Skip to content

Commit 0115267

Browse files
LukasReschkeLukasReschke
committed
Merge pull request #18396 from owncloud/autoloader-check-path
verify the path in the autoloader
2 parents 601c61f + e9b91b1 commit 0115267

File tree

5 files changed

+86
-42
lines changed

5 files changed

+86
-42
lines changed

‎lib/autoloader.php‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,33 @@ class Autoloader {
3434

3535
private $classPaths = array();
3636

37+
private $validRoots = [];
38+
3739
/**
3840
* Optional low-latency memory cache for class to path mapping.
41+
*
3942
* @var \OC\Memcache\Cache
4043
*/
4144
protected $memoryCache;
4245

46+
/**
47+
* Autoloader constructor.
48+
*
49+
* @param string[] $validRoots
50+
*/
51+
public function __construct(array $validRoots) {
52+
$this->validRoots = $validRoots;
53+
}
54+
55+
/**
56+
* Add a path to the list of valid php roots for auto loading
57+
*
58+
* @param string $root
59+
*/
60+
public function addValidRoot($root) {
61+
$this->validRoots[] = $root;
62+
}
63+
4364
/**
4465
* disable the usage of the global classpath \OC::$CLASSPATH
4566
*/
@@ -102,6 +123,15 @@ public function findClass($class) {
102123
return $paths;
103124
}
104125

126+
protected function isValidPath($fullPath) {
127+
foreach ($this->validRoots as $root) {
128+
if (substr($fullPath, 0, strlen($root) + 1) === $root . '/') {
129+
return true;
130+
}
131+
}
132+
throw new \Exception('Path not allowed');
133+
}
134+
105135
/**
106136
* Load the specified class
107137
*
@@ -119,7 +149,7 @@ public function load($class) {
119149
$pathsToRequire = array();
120150
foreach ($this->findClass($class) as $path) {
121151
$fullPath = stream_resolve_include_path($path);
122-
if ($fullPath) {
152+
if ($fullPath && $this->isValidPath($fullPath)) {
123153
$pathsToRequire[] = $fullPath;
124154
}
125155
}
@@ -138,6 +168,7 @@ public function load($class) {
138168

139169
/**
140170
* Sets the optional low-latency cache for class to path mapping.
171+
*
141172
* @param \OC\Memcache\Cache $memoryCache Instance of memory cache.
142173
*/
143174
public function setMemoryCache(\OC\Memcache\Cache $memoryCache = null) {

‎lib/base.php‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -115,9 +115,6 @@ class OC {
115115
* the app path list is empty or contains an invalid path
116116
*/
117117
public static function initPaths() {
118-
// calculate the root directories
119-
OC::$SERVERROOT = str_replace("\\", '/', substr(__DIR__, 0, -4));
120-
121118
// ensure we can find OC_Config
122119
set_include_path(
123120
OC::$SERVERROOT . '/lib' . PATH_SEPARATOR .
@@ -519,10 +516,20 @@ public static function setRequiredIniValues() {
519516
}
520517

521518
public static function init() {
519+
// calculate the root directories
520+
OC::$SERVERROOT = str_replace("\\", '/', substr(__DIR__, 0, -4));
521+
522522
// register autoloader
523523
$loaderStart = microtime(true);
524524
require_once __DIR__ . '/autoloader.php';
525-
self::$loader = new \OC\Autoloader();
525+
self::$loader = new \OC\Autoloader([
526+
OC::$SERVERROOT . '/lib',
527+
OC::$SERVERROOT . '/core',
528+
OC::$SERVERROOT . '/settings',
529+
OC::$SERVERROOT . '/ocs',
530+
OC::$SERVERROOT . '/ocs-provider',
531+
OC::$SERVERROOT . '/3rdparty'
532+
]);
526533
spl_autoload_register(array(self::$loader, 'load'));
527534
$loaderEnd = microtime(true);
528535

@@ -545,6 +552,10 @@ public static function init() {
545552
exit();
546553
}
547554

555+
foreach(OC::$APPSROOTS as $appRoot) {
556+
self::$loader->addValidRoot($appRoot['path']);
557+
}
558+
548559
// setup the basic server
549560
self::$server = new \OC\Server(\OC::$WEBROOT);
550561
\OC::$server->getEventLogger()->log('autoloader', 'Autoloader', $loaderStart, $loaderEnd);

‎tests/bootstrap.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@
88

99
require_once __DIR__ . '/../lib/base.php';
1010

11+
\OC::$loader->addValidRoot(OC::$SERVERROOT . '/tests');
12+
1113
// load minimum set of apps
1214
OC_App::loadApps(array('authentication'));
1315
OC_App::loadApps(array('filesystem', 'logging'));

‎tests/lib/autoloader.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ class AutoLoader extends TestCase {
1616

1717
protected function setUp() {
1818
parent::setUp();
19-
$this->loader = new \OC\AutoLoader();
19+
$this->loader = new \OC\AutoLoader([]);
2020
}
2121

2222
public function testLeadingSlashOnClassName() {

‎tests/lib/template.php‎

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,31 @@
11
<?php
2-
/**
3-
* ownCloud
4-
*
5-
* @author Bernhard Posselt
6-
* @copyright 2012 Bernhard Posselt <dev@bernhard-posselt.com>
7-
*
8-
* This library is free software; you can redistribute it and/or
9-
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
10-
* License as published by the Free Software Foundation; either
11-
* version 3 of the License, or any later version.
12-
*
13-
* This library is distributed in the hope that it will be useful,
14-
* but WITHOUT ANY WARRANTY; without even the implied warranty of
15-
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16-
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
17-
*
18-
* You should have received a copy of the GNU Affero General Public
19-
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
20-
*
21-
*/
222

3+
/**
4+
* ownCloud
5+
*
6+
* @author Bernhard Posselt
7+
* @copyright 2012 Bernhard Posselt <dev@bernhard-posselt.com>
8+
*
9+
* This library is free software; you can redistribute it and/or
10+
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
11+
* License as published by the Free Software Foundation; either
12+
* version 3 of the License, or any later version.
13+
*
14+
* This library is distributed in the hope that it will be useful,
15+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
16+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17+
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
18+
*
19+
* You should have received a copy of the GNU Affero General Public
20+
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
21+
*
22+
*/
2323
class Test_TemplateFunctions extends \Test\TestCase {
2424

2525
protected function setUp() {
2626
parent::setUp();
2727

28-
$loader = new \OC\Autoloader();
28+
$loader = new \OC\Autoloader([OC::$SERVERROOT . '/lib']);
2929
$loader->load('OC_Template');
3030
}
3131

@@ -60,7 +60,7 @@ public function testPrintUnescapedNormalString() {
6060
// ---------------------------------------------------------------------------
6161
// Test relative_modified_date with dates only
6262
// ---------------------------------------------------------------------------
63-
public function testRelativeDateToday(){
63+
public function testRelativeDateToday() {
6464
$currentTime = 1380703592;
6565
$elementTime = $currentTime;
6666
$result = (string)relative_modified_date($elementTime, $currentTime, true);
@@ -74,7 +74,7 @@ public function testRelativeDateToday(){
7474
$this->assertEquals('today', $result);
7575
}
7676

77-
public function testRelativeDateYesterday(){
77+
public function testRelativeDateYesterday() {
7878
$currentTime = 1380703592;
7979
$elementTime = $currentTime - 24 * 3600;
8080
$result = (string)relative_modified_date($elementTime, $currentTime, true);
@@ -88,7 +88,7 @@ public function testRelativeDateYesterday(){
8888
$this->assertEquals('yesterday', $result);
8989
}
9090

91-
public function testRelativeDate2DaysAgo(){
91+
public function testRelativeDate2DaysAgo() {
9292
$currentTime = 1380703592;
9393
$elementTime = $currentTime - 48 * 3600;
9494
$result = (string)relative_modified_date($elementTime, $currentTime, true);
@@ -102,7 +102,7 @@ public function testRelativeDate2DaysAgo(){
102102
$this->assertEquals('2 days ago', $result);
103103
}
104104

105-
public function testRelativeDateLastMonth(){
105+
public function testRelativeDateLastMonth() {
106106
$currentTime = 1380703592;
107107
$elementTime = $currentTime - 86400 * 31;
108108
$result = (string)relative_modified_date($elementTime, $currentTime, true);
@@ -115,7 +115,7 @@ public function testRelativeDateLastMonth(){
115115
$this->assertEquals('last month', $result);
116116
}
117117

