temporary file
			$tempFilenameSvg = tempnam( wfTempDir(), 'ResourceLoaderImage' );
			$tempFilenamePng = tempnam( wfTempDir(), 'ResourceLoaderImage' );

			file_put_contents( $tempFilenameSvg, $svg );

			$metadata = SVGMetadataExtractor::getMetadata( $tempFilenameSvg );
			if ( !isset( $metadata['width'] ) || !isset( $metadata['height'] ) ) {
				unlink( $tempFilenameSvg );
				return false;
			}

			$handler = new SvgHandler;
			$res = $handler->rasterize(
				$tempFilenameSvg,
				$tempFilenamePng,
				$metadata['width'],
				$metadata['height']
			);
			unlink( $tempFilenameSvg );

			$png = null;
			if ( $res === true ) {
				$png = file_get_contents( $tempFilenamePng );
				unlink( $tempFilenamePng );
			}

			return $png ?: false;
		}
	}
}


1			<?php
2			/**
3			* Class encapsulating an image used in a ResourceLoaderImageModule.
4			*
5			* This program is free software; you can redistribute it and/or modify
6			* it under the terms of the GNU General Public License as published by
7			* the Free Software Foundation; either version 2 of the License, or
8			* (at your option) any later version.
9			*
10			* This program is distributed in the hope that it will be useful,
11			* but WITHOUT ANY WARRANTY; without even the implied warranty of
12			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13			* GNU General Public License for more details.
14			*
15			* You should have received a copy of the GNU General Public License along
16			* with this program; if not, write to the Free Software Foundation, Inc.,
17			* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18			* http://www.gnu.org/copyleft/gpl.html
19			*
20			* @file
21			*/
22
23			/**
24			* Class encapsulating an image used in a ResourceLoaderImageModule.
25			*
26			* @since 1.25
27			*/
28			class ResourceLoaderImage {
29
30			/**
31			* Map of allowed file extensions to their MIME types.
32			* @var array
33			*/
34			protected static $fileTypes = [
35			'svg' => 'image/svg+xml',
36			'png' => 'image/png',
37			'gif' => 'image/gif',
38			'jpg' => 'image/jpg',
39			];
40
41			/**
42			* @param string $name Image name
43			* @param string $module Module name
44			* @param string\|array $descriptor Path to image file, or array structure containing paths
45			* @param string $basePath Directory to which paths in descriptor refer
46			* @param array $variants
47			* @throws InvalidArgumentException
48			*/
49			public function __construct( $name, $module, $descriptor, $basePath, $variants ) {
50			$this->name = $name;
			0 ignored issues – show Bug introduced 2016-01-16 18:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this The property `name` does not exist. Did you maybe forget to declare it? In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { } $x = new MyClass(); $x->foo = true; Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass { public $foo; } $x = new MyClass(); $x->foo = true; Loading history...
51			$this->module = $module;
			0 ignored issues – show Bug introduced 2016-01-16 18:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this The property `module` does not exist. Did you maybe forget to declare it? In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { } $x = new MyClass(); $x->foo = true; Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass { public $foo; } $x = new MyClass(); $x->foo = true; Loading history...
52			$this->descriptor = $descriptor;
			0 ignored issues – show Bug introduced 2016-01-16 18:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this The property `descriptor` does not exist. Did you maybe forget to declare it? In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { } $x = new MyClass(); $x->foo = true; Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass { public $foo; } $x = new MyClass(); $x->foo = true; Loading history...
53			$this->basePath = $basePath;
			0 ignored issues – show Bug introduced 2016-01-16 18:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this The property `basePath` does not exist. Did you maybe forget to declare it? In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { } $x = new MyClass(); $x->foo = true; Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass { public $foo; } $x = new MyClass(); $x->foo = true; Loading history...
54			$this->variants = $variants;
			0 ignored issues – show Bug introduced 2016-01-16 18:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this The property `variants` does not exist. Did you maybe forget to declare it? In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { } $x = new MyClass(); $x->foo = true; Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass { public $foo; } $x = new MyClass(); $x->foo = true; Loading history...
55
56			// Expand shorthands:
57			// [ "en,de,fr" => "foo.svg" ]
58			// → [ "en" => "foo.svg", "de" => "foo.svg", "fr" => "foo.svg" ]
59			if ( is_array( $this->descriptor ) && isset( $this->descriptor['lang'] ) ) {
