Skip to content

Commit 6d63c78

Browse files
MaikuolanMaikuolan
committed
Improve escaping.
1 parent 7b49480 commit 6d63c78

File tree

5 files changed

+32
-28
lines changed

5 files changed

+32
-28
lines changed

‎Changelog.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,3 +139,7 @@ __*Why "v3.0.0" instead of "v1.0.0?"*__ Prior to phpMussel v3, the "phpMussel Co
139139
### 3.4.2
140140

141141
[2022.11.22; Maikuolan]: Maintenance release.
142+
143+
### v3.5.0
144+
145+
[2023.12.01; Maikuolan]: Improve escaping.

‎src/Loader.php

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: The loader (last modified: 2023.10.12).
11+
* This file: The loader (last modified: 2023.12.01).
1212
*/
1313

1414
namespace phpMussel\Core;
@@ -802,15 +802,15 @@ public function buildPath(string $Path, bool $PointsToFile = true): string
802802
$Restrictions = strlen(ini_get('open_basedir')) > 0;
803803

804804
/** Split path into steps. */
805-
$Steps = preg_split('~[\\\/]~', $Path, -1, PREG_SPLIT_NO_EMPTY);
805+
$Steps = preg_split('~[\\\\/]~', $Path, -1, PREG_SPLIT_NO_EMPTY);
806806

807807
/** Separate file from path. */
808808
$File = $PointsToFile ? array_pop($Steps) : '';
809809

810810
/** Build directories. */
811811
foreach ($Steps as $Step) {
812812
if (!isset($Rebuilt)) {
813-
$Rebuilt = preg_match('~^[\\\/]~', $Path) ? DIRECTORY_SEPARATOR . $Step : $Step;
813+
$Rebuilt = preg_match('~^[\\\\/]~', $Path) ? DIRECTORY_SEPARATOR . $Step : $Step;
814814
} else {
815815
$Rebuilt .= DIRECTORY_SEPARATOR . $Step;
816816
}
@@ -1102,7 +1102,7 @@ public function logRotation(string $Pattern): bool
11021102
*/
11031103
public function resolvePaths(string $Base, bool $LastIsFile = true, bool $GZ = true): \Generator
11041104
{
1105-
$Steps = preg_split('~[\\\/]~', $Base, -1, PREG_SPLIT_NO_EMPTY);
1105+
$Steps = preg_split('~[\\\\/]~', $Base, -1, PREG_SPLIT_NO_EMPTY);
11061106
$LastStep = $LastIsFile ? array_pop($Steps) : '';
11071107
$BaseFrom = '';
11081108
$Remainder = '';
@@ -1120,8 +1120,8 @@ public function resolvePaths(string $Base, bool $LastIsFile = true, bool $GZ = t
11201120
$LastStep = DIRECTORY_SEPARATOR . $LastStep;
11211121
}
11221122
$Steps = preg_replace(
1123-
['~\\\{(?:dd|mm|yy|hh|ii|ss)\\\}~i', '~\\\{yyyy\\\}~i', '~\\\{(?:Day|Mon)\\\}~i', '~\\\{tz\\\}~i', '~\\\{t\\\:z\\\}~i'],
1124-
['\d{2}', '\d{4}', '\w{3}', '.{1,2}\d{4}', '.{1,2}\d{2}\:\d{2}'],
1123+
['~\\{(?:dd|mm|yy|hh|ii|ss)\\}~i', '~\\{yyyy\\}~i', '~\\{(?:Day|Mon)\\}~i', '~\\{tz\\}~i', '~\\{t:z\\}~i'],
1124+
['\d{2}', '\d{4}', '\w{3}', '.{1,2}\d{4}', '.{1,2}\d{2}:\d{2}'],
11251125
preg_quote($Remainder) . ($LastStep ? preg_quote($LastStep) . ($GZ ? '(?:\.gz)?' : '') . '$' : '')
11261126
);
11271127
$Pattern = '~^' . preg_quote($BaseFrom) . $Steps . '~i';
@@ -1179,7 +1179,7 @@ public function updateConfiguration(): bool
11791179
} elseif (is_string($DirValue)) {
11801180
/** Multiline support. */
11811181
$DirValue = preg_replace('~[^\x00-\xFF]~', '', str_replace(
1182-
["\\", "\0", "\7", "\8", "\t", "\n", "\x0B", "\x0C", "\r", "\x1B"],
1182+
['\\', "\0", "\7", "\8", "\t", "\n", "\x0B", "\x0C", "\r", "\x1B"],
11831183
["\\\\", '\0', '\a', '\b', '\t', '\n', '\v', '\f', '\r', '\e'],
11841184
$DirValue
11851185
));
@@ -1241,7 +1241,7 @@ private function decodeForMultilineSupport(): void
12411241
}
12421242
$DirVal = str_replace(
12431243
["\\\\", '\0', '\a', '\b', '\t', '\n', '\v', '\f', '\r', '\e'],
1244-
["\\", "\0", "\7", "\8", "\t", "\n", "\x0B", "\x0C", "\r", "\x1B"],
1244+
['\\', "\0", "\7", "\8", "\t", "\n", "\x0B", "\x0C", "\r", "\x1B"],
12451245
$DirVal
12461246
);
12471247
}