118-
public function testRelativeDateMonthsAgo(){
118+
public function testRelativeDateMonthsAgo() {
119119
$currentTime = 1380703592;
120120
$elementTime = $currentTime - 86400 * 65;
121121
$result = (string)relative_modified_date($elementTime, $currentTime, true);
@@ -128,7 +128,7 @@ public function testRelativeDateMonthsAgo(){
128128
$this->assertEquals('4 months ago', $result);
129129
}
130130

131-
public function testRelativeDateLastYear(){
131+
public function testRelativeDateLastYear() {
132132
$currentTime = 1380703592;
133133
$elementTime = $currentTime - 86400 * 365;
134134
$result = (string)relative_modified_date($elementTime, $currentTime, true);
@@ -141,7 +141,7 @@ public function testRelativeDateLastYear(){
141141
$this->assertEquals('last year', $result);
142142
}
143143

144-
public function testRelativeDateYearsAgo(){
144+
public function testRelativeDateYearsAgo() {
145145
$currentTime = 1380703592;
146146
$elementTime = $currentTime - 86400 * 365.25 * 2;
147147
$result = (string)relative_modified_date($elementTime, $currentTime, true);
@@ -158,31 +158,31 @@ public function testRelativeDateYearsAgo(){
158158
// Test relative_modified_date with timestamps only (date + time value)
159159
// ---------------------------------------------------------------------------
160160

161-
public function testRelativeTimeSecondsAgo(){
161+
public function testRelativeTimeSecondsAgo() {
162162
$currentTime = 1380703592;
163163
$elementTime = $currentTime - 5;
164164
$result = (string)relative_modified_date($elementTime, $currentTime, false);
165165

166166
$this->assertEquals('seconds ago', $result);
167167
}
168168

169-
public function testRelativeTimeMinutesAgo(){
169+
public function testRelativeTimeMinutesAgo() {
170170
$currentTime = 1380703592;
171171
$elementTime = $currentTime - 190;
172172
$result = (string)relative_modified_date($elementTime, $currentTime, false);
173173

174174
$this->assertEquals('3 minutes ago', $result);
175175
}
176176

177-
public function testRelativeTimeHoursAgo(){
177+
public function testRelativeTimeHoursAgo() {
178178
$currentTime = 1380703592;
179179
$elementTime = $currentTime - 7500;
180180
$result = (string)relative_modified_date($elementTime, $currentTime, false);
181181

182182
$this->assertEquals('2 hours ago', $result);
183183
}
184184

185-
public function testRelativeTime2DaysAgo(){
185+
public function testRelativeTime2DaysAgo() {
186186
$currentTime = 1380703592;
187187
$elementTime = $currentTime - 48 * 3600;
188188
$result = (string)relative_modified_date($elementTime, $currentTime, false);
@@ -196,7 +196,7 @@ public function testRelativeTime2DaysAgo(){
196196
$this->assertEquals('2 days ago', $result);
197197
}
198198

199-
public function testRelativeTimeLastMonth(){
199+
public function testRelativeTimeLastMonth() {
200200
$currentTime = 1380703592;
201201
$elementTime = $currentTime - 86400 * 31;
202202
$result = (string)relative_modified_date($elementTime, $currentTime, false);
@@ -209,7 +209,7 @@ public function testRelativeTimeLastMonth(){
209209
$this->assertEquals('last month', $result);
210210
}
211211

212-
public function testRelativeTimeMonthsAgo(){
212+
public function testRelativeTimeMonthsAgo() {
213213
$currentTime = 1380703592;
214214
$elementTime = $currentTime - 86400 * 65;
215215
$result = (string)relative_modified_date($elementTime, $currentTime, false);
@@ -222,7 +222,7 @@ public function testRelativeTimeMonthsAgo(){
222222
$this->assertEquals('4 months ago', $result);
223223
}
224224

225-
public function testRelativeTimeLastYear(){
225+
public function testRelativeTimeLastYear() {
226226
$currentTime = 1380703592;
227227
$elementTime = $currentTime - 86400 * 365;
228228
$result = (string)relative_modified_date($elementTime, $currentTime, false);
@@ -235,7 +235,7 @@ public function testRelativeTimeLastYear(){
235235
$this->assertEquals('last year', $result);
236236
}
237237

238-
public function testRelativeTimeYearsAgo(){
238+
public function testRelativeTimeYearsAgo() {
239239
$currentTime = 1380703592;
240240
$elementTime = $currentTime - 86400 * 365.25 * 2;
241241
$result = (string)relative_modified_date($elementTime, $currentTime, false);

0 commit comments

Comments
 (0)