wikimedia /
mediawiki
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * Maintenance script that recursively scans MediaWiki's PHP source tree |
||
| 4 | * for deprecated functions and methods and pretty-prints the results. |
||
| 5 | * |
||
| 6 | * This program is free software; you can redistribute it and/or modify |
||
| 7 | * it under the terms of the GNU General Public License as published by |
||
| 8 | * the Free Software Foundation; either version 2 of the License, or |
||
| 9 | * (at your option) any later version. |
||
| 10 | * |
||
| 11 | * This program is distributed in the hope that it will be useful, |
||
| 12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 14 | * GNU General Public License for more details. |
||
| 15 | * |
||
| 16 | * You should have received a copy of the GNU General Public License along |
||
| 17 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
| 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
| 19 | * http://www.gnu.org/copyleft/gpl.html |
||
| 20 | * |
||
| 21 | * @file |
||
| 22 | * @ingroup Maintenance |
||
| 23 | */ |
||
| 24 | |||
| 25 | require_once __DIR__ . '/Maintenance.php'; |
||
| 26 | require_once __DIR__ . '/../vendor/autoload.php'; |
||
| 27 | |||
| 28 | /** |
||
| 29 | * A PHPParser node visitor that associates each node with its file name. |
||
| 30 | */ |
||
| 31 | class FileAwareNodeVisitor extends PhpParser\NodeVisitorAbstract { |
||
| 32 | private $currentFile = null; |
||
| 33 | |||
| 34 | public function enterNode( PhpParser\Node $node ) { |
||
| 35 | $retVal = parent::enterNode( $node ); |
||
| 36 | $node->filename = $this->currentFile; |
||
| 37 | return $retVal; |
||
| 38 | } |
||
| 39 | |||
| 40 | public function setCurrentFile( $filename ) { |
||
| 41 | $this->currentFile = $filename; |
||
| 42 | } |
||
| 43 | |||
| 44 | public function getCurrentFile() { |
||
| 45 | return $this->currentFile; |
||
| 46 | } |
||
| 47 | } |
||
| 48 | |||
| 49 | /** |
||
| 50 | * A PHPParser node visitor that finds deprecated functions and methods. |
||
| 51 | */ |
||
| 52 | class DeprecatedInterfaceFinder extends FileAwareNodeVisitor { |
||
| 53 | |||
| 54 | private $currentClass = null; |
||
| 55 | |||
| 56 | private $foundNodes = []; |
||
| 57 | |||
| 58 | public function getFoundNodes() { |
||
| 59 | // Sort results by version, then by filename, then by name. |
||
| 60 | foreach ( $this->foundNodes as $version => &$nodes ) { |
||
| 61 | uasort( $nodes, function ( $a, $b ) { |
||
| 62 | return ( $a['filename'] . $a['name'] ) < ( $b['filename'] . $b['name'] ) ? -1 : 1; |
||
| 63 | } ); |
||
| 64 | } |
||
| 65 | ksort( $this->foundNodes ); |
||
| 66 | return $this->foundNodes; |
||
| 67 | } |
||
| 68 | |||
| 69 | /** |
||
| 70 | * Check whether a function or method includes a call to wfDeprecated(), |
||
| 71 | * indicating that it is a hard-deprecated interface. |
||
| 72 | */ |
||
| 73 | public function isHardDeprecated( PhpParser\Node $node ) { |
||
| 74 | if ( !$node->stmts ) { |
||
|
0 ignored issues
–
show
|
|||
| 75 | return false; |
||
| 76 | } |
||
| 77 | foreach ( $node->stmts as $stmt ) { |
||
| 78 | if ( |
||
| 79 | $stmt instanceof PhpParser\Node\Expr\FuncCall |
||
| 80 | && $stmt->name->toString() === 'wfDeprecated' |
||
| 81 | ) { |
||
| 82 | return true; |
||
| 83 | } |
||
| 84 | return false; |
||
| 85 | } |
||
| 86 | } |
||
| 87 | |||
| 88 | public function enterNode( PhpParser\Node $node ) { |
||
| 89 | $retVal = parent::enterNode( $node ); |
||
| 90 | |||
| 91 | if ( $node instanceof PhpParser\Node\Stmt\ClassLike ) { |
||
| 92 | $this->currentClass = $node->name; |
||
| 93 | } |
||
| 94 | |||
| 95 | if ( $node instanceof PhpParser\Node\FunctionLike ) { |
||
| 96 | $docComment = $node->getDocComment(); |
||
| 97 | if ( !$docComment ) { |
||
| 98 | return; |
||
| 99 | } |
||
| 100 | if ( !preg_match( '/@deprecated.*(\d+\.\d+)/', $docComment->getText(), $matches ) ) { |
||
