wikimedia /
mediawiki
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | /** |
||
| 4 | * Accepts a list of files and directories to search for |
||
| 5 | * php files and generates $wgAutoloadLocalClasses or $wgAutoloadClasses |
||
| 6 | * lines for all detected classes. These lines are written out |
||
| 7 | * to an autoload.php file in the projects provided basedir. |
||
| 8 | * |
||
| 9 | * Usage: |
||
| 10 | * |
||
| 11 | * $gen = new AutoloadGenerator( __DIR__ ); |
||
| 12 | * $gen->readDir( __DIR__ . '/includes' ); |
||
| 13 | * $gen->readFile( __DIR__ . '/foo.php' ) |
||
| 14 | * $gen->getAutoload(); |
||
| 15 | */ |
||
| 16 | class AutoloadGenerator { |
||
| 17 | const FILETYPE_JSON = 'json'; |
||
| 18 | const FILETYPE_PHP = 'php'; |
||
| 19 | |||
| 20 | /** |
||
| 21 | * @var string Root path of the project being scanned for classes |
||
| 22 | */ |
||
| 23 | protected $basepath; |
||
| 24 | |||
| 25 | /** |
||
| 26 | * @var ClassCollector Helper class extracts class names from php files |
||
| 27 | */ |
||
| 28 | protected $collector; |
||
| 29 | |||
| 30 | /** |
||
| 31 | * @var array Map of file shortpath to list of FQCN detected within file |
||
| 32 | */ |
||
| 33 | protected $classes = []; |
||
| 34 | |||
| 35 | /** |
||
| 36 | * @var string The global variable to write output to |
||
| 37 | */ |
||
| 38 | protected $variableName = 'wgAutoloadClasses'; |
||
| 39 | |||
| 40 | /** |
||
| 41 | * @var array Map of FQCN to relative path(from self::$basepath) |
||
| 42 | */ |
||
| 43 | protected $overrides = []; |
||
| 44 | |||
| 45 | /** |
||
| 46 | * @param string $basepath Root path of the project being scanned for classes |
||
| 47 | * @param array|string $flags |
||
| 48 | * |
||
| 49 | * local - If this flag is set $wgAutoloadLocalClasses will be build instead |
||
| 50 | * of $wgAutoloadClasses |
||
| 51 | */ |
||
| 52 | public function __construct( $basepath, $flags = [] ) { |
||
| 53 | if ( !is_array( $flags ) ) { |
||
| 54 | $flags = [ $flags ]; |
||
| 55 | } |
||
| 56 | $this->basepath = self::normalizePathSeparator( realpath( $basepath ) ); |
||
| 57 | $this->collector = new ClassCollector; |
||
| 58 | if ( in_array( 'local', $flags ) ) { |
||
| 59 | $this->variableName = 'wgAutoloadLocalClasses'; |
||
| 60 | } |
||
| 61 | } |
||
| 62 | |||
| 63 | /** |
||
| 64 | * Force a class to be autoloaded from a specific path, regardless of where |
||
| 65 | * or if it was detected. |
||
| 66 | * |
||
| 67 | * @param string $fqcn FQCN to force the location of |
||
| 68 | * @param string $inputPath Full path to the file containing the class |
||
| 69 | * @throws Exception |
||
| 70 | */ |
||
| 71 | public function forceClassPath( $fqcn, $inputPath ) { |
||
| 72 | $path = self::normalizePathSeparator( realpath( $inputPath ) ); |
||
| 73 | if ( !$path ) { |
||
| 74 | throw new \Exception( "Invalid path: $inputPath" ); |
||
| 75 | } |
||
| 76 | $len = strlen( $this->basepath ); |
||
| 77 | if ( substr( $path, 0, $len ) !== $this->basepath ) { |
||
| 78 | throw new \Exception( "Path is not within basepath: $inputPath" ); |
||
| 79 | } |
||
| 80 | $shortpath = substr( $path, $len ); |
||
| 81 | $this->overrides[$fqcn] = $shortpath; |
||
| 82 | } |
||
| 83 | |||
| 84 | /** |
||
| 85 | * @param string $inputPath Path to a php file to find classes within |
||
| 86 | * @throws Exception |
||
| 87 | */ |
||
| 88 | public function readFile( $inputPath ) { |