‎src/Scanner.php

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: The scanner (last modified: 2023.09.25).
11+
* This file: The scanner (last modified: 2023.12.01).
1212
*/
1313

1414
namespace phpMussel\Core;
@@ -380,7 +380,7 @@ public function directoryRecursiveList(string $Base, bool $Directories = false):
380380
$Offset = strlen($Base);
381381
$List = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($Base), \RecursiveIteratorIterator::SELF_FIRST);
382382
foreach ($List as $Item => $List) {
383-
if (preg_match('~^(?:/\.\.|./\.|\.{3})$~', str_replace("\\", '/', substr($Item, -3))) || !is_readable($Item)) {
383+
if (preg_match('~^(?:/\.\.|./\.|\.{3})$~', str_replace('\\', '/', substr($Item, -3))) || !is_readable($Item)) {
384384
continue;
385385
}
386386
if (is_dir($Item) && !$Directories) {
@@ -783,7 +783,7 @@ private function recursor($Files = '', int $Depth = -1): void
783783
if (is_dir($Files)) {
784784
if (!is_readable($Files)) {
785785
$this->Loader->InstanceCache['ScanErrors']++;
786-
$this->atHit('', -1, preg_replace(['~[\x00-\x1F]~', '~^[\\\/]~'], '', $Files), sprintf(
786+
$this->atHit('', -1, preg_replace(['~[\x00-\x1F]~', '~^[\\\\/]~'], '', $Files), sprintf(
787787
$this->Loader->L10N->getString('grammar_exclamation_mark'),
788788
sprintf($this->Loader->L10N->getString('response.Failed to access %s'), $OriginalFilename)
789789
), -5, $Depth);
@@ -810,7 +810,7 @@ private function recursor($Files = '', int $Depth = -1): void
810810
$this->resetHeuristics();
811811

812812
/** Ensure that the original filename doesn't break lines and clean it up. */
813-
$OriginalFilenameClean = preg_replace(['~[\x00-\x1F]~', '~^[\\\/]~'], '', $OriginalFilename);
813+
$OriginalFilenameClean = preg_replace(['~[\x00-\x1F]~', '~^[\\\\/]~'], '', $OriginalFilename);
814814

