Skip to content

Commit

Permalink
verify the path in the autoloader
Browse files Browse the repository at this point in the history
  • Loading branch information
@icewind1991
icewind1991 committed Sep 1, 2015
1 parent 0d4562c commit e9b91b1
Show file tree
Hide file tree
Showing 5 changed files with 86 additions and 42 deletions.
33 changes: 32 additions & 1 deletion lib/autoloader.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,33 @@ class Autoloader {

private $classPaths = array();

private $validRoots = [];

/**
* Optional low-latency memory cache for class to path mapping.
*
* @var \OC\Memcache\Cache
*/
protected $memoryCache;

/**
* Autoloader constructor.
*
* @param string[] $validRoots
*/
public function __construct(array $validRoots) {
$this->validRoots = $validRoots;
}

/**
* Add a path to the list of valid php roots for auto loading
*
* @param string $root
*/
public function addValidRoot($root) {
$this->validRoots[] = $root;
}

/**
* disable the usage of the global classpath \OC::$CLASSPATH
*/
Expand Down Expand Up @@ -102,6 +123,15 @@ public function findClass($class) {
return $paths;
}

protected function isValidPath($fullPath) {
foreach ($this->validRoots as $root) {
if (substr($fullPath, 0, strlen($root) + 1) === $root . '/') {
return true;
}
}
throw new \Exception('Path not allowed');
}

/**
* Load the specified class
*
Expand All @@ -119,7 +149,7 @@ public function load($class) {
$pathsToRequire = array();
foreach ($this->findClass($class) as $path) {
$fullPath = stream_resolve_include_path($path);
if ($fullPath) {
if ($fullPath && $this->isValidPath($fullPath)) {
$pathsToRequire[] = $fullPath;
}
}
Expand All @@ -138,6 +168,7 @@ public function load($class) {

/**
* Sets the optional low-latency cache for class to path mapping.
*
* @param \OC\Memcache\Cache $memoryCache Instance of memory cache.
*/
public function setMemoryCache(\OC\Memcache\Cache $memoryCache = null) {
Expand Down
19 changes: 15 additions & 4 deletions lib/base.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -115,9 +115,6 @@ class OC {
* the app path list is empty or contains an invalid path
*/
public static function initPaths() {
// calculate the root directories
OC::$SERVERROOT = str_replace("\\", '/', substr(__DIR__, 0, -4));

// ensure we can find OC_Config
set_include_path(
OC::$SERVERROOT . '/lib' . PATH_SEPARATOR .
Expand Down Expand Up @@ -519,10 +516,20 @@ public static function setRequiredIniValues() {
}

public static function init() {
// calculate the root directories
OC::$SERVERROOT = str_replace("\\", '/', substr(__DIR__, 0, -4));

// register autoloader
$loaderStart = microtime(true);
require_once __DIR__ . '/autoloader.php';
self::$loader = new \OC\Autoloader();
self::$loader = new \OC\Autoloader([
OC::$SERVERROOT . '/lib',
OC::$SERVERROOT . '/core',
OC::$SERVERROOT . '/settings',
OC::$SERVERROOT . '/ocs',
OC::$SERVERROOT . '/ocs-provider',
OC::$SERVERROOT . '/3rdparty'
]);
spl_autoload_register(array(self::$loader, 'load'));
$loaderEnd = microtime(true);

Expand All @@ -545,6 +552,10 @@ public static function init() {
exit();
}

foreach(OC::$APPSROOTS as $appRoot) {
self::$loader->addValidRoot($appRoot['path']);
}

// setup the basic server
self::$server = new \OC\Server(\OC::$WEBROOT);
\OC::$server->getEventLogger()->log('autoloader', 'Autoloader', $loaderStart, $loaderEnd);
Expand Down
2 changes: 2 additions & 0 deletions tests/bootstrap.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@

require_once __DIR__ . '/../lib/base.php';

\OC::$loader->addValidRoot(OC::$SERVERROOT . '/tests');

// load minimum set of apps
OC_App::loadApps(array('authentication'));
OC_App::loadApps(array('filesystem', 'logging'));
Expand Down
2 changes: 1 addition & 1 deletion tests/lib/autoloader.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ class AutoLoader extends TestCase {

protected function setUp() {
parent::setUp();
$this->loader = new \OC\AutoLoader();
$this->loader = new \OC\AutoLoader([]);
}

public function testLeadingSlashOnClassName() {
Expand Down
72 changes: 36 additions & 36 deletions tests/lib/template.php
View file
Original file line number Diff line number Diff line change
@@ -1,31 +1,31 @@
<?php
/**
* ownCloud
*
* @author Bernhard Posselt
* @copyright 2012 Bernhard Posselt <dev@bernhard-posselt.com>
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
* License as published by the Free Software Foundation; either
* version 3 of the License, or any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
*
* You should have received a copy of the GNU Affero General Public
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
*
*/

/**
* ownCloud
*
* @author Bernhard Posselt
* @copyright 2012 Bernhard Posselt <dev@bernhard-posselt.com>
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
* License as published by the Free Software Foundation; either
* version 3 of the License, or any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
*
* You should have received a copy of the GNU Affero General Public
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
*
*/
class Test_TemplateFunctions extends \Test\TestCase {

protected function setUp() {
parent::setUp();

$loader = new \OC\Autoloader();
$loader = new \OC\Autoloader([OC::$SERVERROOT . '/lib']);
$loader->load('OC_Template');
}

