|
| 1 | +<?php |
| 2 | + |
| 3 | +declare(strict_types=1); |
| 4 | + |
| 5 | +/* |
| 6 | + * This file is part of the TYPO3 CMS project. |
| 7 | + * |
| 8 | + * It is free software; you can redistribute it and/or modify it under |
| 9 | + * the terms of the GNU General Public License, either version 2 |
| 10 | + * of the License, or any later version. |
| 11 | + * |
| 12 | + * For the full copyright and license information, please read the |
| 13 | + * LICENSE.txt file that was distributed with this source code. |
| 14 | + * |
| 15 | + * The TYPO3 project - inspiring people to share! |
| 16 | + */ |
| 17 | + |
| 18 | +namespace TYPO3\CMS\PHPStan\Rules\Classes; |
| 19 | + |
| 20 | +use PhpParser\Node; |
| 21 | +use PhpParser\Node\Expr\FuncCall; |
| 22 | +use PHPStan\Analyser\ArgumentsNormalizer; |
| 23 | +use PHPStan\Analyser\Scope; |
| 24 | +use PHPStan\Php\PhpVersion; |
| 25 | +use PHPStan\Reflection\ParametersAcceptorSelector; |
| 26 | +use PHPStan\Reflection\ReflectionProvider; |
| 27 | +use PHPStan\Rules\Arrays\AllowedArrayKeysTypes; |
| 28 | +use PHPStan\Rules\Rule; |
| 29 | +use PHPStan\Rules\RuleError; |
| 30 | +use PHPStan\Rules\RuleErrorBuilder; |
| 31 | +use PHPStan\Type\ArrayType; |
| 32 | +use PHPStan\Type\BooleanType; |
| 33 | +use PHPStan\Type\ClassStringType; |
| 34 | +use PHPStan\Type\Constant\ConstantBooleanType; |
| 35 | +use PHPStan\Type\Type; |
| 36 | +use PHPStan\Type\TypeCombinator; |
| 37 | +use PHPStan\Type\VerbosityLevel; |
| 38 | + |
| 39 | +/** |
| 40 | + * Custom PHPStan rule to harden `unserialize` calls. |
| 41 | + * |
| 42 | + * Extracted from https://github.com/phpstan/phpstan-src/pull/4754, may become |
| 43 | + * obsolete once this is merged upstream in PHPStan, and can be removed then. |
| 44 | + * |
| 45 | + * @implements Rule<FuncCall> |
| 46 | + */ |
| 47 | +final readonly class UnserializeRule implements Rule |
| 48 | +{ |
| 49 | + public function __construct( |
| 50 | + private PhpVersion $phpVersion, |
| 51 | + private ReflectionProvider $reflectionProvider, |
| 52 | + ) {} |
| 53 | + |
| 54 | + public function getNodeType(): string |
| 55 | + { |
| 56 | + return FuncCall::class; |
| 57 | + } |
| 58 | + |
| 59 | + public function processNode(Node $node, Scope $scope): array |
| 60 | + { |
| 61 | + if (!($node->name instanceof Node\Name)) { |
| 62 | + return []; |
| 63 | + } |
| 64 | + |
| 65 | + if (!$this->reflectionProvider->hasFunction($node->name, $scope)) { |
| 66 | + return []; |
| 67 | + } |
| 68 | + |
| 69 | + $functionReflection = $this->reflectionProvider->getFunction($node->name, $scope); |
| 70 | + |
| 71 | + // Skip unsupported functions |
| 72 | + if ($functionReflection->getName() !== 'unserialize') { |
| 73 | + return []; |
| 74 | + } |
| 75 | + |
| 76 | + // Normalize function arguments |
| 77 | + $normalizedFuncCall = ArgumentsNormalizer::reorderFuncArguments( |
| 78 | + ParametersAcceptorSelector::selectFromArgs( |
| 79 | + $scope, |
| 80 | + $node->getArgs(), |
| 81 | + $functionReflection->getVariants(), |
| 82 | + $functionReflection->getNamedArgumentsVariants(), |
| 83 | + ), |
| 84 | + $node, |
| 85 | + ); |
| 86 | + |
| 87 | + // Skip on invalid function signatures |
| 88 | + if ($normalizedFuncCall === null) { |
| 89 | + return []; |
| 90 | + } |
| 91 | + |
| 92 | + $args = $normalizedFuncCall->getArgs(); |
| 93 | + |
| 94 | + // Fail if $options array is missing in unserialize call |
| 95 | + if (count($args) !== 2) { |
| 96 | + return [ |
| 97 | + RuleErrorBuilder::message( |
| 98 | + 'Calling unserialize() without parameter $2 options and "allowed_classes" set to false or a list of allowed class names is insecure.', |
| 99 | + )->identifier('unserialize.options.missing')->build(), |
| 100 | + ]; |
| 101 | + } |
| 102 | + |
| 103 | + $type = $scope->getType($args[1]->value); |
| 104 | + $optionsArrays = $type->getConstantArrays(); |
| 105 | + |
| 106 | + // Early return if $options parameter is not an array |
