Chris@0: <?php
Chris@0: /**
Chris@17:  * \Drupal\Sniffs\Semantics\PregSecuritySniff.
Chris@0:  *
Chris@0:  * @category PHP
Chris@0:  * @package  PHP_CodeSniffer
Chris@0:  * @link     http://pear.php.net/package/PHP_CodeSniffer
Chris@0:  */
Chris@0: 
Chris@17: namespace Drupal\Sniffs\Semantics;
Chris@17: 
Chris@17: use Drupal\Sniffs\Semantics\FunctionCall;
Chris@17: use PHP_CodeSniffer\Files\File;
Chris@17: 
Chris@0: /**
Chris@0:  * Check the usage of the preg functions to ensure the insecure /e flag isn't
Chris@0:  * used: https://www.drupal.org/node/750148
Chris@0:  *
Chris@0:  * @category PHP
Chris@0:  * @package  PHP_CodeSniffer
Chris@0:  * @link     http://pear.php.net/package/PHP_CodeSniffer
Chris@0:  */
Chris@17: class PregSecuritySniff extends FunctionCall
Chris@0: {
Chris@0: 
Chris@0: 
Chris@0:     /**
Chris@0:      * Returns an array of function names this test wants to listen for.
Chris@0:      *
Chris@0:      * @return array
Chris@0:      */
Chris@0:     public function registerFunctionNames()
Chris@0:     {
Chris@0:         return array(
Chris@0:                 'preg_filter',
Chris@0:                 'preg_grep',
Chris@0:                 'preg_match',
Chris@0:                 'preg_match_all',
Chris@0:                 'preg_replace',
Chris@0:                 'preg_replace_callback',
Chris@0:                 'preg_split',
Chris@0:                );
Chris@0: 
Chris@0:     }//end registerFunctionNames()
Chris@0: 
Chris@0: 
Chris@0:     /**
Chris@0:      * Processes this function call.
Chris@0:      *
Chris@17:      * @param \PHP_CodeSniffer\Files\File $phpcsFile    The file being scanned.
Chris@17:      * @param int                         $stackPtr     The position of the function call in
Chris@17:      *                                                  the stack.
Chris@17:      * @param int                         $openBracket  The position of the opening
Chris@17:      *                                                  parenthesis in the stack.
Chris@17:      * @param int                         $closeBracket The position of the closing
Chris@17:      *                                                  parenthesis in the stack.
Chris@0:      *
Chris@0:      * @return void
Chris@0:      */
Chris@0:     public function processFunctionCall(
Chris@17:         File $phpcsFile,
Chris@0:         $stackPtr,
Chris@0:         $openBracket,
Chris@0:         $closeBracket
Chris@0:     ) {
Chris@0:         $tokens   = $phpcsFile->getTokens();
Chris@0:         $argument = $this->getArgument(1);
Chris@0: 
Chris@0:         if ($argument === false) {
Chris@0:             return;
Chris@0:         }
Chris@0: 
Chris@0:         if ($tokens[$argument['start']]['code'] !== T_CONSTANT_ENCAPSED_STRING) {
Chris@0:             // Not a string literal.
Chris@0:             // @TODO: Extend code to recognize patterns in variables.
Chris@0:             return;
Chris@0:         }
Chris@0: 
Chris@0:         $pattern = $tokens[$argument['start']]['content'];
Chris@0:         $quote   = substr($pattern, 0, 1);
Chris@0:         // Check that the pattern is a string.
Chris@0:         if ($quote === '"' || $quote === "'") {
Chris@0:             // Get the delimiter - first char after the enclosing quotes.
Chris@0:             $delimiter = preg_quote(substr($pattern, 1, 1), '/');
Chris@0:             // Check if there is the evil e flag.
Chris@0:             if (preg_match('/'.$delimiter.'[\w]{0,}e[\w]{0,}$/', substr($pattern, 0, -1)) === 1) {
Chris@0:                 $warn = 'Using the e flag in %s is a possible security risk. For details see https://www.drupal.org/node/750148';
Chris@0:                 $phpcsFile->addError(
Chris@0:                     $warn,
Chris@0:                     $argument['start'],
Chris@0:                     'PregEFlag',
Chris@0:                     array($tokens[$stackPtr]['content'])
Chris@0:                 );
Chris@0:                 return;
Chris@0:             }
Chris@0:         }
Chris@0: 
Chris@0:     }//end processFunctionCall()
Chris@0: 
Chris@0: 
Chris@0: }//end class