815815
/** Indenting to apply for "checking" . */
816816
$Indent = str_pad('→ ', ($Depth < 1 ? 4 : ($Depth * 3) + 4), '─', STR_PAD_LEFT);
@@ -1728,7 +1728,7 @@ private function dataHandler(string $str = '', int $Depth = 0, string $OriginalF
17281728
) {
17291729
$this->Loader->InstanceCache['LookupCount'] = 0;
17301730
$URLScanner = [
1731-
'FixedSource' => preg_replace('~(data|f(ile|tps?)|https?|sftp):~i', "\x01\\1:", str_replace("\\", '/', $str_norm)) . "\1",
1731+
'FixedSource' => preg_replace('~(data|f(ile|tps?)|https?|sftp):~i', "\x01\\1:", str_replace('\\', '/', $str_norm)) . "\1",
17321732
'DomainsNoLookup' => [],
17331733
'DomainsCount' => 0,
17341734
'Domains' => [],
@@ -3003,8 +3003,8 @@ private function archiveRecursor(string $Data, string $File = '', int $ScanDepth
30033003

30043004
/** Fetch and prepare filename. */
30053005
if ($Filename = $ArchiveObject->EntryName()) {
3006-
while (strpos($Filename, "\\") !== false || strpos($Filename, '/') !== false) {
3007-
$Filename = $this->Loader->substrAfterLast($Filename, "\\");
3006+
while (strpos($Filename, '\\') !== false || strpos($Filename, '/') !== false) {
3007+
$Filename = $this->Loader->substrAfterLast($Filename, '\\');
30083008
$Filename = $this->Loader->substrAfterLast($Filename, '/');
30093009
}
30103010
}
@@ -3017,7 +3017,7 @@ private function archiveRecursor(string $Data, string $File = '', int $ScanDepth
30173017
$Hash = hash('sha256', $Content);
30183018
$DataCRC32 = hash('crc32b', $Content);
30193019
$InternalCRC = $ArchiveObject->EntryCRC();
3020-
$ThisItemRef = $ItemRef . '→' . preg_replace(['~[\x00-\x1F]~', '~^[\\\/]~'], '', $Filename);
3020+
$ThisItemRef = $ItemRef . '→' . preg_replace(['~[\x00-\x1F]~', '~^[\\\\/]~'], '', $Filename);
30213021