60			foreach ( array_keys( $this->descriptor['lang'] ) as $langList ) {
61			if ( strpos( $langList, ',' ) !== false ) {
62			$this->descriptor['lang'] += array_fill_keys(
63			explode( ',', $langList ),
64			$this->descriptor['lang'][$langList]
65			);
66			unset( $this->descriptor['lang'][$langList] );
67			}
68			}
69			}
70
71			// Ensure that all files have common extension.
72			$extensions = [];
73			$descriptor = (array)$descriptor;
74			array_walk_recursive( $descriptor, function ( $path ) use ( &$extensions ) {
75			$extensions[] = pathinfo( $path, PATHINFO_EXTENSION );
76			} );
77			$extensions = array_unique( $extensions );
78			if ( count( $extensions ) !== 1 ) {
79			throw new InvalidArgumentException(
80			"File type for different image files of '$name' not the same"
81			);
82			}
83			$ext = $extensions[0];
84			if ( !isset( self::$fileTypes[$ext] ) ) {
85			throw new InvalidArgumentException(
86			"Invalid file type for image files of '$name' (valid: svg, png, gif, jpg)"
87			);
88			}
89			$this->extension = $ext;
			0 ignored issues – show Bug introduced 2016-01-16 18:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this The property `extension` does not exist. Did you maybe forget to declare it? In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { } $x = new MyClass(); $x->foo = true; Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass { public $foo; } $x = new MyClass(); $x->foo = true; Loading history...
90			}
91
92			/**
93			* Get name of this image.
94			*
95			* @return string
96			*/
97			public function getName() {
98			return $this->name;
99			}
100
101			/**
102			* Get name of the module this image belongs to.
103			*
104			* @return string
105			*/
106			public function getModule() {
107			return $this->module;
108			}
109
110			/**
111			* Get the list of variants this image can be converted to.
112			*
113			* @return string[]
114			*/
115			public function getVariants() {
116			return array_keys( $this->variants );
117			}
118
119			/**
120			* Get the path to image file for given context.
121			*
122			* @param ResourceLoaderContext $context Any context
123			* @return string
124			*/
125			public function getPath( ResourceLoaderContext $context ) {
126			$desc = $this->descriptor;
127			if ( is_string( $desc ) ) {
128			return $this->basePath . '/' . $desc;
129			} elseif ( isset( $desc['lang'][$context->getLanguage()] ) ) {
130			return $this->basePath . '/' . $desc['lang'][$context->getLanguage()];
131			} elseif ( isset( $desc[$context->getDirection()] ) ) {
132			return $this->basePath . '/' . $desc[$context->getDirection()];
133			} else {
134			return $this->basePath . '/' . $desc['default'];
135			}
136			}
137
138			/**
139			* Get the extension of the image.
140			*
141			* @param string $format Format to get the extension for, 'original' or 'rasterized'
142			* @return string Extension without leading dot, e.g. 'png'
143			*/
144			public function getExtension( $format = 'original' ) {
145			if ( $format === 'rasterized' && $this->extension === 'svg' ) {
146			return 'png';
147			} else {
148			return $this->extension;
149			}
150			}
151
152			/**
153			* Get the MIME type of the image.
154			*
155			* @param string $format Format to get the MIME type for, 'original' or 'rasterized'
156			* @return string
157			*/
158			public function getMimeType( $format = 'original' ) {
159			$ext = $this->getExtension( $format );
160			return self::$fileTypes[$ext];
161			}
162
163			/**
164			* Get the load.php URL that will produce this image.
165			*
166			* @param ResourceLoaderContext $context Any context
167			* @param string $script URL to load.php
168			* @param string\|null $variant Variant to get the URL for
169			* @param string $format Format to get the URL for, 'original' or 'rasterized'
170			* @return string
171			*/
172			public function getUrl( ResourceLoaderContext $context, $script, $variant, $format ) {
173			$query = [
174			'modules' => $this->getModule(),
175			'image' => $this->getName(),
176			'variant' => $variant,
177			'format' => $format,
178			'lang' => $context->getLanguage(),
179			'version' => $context->getVersion(),
180			];
181
182			return wfAppendQuery( $script, $query );
183			}
184
185			/**
186			* Get the data: URI that will produce this image.
187			*
188			* @param ResourceLoaderContext $context Any context
189			* @param string\|null $variant Variant to get the URI for
190			* @param string $format Format to get the URI for, 'original' or 'rasterized'
191			* @return string
192			*/
193			public function getDataUri( ResourceLoaderContext $context, $variant, $format ) {
194			$type = $this->getMimeType( $format );
195			$contents = $this->getImageData( $context, $variant, $format );
196			return CSSMin::encodeStringAsDataURI( $contents, $type );