| 101 | return; |
||
| 102 | } |
||
| 103 | $version = $matches[1]; |
||
| 104 | |||
| 105 | if ( $node instanceof PhpParser\Node\Stmt\ClassMethod ) { |
||
| 106 | $name = $this->currentClass . '::' . $node->name; |
||
| 107 | } else { |
||
| 108 | $name = $node->name; |
||
| 109 | } |
||
| 110 | |||
| 111 | $this->foundNodes[ $version ][] = [ |
||
| 112 | 'filename' => $node->filename, |
||
| 113 | 'line' => $node->getLine(), |
||
| 114 | 'name' => $name, |
||
| 115 | 'hard' => $this->isHardDeprecated( $node ), |
||
| 116 | ]; |
||
| 117 | } |
||
| 118 | |||
| 119 | return $retVal; |
||
| 120 | } |
||
| 121 | } |
||
| 122 | |||
| 123 | /** |
||
| 124 | * Maintenance task that recursively scans MediaWiki PHP files for deprecated |
||
| 125 | * functions and interfaces and produces a report. |
||
| 126 | */ |
||
| 127 | class FindDeprecated extends Maintenance { |
||
| 128 | public function __construct() { |
||
| 129 | parent::__construct(); |
||
| 130 | $this->addDescription( 'Find deprecated interfaces' ); |
||
| 131 | } |
||
| 132 | |||
| 133 | public function getFiles() { |
||
| 134 | global $IP; |
||
| 135 | |||
| 136 | $files = new RecursiveDirectoryIterator( $IP . '/includes' ); |
||
| 137 | $files = new RecursiveIteratorIterator( $files ); |
||
| 138 | $files = new RegexIterator( $files, '/\.php$/' ); |
||
| 139 | return iterator_to_array( $files, false ); |
||
| 140 | } |
||
| 141 | |||
| 142 | public function execute() { |
||
| 143 | global $IP; |
||
| 144 | |||
| 145 | $files = $this->getFiles(); |
||
| 146 | $chunkSize = ceil( count( $files ) / 72 ); |
||
| 147 | |||
| 148 | $parser = ( new PhpParser\ParserFactory )->create( PhpParser\ParserFactory::PREFER_PHP7 ); |
||
| 149 | $traverser = new PhpParser\NodeTraverser; |
||
| 150 | $finder = new DeprecatedInterfaceFinder; |
||
| 151 | $traverser->addVisitor( $finder ); |
||
| 152 | |||
| 153 | $fileCount = count( $files ); |
||
| 154 | |||
| 155 | for ( $i = 0; $i < $fileCount; $i++ ) { |
||
| 156 | $file = $files[$i]; |
||
| 157 | $code = file_get_contents( $file ); |
||
| 158 | |||
| 159 | if ( strpos( $code, '@deprecated' ) === -1 ) { |
||
| 160 | continue; |
||
| 161 | } |
||
| 162 | |||
| 163 | $finder->setCurrentFile( substr( $file->getPathname(), strlen( $IP ) + 1 ) ); |
||
| 164 | $nodes = $parser->parse( $code, [ 'throwOnError' => false ] ); |
||
| 165 | $traverser->traverse( $nodes ); |
||
| 166 | |||
| 167 | if ( $i % $chunkSize === 0 ) { |
||
| 168 | $percentDone = 100 * $i / $fileCount; |
||
| 169 | fprintf( STDERR, "\r[%-72s] %d%%", str_repeat( '#', $i / $chunkSize ), $percentDone ); |
||
| 170 | } |
||
| 171 | } |
||
| 172 | |||
| 173 | fprintf( STDERR, "\r[%'#-72s] 100%%\n", '' ); |
||
| 174 | |||
| 175 | // Colorize output if STDOUT is an interactive terminal. |
||
| 176 | if ( posix_isatty( STDOUT ) ) { |
||
| 177 | $versionFmt = "\n* Deprecated since \033[37;1m%s\033[0m:\n"; |
||
| 178 | $entryFmt = " %s \033[33;1m%s\033[0m (%s:%d)\n"; |
||
| 179 | } else { |
||
| 180 | $versionFmt = "\n* Deprecated since %s:\n"; |
||
| 181 | $entryFmt = " %s %s (%s:%d)\n"; |
||
| 182 | } |
||
| 183 | |||
| 184 | foreach ( $finder->getFoundNodes() as $version => $nodes ) { |
||
| 185 | printf( $versionFmt, $version ); |
||
| 186 | foreach ( $nodes as $node ) { |
||
| 187 | printf( |
||
| 188 | $entryFmt, |
||
| 189 | $node['hard'] ? '+' : '-', |
||
| 190 | $node['name'], |
||
| 191 | $node['filename'], |
||
| 192 | $node['line'] |
||
| 193 | ); |
||
| 194 | } |
||
| 195 | } |
||
| 196 | printf( "\nlegend:\n -: soft-deprecated\n +: hard-deprecated (via wfDeprecated())\n" ); |
||
| 197 | } |
||
| 198 | } |
||
| 199 | |||
| 200 | $maintClass = 'FindDeprecated'; |
||
| 201 | require_once RUN_MAINTENANCE_IF_MAIN; |
||
| 202 |
If you access a property on an interface, you most likely code against a concrete implementation of the interface.
Available Fixes
Adding an additional type check:
Changing the type hint: