Skip to content

Commit fe4c7c8

Browse files
trashertrasher
authored
Fix all remaning unsafe functions usages (#20261)
* Fix unsafe functions usage * safe_mode no longer exists * Fix selinux requirement check * Fix unsafe functions usage
1 parent 706e6e7 commit fe4c7c8

File tree

222 files changed

+2292
-4936
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

222 files changed

+2292
-4936
lines changed

‎.phpstan-baseline.php

Lines changed: 921 additions & 4574 deletions
Large diffs are not rendered by default.

‎composer-dependency-analyser.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@
8282
'symfony/property-access',
8383
'symfony/polyfill-mbstring',
8484
], [ErrorType::UNUSED_DEPENDENCY])
85+
->ignoreErrorsOnExtension('ext-iconv', [ErrorType::UNUSED_DEPENDENCY]) // Required by Safe/iconv()
86+
->ignoreErrorsOnExtension('ext-zlib', [ErrorType::UNUSED_DEPENDENCY]) // Required by Safe/gzcompress() Safe::gzuncompress()
8587

8688
->disableReportingUnmatchedIgnores()
8789
;

‎phpunit/functional/TelemetryTest.php

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,6 @@ public function testGrabPhpInfos()
174174
'max_execution_time' => ini_get('max_execution_time'),
175175
'memory_limit' => ini_get('memory_limit'),
176176
'post_max_size' => ini_get('post_max_size'),
177-
'safe_mode' => ini_get('safe_mode'),
178177
'session' => ini_get('session.save_handler'),
179178
'upload_max_filesize' => ini_get('upload_max_filesize'),
180179
],

‎phpunit/functional/ToolboxTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1970,7 +1970,7 @@ public function test_LogInFile_FilterRootPathInLogFile(): void
19701970
$messageWithPath = 'Error somewhere in the path ' . GLPI_ROOT . ' triggered';
19711971

19721972
// Act
1973-
assert(\Toolbox::logInFile(self::TEST_CUSTOM_LOG_FILE_NAME, $messageWithPath), 'log failed');
1973+
\Toolbox::logInFile(self::TEST_CUSTOM_LOG_FILE_NAME, $messageWithPath);
19741974

19751975
// Assert
19761976
$this->assertStringNotContainsString(\GLPI_ROOT, file_get_contents($this->getCustomLogFilePath()));

‎phpunit/web/APIRestTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2043,7 +2043,7 @@ public function testUpdateItemWithNoInput()
20432043
'json' => [],
20442044
],
20452045
400,
2046-
'ERROR_JSON_PAYLOAD_INVALID'
2046+
'ERROR_BAD_ARRAY'
20472047
);
20482048
}
20492049

‎src/Appliance_Item_Relation.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@
3535

3636
use Glpi\DBAL\QueryExpression;
3737

38+
use function Safe\json_encode;
39+
3840
class Appliance_Item_Relation extends CommonDBRelation
3941
{
4042
public static $itemtype_1 = 'Appliance_Item';

‎src/Auth.php

Lines changed: 25 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,15 @@
3939
use Glpi\Event;
4040
use Glpi\Plugin\Hooks;
4141
use Glpi\Security\TOTPManager;
42+
use Safe\Exceptions\LdapException;
43+
44+
use function Safe\ini_get;
45+
use function Safe\json_decode;
46+
use function Safe\json_encode;
47+
use function Safe\ldap_bind;
48+
use function Safe\parse_url;
49+
use function Safe\preg_match;
50+
use function Safe\session_name;
4251

4352
/**
4453
* Identification class used to login
@@ -330,22 +339,24 @@ public function connection_ldap($ldap_method, $login, $password, ?bool &$error =
330339
$dn = $info['dn'];
331340
$this->user_found = $dn !== '';
332341

333-
$bind_result = $this->user_found && @ldap_bind($this->ldap_connection, $dn, $password);
334-
335-
if ($this->user_found && $bind_result !== false) {
336-
// Hook to implement to restrict access by checking the ldap directory
337-
if (Plugin::doHookFunction(Hooks::RESTRICT_LDAP_AUTH, $info)) {
338-
return $info;
342+
if ($this->user_found) {
343+
try {
344+
@ldap_bind($this->ldap_connection, $dn, $password);
345+
// Hook to implement to restrict access by checking the ldap directory
346+
if (Plugin::doHookFunction(Hooks::RESTRICT_LDAP_AUTH, $info)) {
347+
return $info;
348+
}
349+
$this->addToError(__('User not authorized to connect in GLPI'));
350+
// Use is present by has no right to connect because of a plugin
351+
return false;
352+
} catch (LdapException $e) {
353+
//empty catch
339354
}
340-
$this->addToError(__('User not authorized to connect in GLPI'));
341-
// Use is present by has no right to connect because of a plugin
342-
return false;
343-
} else {
344-
// Incorrect login
345-
$this->addToError(__('Incorrect username or password'));
346-
//Use is not present anymore in the directory!
347-
return false;
348355
}
356+
// Incorrect login
357+
$this->addToError(__('Incorrect username or password'));
358+
//Use is not present anymore in the directory!
359+
return false;
349360
} else {
350361
// Directory is not available
351362
$this->addToError(__('Unable to connect to the LDAP directory'));

