This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Simple script that try to find documented hook and hooks actually |
||
4 | * in the code and show what's missing. |
||
5 | * |
||
6 | * This script assumes that: |
||
7 | * - hooks names in hooks.txt are at the beginning of a line and single quoted. |
||
8 | * - hooks names in code are the first parameter of wfRunHooks. |
||
9 | * |
||
10 | * if --online option is passed, the script will compare the hooks in the code |
||
11 | * with the ones at https://www.mediawiki.org/wiki/Manual:Hooks |
||
12 | * |
||
13 | * Any instance of wfRunHooks that doesn't meet these parameters will be noted. |
||
14 | * |
||
15 | * Copyright © Antoine Musso |
||
16 | * |
||
17 | * This program is free software; you can redistribute it and/or modify |
||
18 | * it under the terms of the GNU General Public License as published by |
||
19 | * the Free Software Foundation; either version 2 of the License, or |
||
20 | * (at your option) any later version. |
||
21 | * |
||
22 | * This program is distributed in the hope that it will be useful, |
||
23 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
24 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
25 | * GNU General Public License for more details. |
||
26 | * |
||
27 | * You should have received a copy of the GNU General Public License along |
||
28 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
29 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
30 | * http://www.gnu.org/copyleft/gpl.html |
||
31 | * |
||
32 | * @file |
||
33 | * @ingroup Maintenance |
||
34 | * @author Antoine Musso <hashar at free dot fr> |
||
35 | */ |
||
36 | |||
37 | require_once __DIR__ . '/Maintenance.php'; |
||
38 | |||
39 | /** |
||
40 | * Maintenance script that compares documented and actually present mismatches. |
||
41 | * |
||
42 | * @ingroup Maintenance |
||
43 | */ |
||
44 | class FindHooks extends Maintenance { |
||
45 | const FIND_NON_RECURSIVE = 0; |
||
46 | const FIND_RECURSIVE = 1; |
||
47 | |||
48 | /* |
||
49 | * Hooks that are ignored |
||
50 | */ |
||
51 | protected static $ignore = [ 'testRunLegacyHooks', 'Test' ]; |
||
52 | |||
53 | public function __construct() { |
||
54 | parent::__construct(); |
||
55 | $this->addDescription( 'Find hooks that are undocumented, missing, or just plain wrong' ); |
||
56 | $this->addOption( 'online', 'Check against MediaWiki.org hook documentation' ); |
||
57 | } |
||
58 | |||
59 | public function getDbType() { |
||
60 | return Maintenance::DB_NONE; |
||
61 | } |
||
62 | |||
63 | public function execute() { |
||
64 | global $IP; |
||
65 | |||
66 | $documentedHooks = $this->getHooksFromDoc( $IP . '/docs/hooks.txt' ); |
||
67 | $potentialHooks = []; |
||
68 | $badHooks = []; |
||
69 | |||
70 | $recurseDirs = [ |
||
71 | "$IP/includes/", |
||
72 | "$IP/mw-config/", |
||
73 | "$IP/languages/", |
||
74 | "$IP/maintenance/", |
||
75 | // Omit $IP/tests/phpunit as it contains hook tests that shouldn't be documented |
||
76 | "$IP/tests/parser", |
||
77 | "$IP/tests/phpunit/suites", |
||
78 | ]; |
||
79 | $nonRecurseDirs = [ |
||
80 | "$IP/", |
||
81 | ]; |
||
82 | |||
83 | View Code Duplication | foreach ( $recurseDirs as $dir ) { |
|
84 | $ret = $this->getHooksFromDir( $dir, self::FIND_RECURSIVE ); |
||
85 | $potentialHooks = array_merge( $potentialHooks, $ret['good'] ); |
||
86 | $badHooks = array_merge( $badHooks, $ret['bad'] ); |
||
87 | } |
||
88 | View Code Duplication | foreach ( $nonRecurseDirs as $dir ) { |
|
89 | $ret = $this->getHooksFromDir( $dir ); |
||
90 | $potentialHooks = array_merge( $potentialHooks, $ret['good'] ); |
||
91 | $badHooks = array_merge( $badHooks, $ret['bad'] ); |
||
92 | } |
||
93 | |||
94 | $documented = array_keys( $documentedHooks ); |
||
95 | $potential = array_keys( $potentialHooks ); |
||
96 | $potential = array_unique( $potential ); |
||
97 | $badHooks = array_diff( array_unique( $badHooks ), self::$ignore ); |
||
98 | $todo = array_diff( $potential, $documented, self::$ignore ); |
||
99 | $deprecated = array_diff( $documented, $potential, self::$ignore ); |
||
100 | |||
101 | // Check parameter count and references |
||
102 | $badParameterCount = $badParameterReference = []; |
||
103 | foreach ( $potentialHooks as $hook => $args ) { |
||
104 | if ( !isset( $documentedHooks[$hook] ) ) { |
||
105 | // Not documented, but that will also be in $todo |
||
106 | continue; |
||
107 | } |
||
108 | $argsDoc = $documentedHooks[$hook]; |
||
109 | if ( $args === 'unknown' || $argsDoc === 'unknown' ) { |
||
110 | // Could not get parameter information |
||
111 | continue; |
||
112 | } |
||
113 | if ( count( $argsDoc ) !== count( $args ) ) { |
||
114 | $badParameterCount[] = $hook . ': Doc: ' . count( $argsDoc ) . ' vs. Code: ' . count( $args ); |
||
115 | } else { |
||
116 | // Check if & is equal |
||
117 | foreach ( $argsDoc as $index => $argDoc ) { |
||
118 | $arg = $args[$index]; |
||
119 | if ( ( $arg[0] === '&' ) !== ( $argDoc[0] === '&' ) ) { |
||
120 | $badParameterReference[] = $hook . ': References different: Doc: ' . $argDoc . |
||
121 | ' vs. Code: ' . $arg; |
||
122 | } |
||
123 | } |
||
124 | } |
||
125 | } |
||
126 | |||
127 | // Print the results |
||
128 | $this->printArray( 'Undocumented', $todo ); |
||
129 | $this->printArray( 'Documented and not found', $deprecated ); |
||
130 | $this->printArray( 'Unclear hook calls', $badHooks ); |
||
131 | $this->printArray( 'Different parameter count', $badParameterCount ); |
||
132 | $this->printArray( 'Different parameter reference', $badParameterReference ); |
||
133 | |||
134 | if ( !$todo && !$deprecated && !$badHooks |
||
135 | && !$badParameterCount && !$badParameterReference |
||
136 | ) { |
||
137 | $this->output( "Looks good!\n" ); |
||
138 | } else { |
||
139 | $this->error( 'The script finished with errors.', 1 ); |
||
140 | } |
||
141 | } |
||
142 | |||
143 | /** |
||
144 | * Get the hook documentation, either locally or from MediaWiki.org |
||
145 | * @param string $doc |
||
146 | * @return array Array: key => hook name; value => array of arguments or string 'unknown' |
||
147 | */ |
||
148 | private function getHooksFromDoc( $doc ) { |
||
149 | if ( $this->hasOption( 'online' ) ) { |
||
150 | return $this->getHooksFromOnlineDoc(); |
||
151 | } else { |
||
152 | return $this->getHooksFromLocalDoc( $doc ); |
||
153 | } |
||
154 | } |
||
155 | |||
156 | /** |
||
157 | * Get hooks from a local file (for example docs/hooks.txt) |
||
158 | * @param string $doc Filename to look in |
||
159 | * @return array Array: key => hook name; value => array of arguments or string 'unknown' |
||
160 | */ |
||
161 | private function getHooksFromLocalDoc( $doc ) { |
||
162 | $m = []; |
||
163 | $content = file_get_contents( $doc ); |
||
164 | preg_match_all( |
||
165 | "/\n'(.*?)':.*((?:\n.+)*)/", |
||
166 | $content, |
||
167 | $m, |
||
168 | PREG_SET_ORDER |
||
169 | ); |
||
170 | |||
171 | // Extract the documented parameter |
||
172 | $hooks = []; |
||
173 | foreach ( $m as $match ) { |
||
174 | $args = []; |
||
175 | if ( isset( $match[2] ) ) { |
||
176 | $n = []; |
||
177 | if ( preg_match_all( "/\n(&?\\$\w+):.+/", $match[2], $n ) ) { |
||
178 | $args = $n[1]; |
||
179 | } |
||
180 | } |
||
181 | $hooks[$match[1]] = $args; |
||
182 | } |
||
183 | return $hooks; |
||
184 | } |
||
185 | |||
186 | /** |
||
187 | * Get hooks from www.mediawiki.org using the API |
||
188 | * @return array Array: key => hook name; value => string 'unknown' |
||
189 | */ |
||
190 | private function getHooksFromOnlineDoc() { |
||
191 | $allhooks = $this->getHooksFromOnlineDocCategory( 'MediaWiki_hooks' ); |
||
192 | $removed = $this->getHooksFromOnlineDocCategory( 'Removed_hooks' ); |
||
193 | return array_diff_key( $allhooks, $removed ); |
||
194 | } |
||
195 | |||
196 | /** |
||
197 | * @param string $title |
||
198 | * @return array |
||
199 | */ |
||
200 | private function getHooksFromOnlineDocCategory( $title ) { |
||
201 | $params = [ |
||
202 | 'action' => 'query', |
||
203 | 'list' => 'categorymembers', |
||
204 | 'cmtitle' => "Category:$title", |
||
205 | 'cmlimit' => 500, |
||
206 | 'format' => 'json', |
||
207 | 'continue' => '', |
||
208 | ]; |
||
209 | |||
210 | $retval = []; |
||
211 | while ( true ) { |
||
212 | $json = Http::get( |
||
213 | wfAppendQuery( 'http://www.mediawiki.org/w/api.php', $params ), |
||
214 | [], |
||
215 | __METHOD__ |
||
216 | ); |
||
217 | $data = FormatJson::decode( $json, true ); |
||
0 ignored issues
–
show
|
|||
218 | foreach ( $data['query']['categorymembers'] as $page ) { |
||
219 | if ( preg_match( '/Manual\:Hooks\/([a-zA-Z0-9- :]+)/', $page['title'], $m ) ) { |
||
220 | // parameters are unknown, because that needs parsing of wikitext |
||
221 | $retval[str_replace( ' ', '_', $m[1] )] = 'unknown'; |
||
222 | } |
||
223 | } |
||
224 | if ( !isset( $data['continue'] ) ) { |
||
225 | return $retval; |
||
226 | } |
||
227 | $params = array_replace( $params, $data['continue'] ); |
||
228 | } |
||
229 | } |
||
230 | |||
231 | /** |
||
232 | * Get hooks from a PHP file |
||
233 | * @param string $filePath Full file path to the PHP file. |
||
234 | * @return array Array: key => hook name; value => array of arguments or string 'unknown' |
||
235 | */ |
||
236 | private function getHooksFromFile( $filePath ) { |
||
237 | $content = file_get_contents( $filePath ); |
||
238 | $m = []; |
||
239 | preg_match_all( |
||
240 | // All functions which runs hooks |
||
241 | '/(?:wfRunHooks|Hooks\:\:run|ContentHandler\:\:runLegacyHooks)\s*\(\s*' . |
||
242 | // First argument is the hook name as string |
||
243 | '([\'"])(.*?)\1' . |
||
244 | // Comma for second argument |
||
245 | '(?:\s*(,))?' . |
||
246 | // Second argument must start with array to be processed |
||
247 | '(?:\s*(?:array\s*\(|\[)' . |
||
248 | // Matching inside array - allows one deep of brackets |
||
249 | '((?:[^\(\)\[\]]|\((?-1)\)|\[(?-1)\])*)' . |
||
250 | // End |
||
251 | '[\)\]])?/', |
||
252 | $content, |
||
253 | $m, |
||
254 | PREG_SET_ORDER |
||
255 | ); |
||
256 | |||
257 | // Extract parameter |
||
258 | $hooks = []; |
