This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Check syntax of all PHP files in MediaWiki |
||
4 | * |
||
5 | * This program is free software; you can redistribute it and/or modify |
||
6 | * it under the terms of the GNU General Public License as published by |
||
7 | * the Free Software Foundation; either version 2 of the License, or |
||
8 | * (at your option) any later version. |
||
9 | * |
||
10 | * This program is distributed in the hope that it will be useful, |
||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
13 | * GNU General Public License for more details. |
||
14 | * |
||
15 | * You should have received a copy of the GNU General Public License along |
||
16 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
17 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
18 | * http://www.gnu.org/copyleft/gpl.html |
||
19 | * |
||
20 | * @file |
||
21 | * @ingroup Maintenance |
||
22 | */ |
||
23 | |||
24 | require_once __DIR__ . '/Maintenance.php'; |
||
25 | |||
26 | /** |
||
27 | * Maintenance script to check syntax of all PHP files in MediaWiki. |
||
28 | * |
||
29 | * @ingroup Maintenance |
||
30 | */ |
||
31 | class CheckSyntax extends Maintenance { |
||
32 | |||
33 | // List of files we're going to check |
||
34 | private $mFiles = [], $mFailures = [], $mWarnings = []; |
||
0 ignored issues
–
show
|
|||
35 | private $mIgnorePaths = [], $mNoStyleCheckPaths = []; |
||
0 ignored issues
–
show
|
|||
36 | |||
37 | View Code Duplication | public function __construct() { |
|
38 | parent::__construct(); |
||
39 | $this->addDescription( 'Check syntax for all PHP files in MediaWiki' ); |
||
40 | $this->addOption( 'with-extensions', 'Also recurse the extensions folder' ); |
||
41 | $this->addOption( |
||
42 | 'path', |
||
43 | 'Specific path (file or directory) to check, either with absolute path or ' |
||
44 | . 'relative to the root of this MediaWiki installation', |
||
45 | false, |
||
46 | true |
||
47 | ); |
||
48 | $this->addOption( |
||
49 | 'list-file', |
||
50 | 'Text file containing list of files or directories to check', |
||
51 | false, |
||
52 | true |
||
53 | ); |
||
54 | $this->addOption( |
||
55 | 'modified', |
||
56 | 'Check only files that were modified (requires Git command-line client)' |
||
57 | ); |
||
58 | $this->addOption( 'syntax-only', 'Check for syntax validity only, skip code style warnings' ); |
||
59 | } |
||
60 | |||
61 | public function getDbType() { |
||
62 | return Maintenance::DB_NONE; |
||
63 | } |
||
64 | |||
65 | public function execute() { |
||
66 | $this->buildFileList(); |
||
67 | |||
68 | $this->output( "Checking syntax (using php -l, this can take a long time)\n" ); |
||
69 | foreach ( $this->mFiles as $f ) { |
||
70 | $this->checkFileWithCli( $f ); |
||
71 | if ( !$this->hasOption( 'syntax-only' ) ) { |
||
72 | $this->checkForMistakes( $f ); |
||
73 | } |
||
74 | } |
||
75 | $this->output( "\nDone! " . count( $this->mFiles ) . " files checked, " . |
||
76 | count( $this->mFailures ) . " failures and " . count( $this->mWarnings ) . |
||
77 | " warnings found\n" ); |
||
78 | } |
||
79 | |||
80 | /** |
||
81 | * Build the list of files we'll check for syntax errors |
||
82 | */ |
||
83 | private function buildFileList() { |
||
84 | global $IP; |
||
85 | |||
86 | $this->mIgnorePaths = [ |
||
87 | ]; |
||
88 | |||
89 | $this->mNoStyleCheckPaths = [ |
||
90 | // Third-party code we don't care about |
||
91 | "/activemq_stomp/", |
||
92 | "EmailPage/PHPMailer", |
||
93 | "FCKeditor/fckeditor/", |
||
94 | '\bphplot-', |
||
95 | "/svggraph/", |
||
96 | "\bjsmin.php$", |
||
97 | "PEAR/File_Ogg/", |
||
98 | "QPoll/Excel/", |
||
99 | "/geshi/", |
||
100 | "/smarty/", |
||
101 | ]; |
||
102 | |||
103 | if ( $this->hasOption( 'path' ) ) { |
||
104 | $path = $this->getOption( 'path' ); |
||
105 | if ( !$this->addPath( $path ) ) { |
||
106 | $this->error( "Error: can't find file or directory $path\n", true ); |
||
107 | } |
||
108 | |||
109 | return; // process only this path |
||
110 | } elseif ( $this->hasOption( 'list-file' ) ) { |
||
111 | $file = $this->getOption( 'list-file' ); |
||
112 | MediaWiki\suppressWarnings(); |
||
113 | $f = fopen( $file, 'r' ); |
||
114 | MediaWiki\restoreWarnings(); |
||
115 | if ( !$f ) { |
||
116 | $this->error( "Can't open file $file\n", true ); |
||
117 | } |
||
118 | $path = trim( fgets( $f ) ); |
||
119 | while ( $path ) { |
||
120 | $this->addPath( $path ); |
||
121 | } |
||
122 | fclose( $f ); |
||
123 | |||
124 | return; |
||
125 | } elseif ( $this->hasOption( 'modified' ) ) { |
||
126 | $this->output( "Retrieving list from Git... " ); |
||
127 | $files = $this->getGitModifiedFiles( $IP ); |
||
128 | $this->output( "done\n" ); |
||
129 | foreach ( $files as $file ) { |
||
130 | if ( $this->isSuitableFile( $file ) && !is_dir( $file ) ) { |
||
131 | $this->mFiles[] = $file; |
||
132 | } |
||
133 | } |
||
134 | |||
135 | return; |
||
136 | } |
||
137 | |||
138 | $this->output( 'Building file list...', 'listfiles' ); |
||
139 | |||
140 | // Only check files in these directories. |
||
141 | // Don't just put $IP, because the recursive dir thingie goes into all subdirs |
||
142 | $dirs = [ |
||
143 | $IP . '/includes', |
||
144 | $IP . '/mw-config', |
||
145 | $IP . '/languages', |
||
146 | $IP . '/maintenance', |
||
147 | $IP . '/skins', |
||
148 | ]; |
||
149 | if ( $this->hasOption( 'with-extensions' ) ) { |
||
150 | $dirs[] = $IP . '/extensions'; |
||
151 | } |
||
152 | |||
153 | foreach ( $dirs as $d ) { |
||
154 | $this->addDirectoryContent( $d ); |
||
155 | } |
||
156 | |||
157 | // Manually add two user-editable files that are usually sources of problems |
||
158 | if ( file_exists( "$IP/LocalSettings.php" ) ) { |
||
159 | $this->mFiles[] = "$IP/LocalSettings.php"; |
||
160 | } |
||
161 | |||
162 | $this->output( 'done.', 'listfiles' ); |
||
163 | } |
||
164 | |||
165 | /** |
||
166 | * Returns a list of tracked files in a Git work tree differing from the master branch. |
||
167 | * @param string $path Path to the repository |
||
168 | * @return array Resulting list of changed files |
||
169 | */ |
||
170 | private function getGitModifiedFiles( $path ) { |
||
171 | |||
172 | global $wgMaxShellMemory; |
||
173 | |||
174 | if ( !is_dir( "$path/.git" ) ) { |
||
175 | $this->error( "Error: Not a Git repository!\n", true ); |
||
176 | } |
||
177 | |||
178 | // git diff eats memory. |
||
179 | $oldMaxShellMemory = $wgMaxShellMemory; |
||
180 | if ( $wgMaxShellMemory < 1024000 ) { |
||
181 | $wgMaxShellMemory = 1024000; |
||
182 | } |
||
183 | |||
184 | $ePath = wfEscapeShellArg( $path ); |
||
185 | |||
186 | // Find an ancestor in common with master (rather than just using its HEAD) |
||
187 | // to prevent files only modified there from showing up in the list. |
||
188 | $cmd = "cd $ePath && git merge-base master HEAD"; |
||
189 | $retval = 0; |
||
190 | $output = wfShellExec( $cmd, $retval ); |
||
191 | if ( $retval !== 0 ) { |
||
192 | $this->error( "Error retrieving base SHA1 from Git!\n", true ); |
||
193 | } |
||
194 | |||
195 | // Find files in the working tree that changed since then. |
||
196 | $eBase = wfEscapeShellArg( rtrim( $output, "\n" ) ); |
||
197 | $cmd = "cd $ePath && git diff --name-only --diff-filter AM $eBase"; |
||
198 | $retval = 0; |
||
199 | $output = wfShellExec( $cmd, $retval ); |
||
200 | if ( $retval !== 0 ) { |
||
201 | $this->error( "Error retrieving list from Git!\n", true ); |
||
202 | } |
||
203 | |||
204 | $wgMaxShellMemory = $oldMaxShellMemory; |
||
205 | |||
206 | $arr = []; |
||
207 | $filename = strtok( $output, "\n" ); |
||
208 | while ( $filename !== false ) { |
||
209 | if ( $filename !== '' ) { |
||
210 | $arr[] = "$path/$filename"; |
||
211 | } |
||
212 | $filename = strtok( "\n" ); |
||
213 | } |
||
214 | |||
215 | return $arr; |
||
216 | } |
||
217 | |||
218 | /** |
||
219 | * Returns true if $file is of a type we can check |
||
220 | * @param string $file |
||
221 | * @return bool |
||
222 | */ |
||
223 | private function isSuitableFile( $file ) { |
||
224 | $file = str_replace( '\\', '/', $file ); |
||
225 | $ext = pathinfo( $file, PATHINFO_EXTENSION ); |
||
226 | if ( $ext != 'php' && $ext != 'inc' && $ext != 'php5' ) { |
||
227 | return false; |
||
228 | } |
||
229 | foreach ( $this->mIgnorePaths as $regex ) { |
||
230 | $m = []; |
||
231 | if ( preg_match( "~{$regex}~", $file, $m ) ) { |
||
232 | return false; |
||
233 | } |
||
234 | } |
||
235 | |||
236 | return true; |
||
237 | } |
||
238 | |||
239 | /** |
||
240 | * Add given path to file list, searching it in include path if needed |
||
241 | * @param string $path |
||
242 | * @return bool |
||
243 | */ |
||
244 | private function addPath( $path ) { |
||
245 | global $IP; |
||
246 | |||
247 | return $this->addFileOrDir( $path ) || $this->addFileOrDir( "$IP/$path" ); |
||
248 | } |
||
249 | |||
250 | /** |
||
251 | * Add given file to file list, or, if it's a directory, add its content |
||
252 | * @param string $path |
||
253 | * @return bool |
||
254 | */ |
||
255 | private function addFileOrDir( $path ) { |
||
256 | if ( is_dir( $path ) ) { |
||
257 | $this->addDirectoryContent( $path ); |
||
258 | } elseif ( file_exists( $path ) ) { |
||
259 | $this->mFiles[] = $path; |
||
260 | } else { |
||
261 | return false; |
||
262 | } |
||
263 | |||
264 | return true; |
||
265 | } |
||
266 | |||
267 | /** |
||
268 | * Add all suitable files in given directory or its subdirectories to the file list |
||
269 | * |
||
270 | * @param string $dir Directory to process |
||
271 | */ |
||
272 | private function addDirectoryContent( $dir ) { |
||
273 | $iterator = new RecursiveIteratorIterator( |
||
274 | new RecursiveDirectoryIterator( $dir ), |
||
275 | RecursiveIteratorIterator::SELF_FIRST |
||
276 | ); |
||
277 | foreach ( $iterator as $file ) { |
||
278 | if ( $this->isSuitableFile( $file->getRealPath() ) ) { |
||
279 | $this->mFiles[] = $file->getRealPath(); |
||
280 | } |
||
281 | } |
||
282 | } |
||
283 | |||
284 | /** |
||
285 | * Check a file for syntax errors using php -l |
||
286 | * @param string $file Path to a file to check for syntax errors |
||
287 | * @return bool |
||
288 | */ |
||
289 | private function checkFileWithCli( $file ) { |
||
290 | $res = exec( 'php -l ' . wfEscapeShellArg( $file ) ); |
||
291 | if ( strpos( $res, 'No syntax errors detected' ) === false ) { |
||
292 | $this->mFailures[$file] = $res; |
||
293 | $this->output( $res . "\n" ); |
||
294 | |||
295 | return false; |
||
296 | } |
||
297 | |||
298 | return true; |
||
299 | } |
||
300 | |||
301 | /** |
||
302 | * Check a file for non-fatal coding errors, such as byte-order marks in the beginning |
||
303 | * or pointless ?> closing tags at the end. |
||
304 | * |
||
305 | * @param string $file String Path to a file to check for errors |
||
306 | */ |
||
307 | private function checkForMistakes( $file ) { |
||
308 | foreach ( $this->mNoStyleCheckPaths as $regex ) { |
||
309 | $m = []; |
||
310 | if ( preg_match( "~{$regex}~", $file, $m ) ) { |
||
311 | return; |
||
312 | } |
||
313 | } |
||
314 | |||
315 | $text = file_get_contents( $file ); |
||
316 | $tokens = token_get_all( $text ); |
||
317 | |||
318 | $this->checkEvilToken( $file, $tokens, '@', 'Error supression operator (@)' ); |
||
319 | $this->checkRegex( $file, $text, '/^[\s\r\n]+<\?/', 'leading whitespace' ); |
||
320 | $this->checkRegex( $file, $text, '/\?>[\s\r\n]*$/', 'trailing ?>' ); |
||
321 | $this->checkRegex( $file, $text, '/^[\xFF\xFE\xEF]/', 'byte-order mark' ); |
||
322 | } |
||
323 | |||
324 | View Code Duplication | private function checkRegex( $file, $text, $regex, $desc ) { |
|
325 | if ( !preg_match( $regex, $text ) ) { |
||
326 | return; |
||
327 | } |
||
328 | |||
329 | if ( !isset( $this->mWarnings[$file] ) ) { |
||
330 | $this->mWarnings[$file] = []; |
||
331 | } |
||
332 | $this->mWarnings[$file][] = $desc; |
||
333 | $this->output( "Warning in file $file: $desc found.\n" ); |
||
334 | } |
||
335 | |||
336 | View Code Duplication | private function checkEvilToken( $file, $tokens, $evilToken, $desc ) { |
|
337 | if ( !in_array( $evilToken, $tokens ) ) { |
||
338 | return; |
||
339 | } |
||
340 | |||
341 | if ( !isset( $this->mWarnings[$file] ) ) { |
||
342 | $this->mWarnings[$file] = []; |
||
343 | } |
||
344 | $this->mWarnings[$file][] = $desc; |
||
345 | $this->output( "Warning in file $file: $desc found.\n" ); |
||
346 | } |
||
347 | } |
||
348 | |||
349 | $maintClass = "CheckSyntax"; |
||
350 | require_once RUN_MAINTENANCE_IF_MAIN; |
||
351 |
Only declaring a single property per statement allows you to later on add doc comments more easily.
It is also recommended by PSR2, so it is a common style that many people expect.