‎src/AuthLDAP.php

Lines changed: 56 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,19 @@
3737
use Glpi\Error\ErrorHandler;
3838
use Glpi\Toolbox\Filesystem;
3939
use LDAP\Connection;
40-
40+
use Safe\Exceptions\DatetimeException;
41+
use Safe\Exceptions\LdapException;
42+
43+
use function Safe\fsockopen;
44+
use function Safe\gmmktime;
45+
use function Safe\ldap_bind;
46+
use function Safe\ldap_get_entries;
47+
use function Safe\ldap_set_option;
4148
use function Safe\parse_url;
49+
use function Safe\preg_match;
4250
use function Safe\preg_replace;
51+
use function Safe\strtotime;
52+
use function Safe\unpack;
4353

4454
/**
4555
* Class used to manage Auth LDAP config
@@ -1274,7 +1284,12 @@ public static function ldapStamp2UnixStamp($ldapstamp, $ldap_time_offset = 0)
12741284
*/
12751285
public static function date2ldapTimeStamp($date)
12761286
{
1277-
return date("YmdHis", strtotime($date)) . '.0Z';
1287+
try {
1288+
$strdate = strtotime($date);
1289+
} catch (DatetimeException $e) {
1290+
$strdate = 0;
1291+
}
1292+
return date("YmdHis", $strdate) . '.0Z';
12781293
}
12791294

12801295
/**
@@ -1409,12 +1424,13 @@ private function testLDAPSockopen(?Connection &$connection): array
14091424
$errstr = __('No hostname provided');
14101425
}
14111426

1412-
if (@fsockopen($host, $port_num, $errno, $errstr, 5)) {
1427+
try {
1428+
@fsockopen($host, $port_num, $errno, $errstr, 5);
14131429
return [
14141430
'success' => true,
14151431
'message' => sprintf(__('Connection to %s on port %s succeeded'), $host, $port_num),
14161432
];
1417-
} else {
1433+
} catch (\Safe\Exceptions\NetworkException $e) {
14181434
return [
14191435
'success' => false,
14201436
'message' => sprintf(__('%s (ERR: %s) to %s on port %s'), $errstr, $errno, $host, $port_num),
@@ -1748,7 +1764,7 @@ public static function searchForUsers(
17481764
$sr = @ldap_search($ds, $values['basedn'], $filter, $attrs, 0, -1, -1, LDAP_DEREF_NEVER, $controls);
17491765
if (
17501766
$sr === false
1751-
|| @ldap_parse_result($ds, $sr, $errcode, $matcheddn, $errmsg, $referrals, $controls) === false
1767+
|| @ldap_parse_result($ds, $sr, $errcode, $matcheddn, $errmsg, $referrals, $controls) === false // @phpstan-ignore theCodingMachineSafe.function
17521768
) {
17531769
// 32 = LDAP_NO_SUCH_OBJECT => This error can be silented as it just means that search produces no result.
17541770
if (ldap_errno($ds) !== 32) {
@@ -2430,7 +2446,7 @@ public static function getGroupsFromLDAP(
24302446
$sr = @ldap_search($ldap_connection, $config_ldap->fields['basedn'], $filter, $attrs, 0, -1, -1, LDAP_DEREF_NEVER, $controls);
24312447
if (
24322448
$sr === false
2433-
|| @ldap_parse_result($ldap_connection, $sr, $errcode, $matcheddn, $errmsg, $referrals, $controls) === false
2449+
|| @ldap_parse_result($ldap_connection, $sr, $errcode, $matcheddn, $errmsg, $referrals, $controls) === false // @phpstan-ignore theCodingMachineSafe.function
24342450
) {
24352451
// 32 = LDAP_NO_SUCH_OBJECT => This error can be silented as it just means that search produces no result.
24362452
if (ldap_errno($ldap_connection) !== 32) {
@@ -2891,7 +2907,9 @@ public static function connectToServer(
28912907
}
28922908

28932909
foreach ($ldap_options as $option => $value) {
2894-
if (!@ldap_set_option($ds, $option, $value)) {
2910+
try {
2911+
@ldap_set_option($ds, $option, $value);
2912+
} catch (LdapException $e) {
28952913
trigger_error(
28962914
static::buildError(
28972915
$ds,
@@ -2911,25 +2929,35 @@ public static function connectToServer(
29112929
trigger_error("TLS certificate path is not safe.", E_USER_WARNING);
29122930
} elseif (!file_exists($tls_certfile)) {
29132931
trigger_error("TLS certificate path is not valid.", E_USER_WARNING);
2914-
} elseif (!@ldap_set_option(null, LDAP_OPT_X_TLS_CERTFILE, $tls_certfile)) {
2915-
trigger_error("Unable to set LDAP option `LDAP_OPT_X_TLS_CERTFILE`", E_USER_WARNING);
2932+
} else {
2933+
try {
2934+
@ldap_set_option(null, LDAP_OPT_X_TLS_CERTFILE, $tls_certfile);
2935+
} catch (LdapException $e) {
2936+
trigger_error("Unable to set LDAP option `LDAP_OPT_X_TLS_CERTFILE`", E_USER_WARNING);
2937+
}
29162938
}
29172939
}
29182940
if (!empty($tls_keyfile)) {
29192941
if (!Filesystem::isFilepathSafe($tls_keyfile)) {
29202942
trigger_error("TLS key file path is not safe.", E_USER_WARNING);
29212943
} elseif (!file_exists($tls_keyfile)) {
29222944
trigger_error("TLS key file path is not valid.", E_USER_WARNING);
2923-
} elseif (!@ldap_set_option(null, LDAP_OPT_X_TLS_KEYFILE, $tls_keyfile)) {
2924-
trigger_error("Unable to set LDAP option `LDAP_OPT_X_TLS_KEYFILE`", E_USER_WARNING);
2945+
} else {
2946+
try {
2947+
@ldap_set_option(null, LDAP_OPT_X_TLS_KEYFILE, $tls_keyfile);
2948+
} catch (LdapException $e) {
2949+
trigger_error("Unable to set LDAP option `LDAP_OPT_X_TLS_KEYFILE`", E_USER_WARNING);
2950+
}
29252951
}
29262952
}
29272953
if (!empty($tls_version)) {
29282954
$cipher_suite = 'NORMAL';
29292955
foreach (self::TLS_VERSIONS as $tls_version_value) {
29302956
$cipher_suite .= ($tls_version_value == $tls_version ? ':+' : ':!') . 'VERS-TLS' . $tls_version_value;
29312957
}
2932-
if (!@ldap_set_option(null, LDAP_OPT_X_TLS_CIPHER_SUITE, $cipher_suite)) {
2958+
try {
2959+
@ldap_set_option(null, LDAP_OPT_X_TLS_CIPHER_SUITE, $cipher_suite);
2960+
} catch (LdapException $e) {
29332961
trigger_error("Unable to set LDAP option `LDAP_OPT_X_TLS_CIPHER_SUITE`", E_USER_WARNING);
29342962
}
29352963
}
@@ -2958,14 +2986,15 @@ public static function connectToServer(
29582986
return $ds;
29592987
}
29602988

2961-
if ($login !== '') {
2962-
// Auth bind
2963-
$b = @ldap_bind($ds, $login, $password);
2964-
} else {
2965-
// Anonymous bind
2966-
$b = @ldap_bind($ds);
2967-
}
2968-
if ($b === false) {
2989+
try {
2990+
if ($login !== '') {
2991+
// Auth bind
2992+
@ldap_bind($ds, $login, $password);
2993+
} else {
2994+
// Anonymous bind
2995+
@ldap_bind($ds);
2996+
}
2997+
} catch (LdapException $e) {
29692998
self::$last_errno = ldap_errno($ds);
29702999
self::$last_error = ldap_error($ds);
29713000

@@ -3999,8 +4028,10 @@ public static function displayTabContentForItem(CommonGLPI $item, $tabnum = 1, $
39994028
*/
40004029
public static function get_entries_clean($link, $result, ?bool &$error = null)
40014030
{
4002-
$entries = @ldap_get_entries($link, $result);
4003-
if ($entries === false) {
4031+
try {
4032+
$entries = @ldap_get_entries($link, $result);
4033+
return $entries;
4034+
} catch (LdapException $e) {
40044035
$error = true;
40054036
trigger_error(
40064037
static::buildError(
@@ -4010,7 +4041,7 @@ public static function get_entries_clean($link, $result, ?bool &$error = null)
40104041
E_USER_WARNING
40114042
);
40124043
}
4013-
return $entries;
4044+
return [];
40144045
}
40154046

40164047
/**
@@ -4366,8 +4397,8 @@ final public static function buildError($ds, string $message): string
43664397
$message,
43674398
ldap_error($ds),
43684399
ldap_errno($ds),
4369-
(ldap_get_option($ds, LDAP_OPT_DIAGNOSTIC_MESSAGE, $diag_message) ? "\nextended error: " . $diag_message : ''),
4370-
(ldap_get_option($ds, LDAP_OPT_ERROR_STRING, $err_message) ? "\nerr string: " . $err_message : '')
4400+
(ldap_get_option($ds, LDAP_OPT_DIAGNOSTIC_MESSAGE, $diag_message) ? "\nextended error: " . $diag_message : ''), // @phpstan-ignore theCodingMachineSafe.function
4401+
(ldap_get_option($ds, LDAP_OPT_ERROR_STRING, $err_message) ? "\nerr string: " . $err_message : '') // @phpstan-ignore theCodingMachineSafe.function
43714402
);
43724403
return $message;
43734404
}

‎src/Blacklist.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@
3535

3636
use Glpi\Features\Clonable;
3737

38+
use function Safe\preg_match;
39+
3840
/**
3941
* Blacklist Class
4042
*

‎src/Calendar.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@
3333
* ---------------------------------------------------------------------
3434
*/
3535

36+
use function Safe\strtotime;
37+
3638
/**
3739
* Calendar Class
3840
**/

0 commit comments

Comments
 (0)