			0 ignored issues – show Security Bug introduced 2016-02-23 18:13 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `$contents` defined by `$this->getImageData($context, $variant, $format)` on line `195` can also be of type `false`; however, `CSSMin::encodeStringAsDataURI()` does only seem to accept `string`, did you maybe forget to handle an error condition? This check looks for type mismatches where the missing type is `false`. This is usually indicative of an error condtion. Consider the follow example <?php function getDate($date) { if ($date !== null) { return new DateTime($date); } return false; } This function either returns a new `DateTime` object or false, if there was an error. This is a typical pattern in PHP programming to show that an error has occurred without raising an exception. The calling code should check for this returned `false` before passing on the value to another function or method that may not be able to handle a `false`. Loading history...
197			}
198
199			/**
200			* Get actual image data for this image. This can be saved to a file or sent to the browser to
201			* produce the converted image.
202			*
203			* Call getExtension() or getMimeType() with the same $format argument to learn what file type the
204			* returned data uses.
205			*
206			* @param ResourceLoaderContext $context Image context, or any context if $variant and $format
207			* given.
208			* @param string\|null $variant Variant to get the data for. Optional; if given, overrides the data
209			* from $context.
210			* @param string $format Format to get the data for, 'original' or 'rasterized'. Optional; if
211			* given, overrides the data from $context.
212			* @return string\|false Possibly binary image data, or false on failure
213			* @throws MWException If the image file doesn't exist
214			*/
215			public function getImageData( ResourceLoaderContext $context, $variant = false, $format = false ) {
216			if ( $variant === false ) {
217			$variant = $context->getVariant();
218			}
219			if ( $format === false ) {
220			$format = $context->getFormat();
221			}
222
223			$path = $this->getPath( $context );
224			if ( !file_exists( $path ) ) {
225			throw new MWException( "File '$path' does not exist" );
226			}
227
228			if ( $this->getExtension() !== 'svg' ) {
229			return file_get_contents( $path );
230			}
231
232			if ( $variant && isset( $this->variants[$variant] ) ) {
			0 ignored issues – show Bug Best Practice introduced 2016-01-16 18:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this The expression `$variant` of type `string\|null` is loosely compared to `true`; this is ambiguous if the string can be empty. You might want to explicitly use `!== null` instead. In PHP, under loose comparison (like `==`, or `!=`, or `switch` conditions), values of different types might be equal. For `string` values, the empty string `''` is a special case, in particular the following results might be unexpected: '' == false // true '' == null // true 'ab' == false // false 'ab' == null // false // It is often better to use strict comparison '' === false // false '' === null // false Loading history...
233			$data = $this->variantize( $this->variants[$variant], $context );
234			} else {
235			$data = file_get_contents( $path );
236			}
237
238			if ( $format === 'rasterized' ) {
239			$data = $this->rasterize( $data );
240			if ( !$data ) {
			0 ignored issues – show Bug Best Practice introduced 2016-01-16 18:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this The expression `$data` of type `string\|false` is loosely compared to `false`; this is ambiguous if the string can be empty. You might want to explicitly use `=== false` instead. In PHP, under loose comparison (like `==`, or `!=`, or `switch` conditions), values of different types might be equal. For `string` values, the empty string `''` is a special case, in particular the following results might be unexpected: '' == false // true '' == null // true 'ab' == false // false 'ab' == null // false // It is often better to use strict comparison '' === false // false '' === null // false Loading history...
241			wfDebugLog( 'ResourceLoaderImage', __METHOD__ . " failed to rasterize for $path" );
242			}
243			}
244
245			return $data;
246			}
247
248			/**
249			* Send response headers (using the header() function) that are necessary to correctly serve the
250			* image data for this image, as returned by getImageData().
251			*
252			* Note that the headers are independent of the language or image variant.
253			*
254			* @param ResourceLoaderContext $context Image context
255			*/
256			public function sendResponseHeaders( ResourceLoaderContext $context ) {
257			$format = $context->getFormat();
258			$mime = $this->getMimeType( $format );
259			$filename = $this->getName() . '.' . $this->getExtension( $format );
260
261			header( 'Content-Type: ' . $mime );
262			header( 'Content-Disposition: ' .
263			FileBackend::makeContentDisposition( 'inline', $filename ) );
264			}
265
266			/**
267			* Convert this image, which is assumed to be SVG, to given variant.