| 107 | + // (this is already handled by PHPStan's reflection provider) |
| 108 | + if ($optionsArrays === []) { |
| 109 | + return []; |
| 110 | + } |
| 111 | + |
| 112 | + $allowedClassesChecked = false; |
| 113 | + $errors = []; |
| 114 | + |
| 115 | + foreach ($optionsArrays as $optionsArray) { |
| 116 | + foreach ($optionsArray->getValueTypes() as $i => $valueType) { |
| 117 | + $key = $optionsArray->getKeyTypes()[$i]->getValue(); |
| 118 | + |
| 119 | + switch ($key) { |
| 120 | + case 'allowed_classes': |
| 121 | + $allowedClassesChecked = true; |
| 122 | + $errors = [ |
| 123 | + ...$errors, |
| 124 | + ...$this->checkAllowedClasses($valueType), |
| 125 | + ]; |
| 126 | + break; |
| 127 | + case 'max_depth': |
| 128 | + if ($valueType->isInteger()->no()) { |
| 129 | + $errors[] = RuleErrorBuilder::message(sprintf( |
| 130 | + 'Parameter #2 $options to function unserialize contains an invalid value %s for "max_depth".', |
| 131 | + $valueType->describe(VerbosityLevel::value()), |
| 132 | + ))->identifier('unserialize.maxDepth.invalidType')->build(); |
| 133 | + } |
| 134 | + break; |
| 135 | + default: |
| 136 | + $errors[] = RuleErrorBuilder::message(sprintf( |
| 137 | + 'Parameter #2 $options to function unserialize contains unsupported option "%s".', |
| 138 | + $key, |
| 139 | + ))->identifier('unserialize.unsupported')->build(); |
| 140 | + } |
| 141 | + } |
| 142 | + } |
| 143 | + |
| 144 | + if (!$allowedClassesChecked) { |
| 145 | + $errors[] = RuleErrorBuilder::message( |
| 146 | + 'Parameter #2 $options to function unserialize must be present with "allowed_classes" set to false or a list of allowed class names.', |
| 147 | + )->identifier('unserialize.allowedClasses.missing')->build(); |
| 148 | + } |
| 149 | + |
| 150 | + return $errors; |
| 151 | + } |
| 152 | + |
| 153 | + /** |
| 154 | + * @return list<RuleError> |
| 155 | + */ |
| 156 | + private function checkAllowedClasses(Type $valueType): array |
| 157 | + { |
| 158 | + // $options = false (disallow all classes) |
| 159 | + if ($valueType instanceof ConstantBooleanType && $valueType->getValue() === false) { |
| 160 | + return []; |
| 161 | + } |
| 162 | + |
| 163 | + // $options = true (allow all classes) |
| 164 | + if ($valueType instanceof ConstantBooleanType && $valueType->getValue() === true) { |
| 165 | + return [ |
| 166 | + RuleErrorBuilder::message( |
| 167 | + 'Parameter #2 $options to function unserialize must either be false or a list of allowed class names.', |
| 168 | + )->identifier('unserialize.allowedClasses.insecure')->build(), |
| 169 | + ]; |
| 170 | + } |
| 171 | + |
| 172 | + $allowedArrayType = new ArrayType(AllowedArrayKeysTypes::getType($this->phpVersion), new ClassStringType()); |
| 173 | + $allowedType = TypeCombinator::union(new BooleanType(), $allowedArrayType); |
| 174 | + |
| 175 | + // Invalid value type |
| 176 | + if (!$allowedType->accepts($valueType, true)->yes()) { |
| 177 | + return [ |
| 178 | + RuleErrorBuilder::message(sprintf( |
| 179 | + 'Parameter #2 $options to function unserialize contains an invalid value %s for "allowed_classes".', |
| 180 | + $valueType->describe(VerbosityLevel::value()), |
| 181 | + ))->identifier('unserialize.allowedClasses.invalidType')->build(), |
| 182 | + ]; |
| 183 | + } |
| 184 | + |
| 185 | + $errors = []; |
| 186 | + |
| 187 | + foreach ($valueType->getConstantArrays() as $optionConstantArray) { |
| 188 | + foreach ($optionConstantArray->getValueTypes() as $j => $itemType) { |
| 189 | + // Unsupported value type |
| 190 | + if (!$itemType->isString()->yes()) { |
| 191 | + $errors[] = RuleErrorBuilder::message(sprintf( |
| 192 | + 'Parameter #2 $options to function unserialize contains an invalid value for "allowed_classes" item #%d.', |
| 193 | + $j + 1, |
| 194 | + ))->identifier('unserialize.allowedClasses.invalidType')->build(); |
| 195 | + } |
| 196 | + } |
| 197 | + } |
| 198 | + |
| 199 | + return $errors; |
| 200 | + } |
| 201 | +} |
0 commit comments