30223022
/** Verify filesize, integrity, etc. Exit early in case of problems. */
30233023
if ($Filesize !== strlen($Content) || (
@@ -3264,7 +3264,7 @@ private function memoryUse(string $Path, int $Delete = 0, int $DeleteFiles = 0):
32643264
$Files = [];
32653265
$List = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($Path), \RecursiveIteratorIterator::SELF_FIRST);
32663266
foreach ($List as $Item => $List) {
3267-
$File = str_replace("\\", '/', substr($Item, $Offset));
3267+
$File = str_replace('\\', '/', substr($Item, $Offset));
32683268
if ($File && strtolower(substr($Item, -4)) === '.qfu' && is_file($Item) && !is_link($Item) && is_readable($Item)) {
32693269
$Files[$File] = filemtime($Item);
32703270
}
@@ -3308,7 +3308,7 @@ private function normalise(string $str, bool $html = false, bool $decode = false
33083308
while (true) {
33093309
if (
33103310
function_exists('gzinflate') &&
3311-
$c = preg_match_all('/(gzinflate\s*\(\s*["\'])(.{1,4096})(,\d)?(["\']\s*\))/i', $str, $matches)
3311+
$c = preg_match_all('/(gzinflate\s*\\(\s*["\'])(.{1,4096})(,\d)?(["\']\s*\\))/i', $str, $matches)
33123312
) {
33133313
for ($i = 0; $c > $i; $i++) {
33143314
$str = str_ireplace(
@@ -3321,8 +3321,8 @@ function_exists('gzinflate') &&
33213321
}
33223322
if ($c = preg_match_all(
33233323
'/(base64_decode|decode_base64|base64\.b64decode|atob|Base64\.decode64)(\s*' .
3324-
'\(\s*["\'\`])([\da-z+\/]{4})*([\da-z+\/]{4}|[\da-z+\/]{3}=|[\da-z+\/]{2}==)(["\'\`]' .
3325-
'\s*\))/i',
3324+
'\\(\s*["\'\`])([\da-z+\/]{4})*([\da-z+\/]{4}|[\da-z+\/]{3}=|[\da-z+\/]{2}==)(["\'\`]' .
3325+
'\s*\\))/i',
33263326
$str,
33273327
$matches
33283328
)) {
@@ -3336,7 +3336,7 @@ function_exists('gzinflate') &&
33363336
continue;
33373337
}
33383338
if ($c = preg_match_all(
3339-
'/(str_rot13\s*\(\s*["\'])([^\'"\(\)]{1,4096})(["\']\s*\))/i',
3339+
'/(str_rot13\s*\\(\s*["\'])([^\'"\\(\\)]{1,4096})(["\']\s*\\))/i',
33403340
$str,
33413341
$matches
33423342
)) {
@@ -3350,7 +3350,7 @@ function_exists('gzinflate') &&
33503350
continue;
33513351
}
33523352
if ($c = preg_match_all(
3353-
'/(hex2bin\s*\(\s*["\'])([\da-f]{1,4096})(["\']\s*\))/i',
3353+
'/(hex2bin\s*\\(\s*["\'])([\da-f]{1,4096})(["\']\s*\\))/i',
33543354
$str,
33553355
$matches
33563356
)) {
@@ -3364,7 +3364,7 @@ function_exists('gzinflate') &&
33643364
continue;
33653365
}
33663366
if ($c = preg_match_all(
3367-
'/([Uu][Nn][Pp][Aa][Cc][Kk]\s*\(\s*["\']\s*H\*\s*["\']\s*,\s*["\'])([\da-fA-F]{1,4096})(["\']\s*\))/',
3367+
'/([Uu][Nn][Pp][Aa][Cc][Kk]\s*\\(\s*["\']\s*H\*\s*["\']\s*,\s*["\'])([\da-fA-F]{1,4096})(["\']\s*\\))/',
33683368
$str,
33693369
$matches
33703370
)) {
@@ -3833,7 +3833,7 @@ private function matchVarInSigFile($Actual, $Expected): bool
38333833
*/
38343834
private function splitSigParts(string $Sig, int $Max = -1): array
38353835
{
3836-
return preg_split('~(?<!\?|\<)\:~', $Sig, $Max, PREG_SPLIT_NO_EMPTY);
3836+
return preg_split('~(?<!\?|\<):~', $Sig, $Max, PREG_SPLIT_NO_EMPTY);
38373837
}
38383838

38393839
/**

‎src/TarHandler.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Tar handler (last modified: 2021.07.10).
11+
* This file: Tar handler (last modified: 2023.12.01).
1212
*/
1313

1414
namespace phpMussel\Core;
@@ -104,7 +104,7 @@ public function EntryIsDirectory(): bool
104104
{
105105
$Name = $this->EntryName();
106106
$Separator = substr($Name, -1, 1);
107-
return (($Separator === "\\" || $Separator === '/') && $this->EntryActualSize() === 0);
107+
return (($Separator === '\\' || $Separator === '/') && $this->EntryActualSize() === 0);
108108
}
109109

110110
/**

‎src/TemporaryFileHandler.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Temporary file handler (last modified: 2021.07.10).
11+
* This file: Temporary file handler (last modified: 2023.12.01).
1212
*/
1313

1414
namespace phpMussel\Core;
@@ -30,7 +30,7 @@ class TemporaryFileHandler
3030
public function __construct(string $Content, string $Location)
3131
{
3232
/** Pad the location if necessary. */
33-
if (($Pad = substr($Location, -1)) && ($Pad !== '/') && ($Pad !== "\\") && ($Pad !== DIRECTORY_SEPARATOR)) {
33+
if (($Pad = substr($Location, -1)) && ($Pad !== '/') && ($Pad !== '\\') && ($Pad !== DIRECTORY_SEPARATOR)) {
3434
$Location .= DIRECTORY_SEPARATOR;
3535
}
3636

0 commit comments

Comments
 (0)