268			*
269			* @param array $variantConf Array with a 'color' key, its value will be used as fill color
270			* @param ResourceLoaderContext $context Image context
271			* @return string New SVG file data
272			*/
273			protected function variantize( $variantConf, ResourceLoaderContext $context ) {
274			$dom = new DomDocument;
275			$dom->loadXML( file_get_contents( $this->getPath( $context ) ) );
276			$root = $dom->documentElement;
277			$wrapper = $dom->createElement( 'g' );
278			while ( $root->firstChild ) {
279			$wrapper->appendChild( $root->firstChild );
280			}
281			$root->appendChild( $wrapper );
282			$wrapper->setAttribute( 'fill', $variantConf['color'] );
283			return $dom->saveXML();
284			}
285
286			/**
287			* Massage the SVG image data for converters which don't understand some path data syntax.
288			*
289			* This is necessary for rsvg and ImageMagick when compiled with rsvg support.
290			* Upstream bug is https://bugzilla.gnome.org/show_bug.cgi?id=620923, fixed 2014-11-10, so
291			* this will be needed for a while. (T76852)
292			*
293			* @param string $svg SVG image data
294			* @return string Massaged SVG image data
295			*/
296			protected function massageSvgPathdata( $svg ) {
297			$dom = new DomDocument;
298			$dom->loadXML( $svg );
299			foreach ( $dom->getElementsByTagName( 'path' ) as $node ) {
300			$pathData = $node->getAttribute( 'd' );
301			// Make sure there is at least one space between numbers, and that leading zero is not omitted.
302			// rsvg has issues with syntax like "M-1-2" and "M.445.483" and especially "M-.445-.483".
303			$pathData = preg_replace( '/(-?)(\d*\.\d+\|\d+)/', ' ${1}0$2 ', $pathData );
304			// Strip unnecessary leading zeroes for prettiness, not strictly necessary
305			$pathData = preg_replace( '/([ -])0(\d)/', '$1$2', $pathData );
306			$node->setAttribute( 'd', $pathData );
307			}
308			return $dom->saveXML();
309			}
310
311			/**
312			* Convert passed image data, which is assumed to be SVG, to PNG.
313			*
314			* @param string $svg SVG image data
315			* @return string\|bool PNG image data, or false on failure
316			*/
317			protected function rasterize( $svg ) {
318			/**
319			* This code should be factored out to a separate method on SvgHandler, or perhaps a separate
320			* class, with a separate set of configuration settings.
321			*
322			* This is a distinct use case from regular SVG rasterization:
323			* * We can skip many sanity and security checks (as the images come from a trusted source,
324			* rather than from the user).
325			* * We need to provide extra options to some converters to achieve acceptable quality for very
326			* small images, which might cause performance issues in the general case.
327			* * We want to directly pass image data to the converter, rather than a file path.
328			*
329			* See https://phabricator.wikimedia.org/T76473#801446 for examples of what happens with the
330			* default settings.
331			*
332			* For now, we special-case rsvg (used in WMF production) and do a messy workaround for other
333			* converters.
334			*/
335
336			global $wgSVGConverter, $wgSVGConverterPath;
337
338			$svg = $this->massageSvgPathdata( $svg );
339
340			// Sometimes this might be 'rsvg-secure'. Long as it's rsvg.
341			if ( strpos( $wgSVGConverter, 'rsvg' ) === 0 ) {
342			$command = 'rsvg-convert';
343			if ( $wgSVGConverterPath ) {
344			$command = wfEscapeShellArg( "$wgSVGConverterPath/" ) . $command;
345			}
346
347			$process = proc_open(
348			$command,
349			[ 0 => [ 'pipe', 'r' ], 1 => [ 'pipe', 'w' ] ],
350			$pipes
351			);
352
353			if ( is_resource( $process ) ) {
354			fwrite( $pipes[0], $svg );
355			fclose( $pipes[0] );
356			$png = stream_get_contents( $pipes[1] );
357			fclose( $pipes[1] );
358			proc_close( $process );
359
360			return $png ?: false;
361			}
362			return false;
363
364			} else {
365			// Write input to and read output from a temporary file
366			$tempFilenameSvg = tempnam( wfTempDir(), 'ResourceLoaderImage' );
367			$tempFilenamePng = tempnam( wfTempDir(), 'ResourceLoaderImage' );
368
369			file_put_contents( $tempFilenameSvg, $svg );
370
371			$metadata = SVGMetadataExtractor::getMetadata( $tempFilenameSvg );
372			if ( !isset( $metadata['width'] ) \|\| !isset( $metadata['height'] ) ) {
373			unlink( $tempFilenameSvg );
374			return false;
375			}
376
377			$handler = new SvgHandler;
378			$res = $handler->rasterize(
379			$tempFilenameSvg,
380			$tempFilenamePng,
381			$metadata['width'],
382			$metadata['height']
383			);
384			unlink( $tempFilenameSvg );
385
386			$png = null;
387			if ( $res === true ) {
388			$png = file_get_contents( $tempFilenamePng );
389			unlink( $tempFilenamePng );
390			}
391
392			return $png ?: false;
393			}
394			}
395			}
396

wikimedia / mediawiki

Issues (4122)

Security Analysis not enabled

includes/resourceloader/ResourceLoaderImage.php (9 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like