||
| 89 | // NOTE: do NOT expand $inputPath using realpath(). It is perfectly |
||
| 90 | // reasonable for LocalSettings.php and similiar files to be symlinks |
||
| 91 | // to files that are outside of $this->basepath. |
||
| 92 | $inputPath = self::normalizePathSeparator( $inputPath ); |
||
| 93 | $len = strlen( $this->basepath ); |
||
| 94 | if ( substr( $inputPath, 0, $len ) !== $this->basepath ) { |
||
| 95 | throw new \Exception( "Path is not within basepath: $inputPath" ); |
||
| 96 | } |
||
| 97 | $result = $this->collector->getClasses( |
||
| 98 | file_get_contents( $inputPath ) |
||
| 99 | ); |
||
| 100 | if ( $result ) { |
||
| 101 | $shortpath = substr( $inputPath, $len ); |
||
| 102 | $this->classes[$shortpath] = $result; |
||
| 103 | } |
||
| 104 | } |
||
| 105 | |||
| 106 | /** |
||
| 107 | * @param string $dir Path to a directory to recursively search |
||
| 108 | * for php files with either .php or .inc extensions |
||
| 109 | */ |
||
| 110 | public function readDir( $dir ) { |
||
| 111 | $it = new RecursiveDirectoryIterator( |
||
| 112 | self::normalizePathSeparator( realpath( $dir ) ) ); |
||
| 113 | $it = new RecursiveIteratorIterator( $it ); |
||
| 114 | |||
| 115 | foreach ( $it as $path => $file ) { |
||
| 116 | $ext = pathinfo( $path, PATHINFO_EXTENSION ); |
||
| 117 | // some older files in mw use .inc |
||
| 118 | if ( $ext === 'php' || $ext === 'inc' ) { |
||
| 119 | $this->readFile( $path ); |
||
| 120 | } |
||
| 121 | } |
||
| 122 | } |
||
| 123 | |||
| 124 | /** |
||
| 125 | * Updates the AutoloadClasses field at the given |
||
| 126 | * filename. |
||
| 127 | * |
||
| 128 | * @param string $filename Filename of JSON |
||
| 129 | * extension/skin registration file |
||
| 130 | * @return string Updated Json of the file given as the $filename parameter |
||
| 131 | */ |
||
| 132 | protected function generateJsonAutoload( $filename ) { |
||
| 133 | $key = 'AutoloadClasses'; |
||
| 134 | $json = FormatJson::decode( file_get_contents( $filename ), true ); |
||
| 135 | unset( $json[$key] ); |
||
| 136 | // Inverting the key-value pairs so that they become of the |
||
| 137 | // format class-name : path when they get converted into json. |
||
| 138 | foreach ( $this->classes as $path => $contained ) { |
||
| 139 | foreach ( $contained as $fqcn ) { |
||
| 140 | |||
| 141 | // Using substr to remove the leading '/' |
||
| 142 | $json[$key][$fqcn] = substr( $path, 1 ); |
||
| 143 | } |
||
| 144 | } |
||
| 145 | foreach ( $this->overrides as $path => $fqcn ) { |
||
| 146 | |||
| 147 | // Using substr to remove the leading '/' |
||
| 148 | $json[$key][$fqcn] = substr( $path, 1 ); |
||
| 149 | } |
||
| 150 | |||
| 151 | // Sorting the list of autoload classes. |
||
| 152 | ksort( $json[$key] ); |
||
| 153 | |||
| 154 | // Return the whole JSON file |
||
| 155 | return FormatJson::encode( $json, true ) . "\n"; |
||
| 156 | } |
||
| 157 | |||
| 158 | /** |
||
| 159 | * Generates a PHP file setting up autoload information. |
||
| 160 | * |
||
| 161 | * @param {string} $commandName Command name to include in comment |
||
|
0 ignored issues
–
show
|
|||
| 162 | * @param {string} $filename of PHP file to put autoload information in. |
||
|
0 ignored issues
–
show
The doc-type
{string} could not be parsed: Unknown type name "{string}" at position 0. (view supported doc-types)
This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. Loading history...
|
|||
| 163 | * @return string |
||
| 164 | */ |
||
| 165 | protected function generatePHPAutoload( $commandName, $filename ) { |
||
| 166 | // No existing JSON file found; update/generate PHP file |
||
| 167 | $content = []; |
||
| 168 | |||
| 169 | // We need to generate a line each rather than exporting the |
||
| 170 | // full array so __DIR__ can be prepended to all the paths |
||
| 171 | $format = "%s => __DIR__ . %s,"; |
||
| 172 | foreach ( $this->classes as $path => $contained ) { |
||
| 173 | $exportedPath = var_export( $path, true ); |
||
| 174 | foreach ( $contained as $fqcn ) { |
||
| 175 | $content[$fqcn] = sprintf( |
||
| 176 | $format, |
||
| 177 | var_export( $fqcn, true ), |
||
| 178 | $exportedPath |
||
| 179 | ); |
||
| 180 | } |
||
| 181 | } |
||
| 182 | |||
| 183 | foreach ( $this->overrides as $fqcn => $path ) { |
||
| 184 | $content[$fqcn] = sprintf( |
||
| 185 | $format, |
||
| 186 | var_export( $fqcn, true ), |
||
| 187 | var_export( $path, true ) |
||
| 188 | ); |
||
| 189 | } |
||
| 190 | |||
| 191 | // sort for stable output |
||
| 192 | ksort( $content ); |
||
| 193 | |||
| 194 | // extensions using this generator are appending to the existing |
||
| 195 | // autoload. |
||
| 196 | if ( $this->variableName === 'wgAutoloadClasses' ) { |
||
| 197 | $op = '+='; |
||
| 198 | } else { |
||
| 199 | $op = '='; |
||
| 200 | } |
||
| 201 | |||
| 202 | $output = implode( "\n\t", $content ); |
||
| 203 | return |
||
| 204 | <<<EOD |
||
| 205 | <?php |
||
| 206 | // This file is generated by $commandName, do not adjust manually |
||
| 207 | // @codingStandardsIgnoreFile |
||
| 208 | global \${$this->variableName}; |
||
| 209 | |||
| 210 | \${$this->variableName} {$op} [ |
||
| 211 | {$output} |
||
| 212 | ]; |
||
| 213 | |||
| 214 | EOD; |
||
| 215 | |||
| 216 | } |
||
| 217 | |||
| 218 | /** |
||
| 219 | * Returns all known classes as a string, which can be used to put into a target |
||
| 220 | * file (e.g. extension.json, skin.json or autoload.php) |
||
| 221 | * |
||
| 222 | * @param string $commandName Value used in file comment to direct |
||
| 223 | * developers towards the appropriate way to update the autoload. |
||
| 224 | * @return string |
||
| 225 | */ |
||
| 226 | public function getAutoload( $commandName = 'AutoloadGenerator' ) { |
||
| 227 | |||
| 228 | // We need to check whether an extenson.json or skin.json exists or not, and |
||
| 229 | // incase it doesn't, update the autoload.php file. |
||
| 230 | |||
| 231 | $fileinfo = $this->getTargetFileinfo(); |
||
| 232 | |||
| 233 | if ( $fileinfo['type'] === self::FILETYPE_JSON ) { |
||
| 234 | return $this->generateJsonAutoload( $fileinfo['filename'] ); |
||
| 235 | } else { |
||
| 236 | return $this->generatePHPAutoload( $commandName, $fileinfo['filename'] ); |
||
| 237 | } |
||
| 238 | } |
||
| 239 | |||
| 240 | /** |
||
| 241 | * Returns the filename of the extension.json of skin.json, if there's any, or |
||
| 242 | * otherwise the path to the autoload.php file in an array as the "filename" |
||
| 243 | * key and with the type (AutoloadGenerator::FILETYPE_JSON or AutoloadGenerator::FILETYPE_PHP) |
||
| 244 | * of the file as the "type" key. |
||
| 245 | * |
||
| 246 | * @return array |
||
| 247 | */ |
||
| 248 | public function getTargetFileinfo() { |
||
| 249 | $fileinfo = [ |
||
| 250 | 'filename' => $this->basepath . '/autoload.php', |
||
| 251 | 'type' => self::FILETYPE_PHP |
||
| 252 | ]; |
||
| 253 | if ( file_exists( $this->basepath . '/extension.json' ) ) { |
||
| 254 | $fileinfo = [ |
||
| 255 | 'filename' => $this->basepath . '/extension.json', |
||
| 256 | 'type' => self::FILETYPE_JSON |
||
| 257 | ]; |
||
| 258 | } elseif ( file_exists( $this->basepath . '/skin.json' ) ) { |
||
| 259 | $fileinfo = [ |
||
| 260 | 'filename' => $this->basepath . '/skin.json', |
||
| 261 | 'type' => self::FILETYPE_JSON |
||
| 262 | ]; |
||
| 263 | } |
||
| 264 | |||
| 265 | return $fileinfo; |
||
| 266 | } |
||
| 267 | |||
| 268 | /** |
||
| 269 | * Ensure that Unix-style path separators ("/") are used in the path. |
||
| 270 | * |
||
| 271 | * @param string $path |
||
| 272 | * @return string |
||
| 273 | */ |
||
| 274 | protected static function normalizePathSeparator( $path ) { |
||
| 275 | return str_replace( '\\', '/', $path ); |
||
| 276 | } |
||
| 277 | |||
| 278 | /** |
||
| 279 | * Initialize the source files and directories which are used for the MediaWiki default |
||
| 280 | * autoloader in {mw-base-dir}/autoload.php including: |
||
| 281 | * * includes/ |
||
| 282 | * * languages/ |
||
| 283 | * * maintenance/ |
||
| 284 | * * mw-config/ |
||
| 285 | * * /*.php |
||
| 286 | */ |
||
| 287 | public function initMediaWikiDefault() { |
||
| 288 | foreach ( [ 'includes', 'languages', 'maintenance', 'mw-config' ] as $dir ) { |
||
| 289 | $this->readDir( $this->basepath . '/' . $dir ); |
||
| 290 | } |
||
| 291 | foreach ( glob( $this->basepath . '/*.php' ) as $file ) { |
||
| 292 | $this->readFile( $file ); |
||
| 293 | } |
||
| 294 | |||
| 295 | // Legacy aliases |
||
| 296 | $this->forceClassPath( 'DatabaseBase', |
||
| 297 | $this->basepath . '/includes/libs/rdbms/database/Database.php' ); |
||
| 298 | } |
||
| 299 | } |
||
| 300 | |||
| 301 | /** |
||
| 302 | * Reads PHP code and returns the FQCN of every class defined within it. |
||
| 303 | */ |
||
| 304 | class ClassCollector { |
||
| 305 | |||
| 306 | /** |
||
| 307 | * @var string Current namespace |
||
| 308 | */ |
||
| 309 | protected $namespace = ''; |
||
| 310 | |||
| 311 | /** |
||
| 312 | * @var array List of FQCN detected in this pass |
||
| 313 | */ |
||
| 314 | protected $classes; |
||
| 315 | |||
| 316 | /** |
||
| 317 | * @var array Token from token_get_all() that started an expect sequence |
||
| 318 | */ |
||
| 319 | protected $startToken; |
||
| 320 | |||
| 321 | /** |
||
| 322 | * @var array List of tokens that are members of the current expect sequence |
||
| 323 | */ |
||
| 324 | protected $tokens; |
||
| 325 | |||
| 326 | /** |
||
| 327 | * @var string $code PHP code (including <?php) to detect class names from |
||
| 328 | * @return array List of FQCN detected within the tokens |
||
| 329 | */ |
||
| 330 | public function getClasses( $code ) { |
||
| 331 | $this->namespace = ''; |
||
| 332 | $this->classes = []; |
||
| 333 | $this->startToken = null; |
||
|
0 ignored issues
–
show
It seems like
null of type null is incompatible with the declared type array of property $startToken.
Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property. Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property.. Loading history...
|
|||
| 334 | $this->tokens = []; |
||
| 335 | |||
| 336 | foreach ( token_get_all( $code ) as $token ) { |
||
| 337 | if ( $this->startToken === null ) { |
||
| 338 | $this->tryBeginExpect( $token ); |
||
| 339 | } else { |
||
| 340 | $this->tryEndExpect( $token ); |
||
| 341 | } |
||
| 342 | } |
||
| 343 | |||
| 344 | return $this->classes; |
||
| 345 | } |
||
| 346 | |||
| 347 | /** |
||
| 348 | * Determine if $token begins the next expect sequence. |
||
| 349 | * |
||
| 350 | * @param array $token |
||
| 351 | */ |
||
| 352 | protected function tryBeginExpect( $token ) { |
||
| 353 | if ( is_string( $token ) ) { |
||
| 354 | return; |
||
| 355 | } |
||
| 356 | switch ( $token[0] ) { |
||
| 357 | case T_NAMESPACE: |
||
| 358 | case T_CLASS: |
||
| 359 | case T_INTERFACE: |
||
| 360 | case T_TRAIT: |
||
| 361 | case T_DOUBLE_COLON: |
||
| 362 | $this->startToken = $token; |
||
| 363 | } |
||
| 364 | } |
||
| 365 | |||
| 366 | /** |
||
| 367 | * Accepts the next token in an expect sequence |
||
| 368 | * |
||
| 369 | * @param array |
||
| 370 | */ |
||
| 371 | protected function tryEndExpect( $token ) { |
||
| 372 | switch ( $this->startToken[0] ) { |
||
| 373 | case T_DOUBLE_COLON: |
||
| 374 | // Skip over T_CLASS after T_DOUBLE_COLON because this is something like |
||
| 375 | // "self::static" which accesses the class name. It doens't define a new class. |
||
| 376 | $this->startToken = null; |
||
|
0 ignored issues
–
show
It seems like
null of type null is incompatible with the declared type array of property $startToken.
Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property. Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property.. Loading history...
|
|||
| 377 | break; |
||
| 378 | case T_NAMESPACE: |
||
| 379 | if ( $token === ';' || $token === '{' ) { |
||
| 380 | $this->namespace = $this->implodeTokens() . '\\'; |
||
| 381 | } else { |
||
| 382 | $this->tokens[] = $token; |
||
| 383 | } |
||
| 384 | break; |
||
| 385 | |||
| 386 | case T_CLASS: |
||
| 387 | case T_INTERFACE: |
||
| 388 | case T_TRAIT: |
||
| 389 | $this->tokens[] = $token; |
||
| 390 | if ( is_array( $token ) && $token[0] === T_STRING ) { |
||
| 391 | $this->classes[] = $this->namespace . $this->implodeTokens(); |
||
| 392 | } |
||
| 393 | } |
||
| 394 | } |
||
| 395 | |||
| 396 | /** |
||
| 397 | * Returns the string representation of the tokens within the |
||
| 398 | * current expect sequence and resets the sequence. |
||
| 399 | * |
||
| 400 | * @return string |
||
| 401 | */ |
||
| 402 | protected function implodeTokens() { |
||
| 403 | $content = []; |
||
| 404 | foreach ( $this->tokens as $token ) { |
||
| 405 | $content[] = is_string( $token ) ? $token : $token[1]; |
||
| 406 | } |
||
| 407 | |||
| 408 | $this->tokens = []; |
||
| 409 | $this->startToken = null; |
||
|
0 ignored issues
–
show
It seems like
null of type null is incompatible with the declared type array of property $startToken.
Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property. Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property.. Loading history...
|
|||
| 410 | |||
| 411 | return trim( implode( '', $content ), " \n\t" ); |
||
| 412 | } |
||
| 413 | } |
||
| 414 |
This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.