Expand Down Expand Up @@ -60,7 +60,7 @@ public function testPrintUnescapedNormalString() {
// ---------------------------------------------------------------------------
// Test relative_modified_date with dates only
// ---------------------------------------------------------------------------
public function testRelativeDateToday(){
public function testRelativeDateToday() {
$currentTime = 1380703592;
$elementTime = $currentTime;
$result = (string)relative_modified_date($elementTime, $currentTime, true);
Expand All @@ -74,7 +74,7 @@ public function testRelativeDateToday(){
$this->assertEquals('today', $result);
}

public function testRelativeDateYesterday(){
public function testRelativeDateYesterday() {
$currentTime = 1380703592;
$elementTime = $currentTime - 24 * 3600;
$result = (string)relative_modified_date($elementTime, $currentTime, true);
Expand All @@ -88,7 +88,7 @@ public function testRelativeDateYesterday(){
$this->assertEquals('yesterday', $result);
}

public function testRelativeDate2DaysAgo(){
public function testRelativeDate2DaysAgo() {
$currentTime = 1380703592;
$elementTime = $currentTime - 48 * 3600;
$result = (string)relative_modified_date($elementTime, $currentTime, true);
Expand All @@ -102,7 +102,7 @@ public function testRelativeDate2DaysAgo(){
$this->assertEquals('2 days ago', $result);
}

public function testRelativeDateLastMonth(){
public function testRelativeDateLastMonth() {
$currentTime = 1380703592;
$elementTime = $currentTime - 86400 * 31;
$result = (string)relative_modified_date($elementTime, $currentTime, true);
Expand All @@ -115,7 +115,7 @@ public function testRelativeDateLastMonth(){
$this->assertEquals('last month', $result);
}

public function testRelativeDateMonthsAgo(){
public function testRelativeDateMonthsAgo() {
$currentTime = 1380703592;
$elementTime = $currentTime - 86400 * 65;
$result = (string)relative_modified_date($elementTime, $currentTime, true);
Expand All @@ -128,7 +128,7 @@ public function testRelativeDateMonthsAgo(){
$this->assertEquals('4 months ago', $result);
}

public function testRelativeDateLastYear(){
public function testRelativeDateLastYear() {
$currentTime = 1380703592;
$elementTime = $currentTime - 86400 * 365;
$result = (string)relative_modified_date($elementTime, $currentTime, true);
Expand All @@ -141,7 +141,7 @@ public function testRelativeDateLastYear(){
$this->assertEquals('last year', $result);
}

public function testRelativeDateYearsAgo(){
public function testRelativeDateYearsAgo() {
$currentTime = 1380703592;
$elementTime = $currentTime - 86400 * 365.25 * 2;
$result = (string)relative_modified_date($elementTime, $currentTime, true);
Expand All @@ -158,31 +158,31 @@ public function testRelativeDateYearsAgo(){
// Test relative_modified_date with timestamps only (date + time value)
// ---------------------------------------------------------------------------

public function testRelativeTimeSecondsAgo(){
public function testRelativeTimeSecondsAgo() {
$currentTime = 1380703592;
$elementTime = $currentTime - 5;
$result = (string)relative_modified_date($elementTime, $currentTime, false);

$this->assertEquals('seconds ago', $result);
}

public function testRelativeTimeMinutesAgo(){
public function testRelativeTimeMinutesAgo() {
$currentTime = 1380703592;
$elementTime = $currentTime - 190;
$result = (string)relative_modified_date($elementTime, $currentTime, false);

$this->assertEquals('3 minutes ago', $result);
}

public function testRelativeTimeHoursAgo(){
public function testRelativeTimeHoursAgo() {
$currentTime = 1380703592;
$elementTime = $currentTime - 7500;
$result = (string)relative_modified_date($elementTime, $currentTime, false);

$this->assertEquals('2 hours ago', $result);
}

public function testRelativeTime2DaysAgo(){
public function testRelativeTime2DaysAgo() {
$currentTime = 1380703592;
$elementTime = $currentTime - 48 * 3600;
$result = (string)relative_modified_date($elementTime, $currentTime, false);
Expand All @@ -196,7 +196,7 @@ public function testRelativeTime2DaysAgo(){
$this->assertEquals('2 days ago', $result);
}

public function testRelativeTimeLastMonth(){
public function testRelativeTimeLastMonth() {
$currentTime = 1380703592;
$elementTime = $currentTime - 86400 * 31;
$result = (string)relative_modified_date($elementTime, $currentTime, false);
Expand All @@ -209,7 +209,7 @@ public function testRelativeTimeLastMonth(){
$this->assertEquals('last month', $result);
}

public function testRelativeTimeMonthsAgo(){
public function testRelativeTimeMonthsAgo() {
$currentTime = 1380703592;
$elementTime = $currentTime - 86400 * 65;
$result = (string)relative_modified_date($elementTime, $currentTime, false);
Expand All @@ -222,7 +222,7 @@ public function testRelativeTimeMonthsAgo(){
$this->assertEquals('4 months ago', $result);
}

public function testRelativeTimeLastYear(){
public function testRelativeTimeLastYear() {
$currentTime = 1380703592;
$elementTime = $currentTime - 86400 * 365;
$result = (string)relative_modified_date($elementTime, $currentTime, false);
Expand All @@ -235,7 +235,7 @@ public function testRelativeTimeLastYear(){
$this->assertEquals('last year', $result);
}

public function testRelativeTimeYearsAgo(){
public function testRelativeTimeYearsAgo() {
$currentTime = 1380703592;
$elementTime = $currentTime - 86400 * 365.25 * 2;
$result = (string)relative_modified_date($elementTime, $currentTime, false);
Expand Down

0 comments on commit e9b91b1

Please sign in to comment.