||
259 | foreach ( $m as $match ) { |
||
260 | $args = []; |
||
261 | if ( isset( $match[4] ) ) { |
||
262 | $n = []; |
||
263 | if ( preg_match_all( '/((?:[^,\(\)]|\([^\(\)]*\))+)/', $match[4], $n ) ) { |
||
264 | $args = array_map( 'trim', $n[1] ); |
||
265 | } |
||
266 | } elseif ( isset( $match[3] ) ) { |
||
267 | // Found a parameter for Hooks::run, |
||
268 | // but could not extract the hooks argument, |
||
269 | // because there are given by a variable |
||
270 | $args = 'unknown'; |
||
271 | } |
||
272 | $hooks[$match[2]] = $args; |
||
273 | } |
||
274 | |||
275 | return $hooks; |
||
276 | } |
||
277 | |||
278 | /** |
||
279 | * Get bad hooks (where the hook name could not be determined) from a PHP file |
||
280 | * @param string $filePath Full filename to the PHP file. |
||
281 | * @return array Array of bad wfRunHooks() lines |
||
282 | */ |
||
283 | private function getBadHooksFromFile( $filePath ) { |
||
284 | $content = file_get_contents( $filePath ); |
||
285 | $m = []; |
||
286 | // We want to skip the "function wfRunHooks()" one. :) |
||
287 | preg_match_all( '/(?<!function )wfRunHooks\(\s*[^\s\'"].*/', $content, $m ); |
||
288 | $list = []; |
||
289 | foreach ( $m[0] as $match ) { |
||
290 | $list[] = $match . "(" . $filePath . ")"; |
||
291 | } |
||
292 | |||
293 | return $list; |
||
294 | } |
||
295 | |||
296 | /** |
||
297 | * Get hooks from a directory of PHP files. |
||
298 | * @param string $dir Directory path to start at |
||
299 | * @param int $recursive Pass self::FIND_RECURSIVE |
||
300 | * @return array Array: key => hook name; value => array of arguments or string 'unknown' |
||
301 | */ |
||
302 | private function getHooksFromDir( $dir, $recurse = 0 ) { |
||
303 | $good = []; |
||
304 | $bad = []; |
||
305 | |||
306 | if ( $recurse === self::FIND_RECURSIVE ) { |
||
307 | $iterator = new RecursiveIteratorIterator( |
||
308 | new RecursiveDirectoryIterator( $dir, RecursiveDirectoryIterator::SKIP_DOTS ), |
||
309 | RecursiveIteratorIterator::SELF_FIRST |
||
310 | ); |
||
311 | } else { |
||
312 | $iterator = new DirectoryIterator( $dir ); |
||
313 | } |
||
314 | |||
315 | foreach ( $iterator as $info ) { |
||
316 | // Ignore directories, work only on php files, |
||
317 | if ( $info->isFile() && in_array( $info->getExtension(), [ 'php', 'inc' ] ) |
||
318 | // Skip this file as it contains text that looks like a bad wfRunHooks() call |
||
319 | && $info->getRealPath() !== __FILE__ |
||
320 | ) { |
||
321 | $good = array_merge( $good, $this->getHooksFromFile( $info->getRealPath() ) ); |
||
322 | $bad = array_merge( $bad, $this->getBadHooksFromFile( $info->getRealPath() ) ); |
||
323 | } |
||
324 | } |
||
325 | |||
326 | return [ 'good' => $good, 'bad' => $bad ]; |
||
327 | } |
||
328 | |||
329 | /** |
||
330 | * Nicely sort an print an array |
||
331 | * @param string $msg A message to show before the value |
||
332 | * @param array $arr |
||
333 | */ |
||
334 | private function printArray( $msg, $arr ) { |
||
335 | asort( $arr ); |
||
336 | |||
337 | foreach ( $arr as $v ) { |
||
338 | $this->output( "$msg: $v\n" ); |
||
339 | } |
||
340 | } |
||
341 | } |
||
342 | |||
343 | $maintClass = 'FindHooks'; |
||
344 | require_once RUN_MAINTENANCE_IF_MAIN; |
||
345 |
If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check:
If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue.