includes/libs/mime/XmlTypeCheck.php

   1 <?php
   2 /**
   3  * XML syntax and type checker.
   4  *
   5  * Since 1.24.2, it uses XMLReader instead of xml_parse, which gives us
   6  * more control over the expansion of XML entities. When passed to the
   7  * callback, entities will be fully expanded, but may report the XML is
   8  * invalid if expanding the entities are likely to cause a DoS.
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License as published by
  12  * the Free Software Foundation; either version 2 of the License, or
  13  * (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License along
  21  * with this program; if not, write to the Free Software Foundation, Inc.,
  22  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  23  * http://www.gnu.org/copyleft/gpl.html
  24  *
  25  * @file
  26  */
  27
  28 class XmlTypeCheck {
  29         /**
  30          * @var bool|null Will be set to true or false to indicate whether the file is
  31          * well-formed XML. Note that this doesn't check schema validity.
  32          */
  33         public $wellFormed = null;
  34
  35         /**
  36          * @var bool Will be set to true if the optional element filter returned
  37          * a match at some point.
  38          */
  39         public $filterMatch = false;
  40
  41         /**
  42          * Will contain the type of filter hit if the optional element filter returned
  43          * a match at some point.
  44          * @var mixed
  45          */
  46         public $filterMatchType = false;
  47
  48         /**
  49          * @var string Name of the document's root element, including any namespace
  50          * as an expanded URL.
  51          */
  52         public $rootElement = '';
  53
  54         /**
  55          * @var string[] A stack of strings containing the data of each xml element as it's processed.
  56          * Append data to the top string of the stack, then pop off the string and process it when the
  57          * element is closed.
  58          */
  59         protected $elementData = [];
  60
  61         /**
  62          * @var array A stack of element names and attributes, as we process them.
  63          */
  64         protected $elementDataContext = [];
  65
  66         /**
  67          * @var int Current depth of the data stack.
  68          */
  69         protected $stackDepth = 0;
  70
  71         /** @var callable|null */
  72         protected $filterCallback;
  73
  74         /**
  75          * @var array Additional parsing options
  76          */
  77         private $parserOptions = [
  78                 'processing_instruction_handler' => null,
  79                 'external_dtd_handler' => '',
  80                 'dtd_handler' => '',
  81                 'require_safe_dtd' => true
  82         ];
  83
  84         /**
  85          * Allow filtering an XML file.
  86          *
  87          * Filters should return either true or a string to indicate something
  88          * is wrong with the file. $this->filterMatch will store if the
  89          * file failed validation (true = failed validation).
  90          * $this->filterMatchType will contain the validation error.
  91          * $this->wellFormed will contain whether the xml file is well-formed.
  92          *
  93          * @note If multiple filters are hit, only one of them will have the
  94          *  result stored in $this->filterMatchType.
  95          *
  96          * @param string $input a filename or string containing the XML element
  97          * @param callable|null $filterCallback (optional)
  98          *        Function to call to do additional custom validity checks from the
  99          *        SAX element handler event. This gives you access to the element
 100          *        namespace, name, attributes, and text contents.
 101          *        Filter should return a truthy value describing the error.
 102          * @param bool $isFile (optional) indicates if the first parameter is a
 103          *        filename (default, true) or if it is a string (false)
 104          * @param array $options list of additional parsing options:
 105          *        processing_instruction_handler: Callback for xml_set_processing_instruction_handler
 106          *        external_dtd_handler: Callback for the url of external dtd subset
 107          *        dtd_handler: Callback given the full text of the <!DOCTYPE declaration.
 108          *        require_safe_dtd: Only allow non-recursive entities in internal dtd (default true)
 109          */
 110         function __construct( $input, $filterCallback = null, $isFile = true, $options = [] ) {
 111                 $this->filterCallback = $filterCallback;
 112                 $this->parserOptions = array_merge( $this->parserOptions, $options );
 113                 $this->validateFromInput( $input, $isFile );
 114         }
 115
 116         /**
 117          * Alternative constructor: from filename
 118          *
 119          * @param string $fname the filename of an XML document
 120          * @param callable|null $filterCallback (optional)
 121          *        Function to call to do additional custom validity checks from the
 122          *        SAX element handler event. This gives you access to the element
 123          *        namespace, name, and attributes, but not to text contents.
 124          *        Filter should return 'true' to toggle on $this->filterMatch
 125          * @return XmlTypeCheck
 126          */
 127         public static function newFromFilename( $fname, $filterCallback = null ) {
 128                 return new self( $fname, $filterCallback, true );
 129         }
 130
 131         /**
 132          * Alternative constructor: from string
 133          *
 134          * @param string $string a string containing an XML element
 135          * @param callable|null $filterCallback (optional)
 136          *        Function to call to do additional custom validity checks from the
 137          *        SAX element handler event. This gives you access to the element
 138          *        namespace, name, and attributes, but not to text contents.
 139          *        Filter should return 'true' to toggle on $this->filterMatch
 140          * @return XmlTypeCheck
 141          */
 142         public static function newFromString( $string, $filterCallback = null ) {
 143                 return new self( $string, $filterCallback, false );
 144         }
 145
 146         /**
 147          * Get the root element. Simple accessor to $rootElement
 148          *
 149          * @return string
 150          */
 151         public function getRootElement() {
 152                 return $this->rootElement;
 153         }
 154
 155         /**
 156          * @param string $xml
 157          * @param bool $isFile
 158          */
 159         private function validateFromInput( $xml, $isFile ) {
 160                 $reader = new XMLReader();
 161                 if ( $isFile ) {
 162                         $s = $reader->open( $xml, null, LIBXML_NOERROR | LIBXML_NOWARNING );
 163                 } else {
 164                         $s = $reader->XML( $xml, null, LIBXML_NOERROR | LIBXML_NOWARNING );
 165                 }
 166                 if ( $s !== true ) {
 167                         // Couldn't open the XML
 168                         $this->wellFormed = false;
 169                 } else {
 170                         $oldDisable = libxml_disable_entity_loader( true );
 171                         $reader->setParserProperty( XMLReader::SUBST_ENTITIES, true );
 172                         try {
 173                                 $this->validate( $reader );
 174                         } catch ( Exception $e ) {
 175                                 // Calling this malformed, because we didn't parse the whole
 176                                 // thing. Maybe just an external entity refernce.
 177                                 $this->wellFormed = false;
 178                                 $reader->close();
 179                                 libxml_disable_entity_loader( $oldDisable );
 180                                 throw $e;
 181                         }
 182                         $reader->close();
 183                         libxml_disable_entity_loader( $oldDisable );
 184                 }
 185         }
 186
 187         private function readNext( XMLReader $reader ) {
 188                 set_error_handler( [ $this, 'XmlErrorHandler' ] );
 189                 $ret = $reader->read();
 190                 restore_error_handler();
 191                 return $ret;
 192         }
 193
 194         public function XmlErrorHandler( $errno, $errstr ) {
 195                 $this->wellFormed = false;
 196         }
 197
 198         private function validate( $reader ) {
 199                 // First, move through anything that isn't an element, and
 200                 // handle any processing instructions with the callback
 201                 do {
 202                         if ( !$this->readNext( $reader ) ) {
 203                                 // Hit the end of the document before any elements
 204                                 $this->wellFormed = false;
 205                                 return;
 206                         }
 207                         if ( $reader->nodeType === XMLReader::PI ) {
 208                                 $this->processingInstructionHandler( $reader->name, $reader->value );
 209                         }
 210                         if ( $reader->nodeType === XMLReader::DOC_TYPE ) {
 211                                 $this->DTDHandler( $reader );
 212                         }
 213                 } while ( $reader->nodeType != XMLReader::ELEMENT );
 214
 215                 // Process the rest of the document
 216                 do {
 217                         switch ( $reader->nodeType ) {
 218                                 case XMLReader::ELEMENT:
 219                                         $name = $this->expandNS(
 220                                                 $reader->name,
 221                                                 $reader->namespaceURI
 222                                         );
 223                                         if ( $this->rootElement === '' ) {
 224                                                 $this->rootElement = $name;
 225                                         }
 226                                         $empty = $reader->isEmptyElement;
 227                                         $attrs = $this->getAttributesArray( $reader );
 228                                         $this->elementOpen( $name, $attrs );
 229                                         if ( $empty ) {
 230                                                 $this->elementClose();
 231                                         }
 232                                         break;
 233
 234                                 case XMLReader::END_ELEMENT:
 235                                         $this->elementClose();
 236                                         break;
 237
 238                                 case XMLReader::WHITESPACE:
 239                                 case XMLReader::SIGNIFICANT_WHITESPACE:
 240                                 case XMLReader::CDATA:
 241                                 case XMLReader::TEXT:
 242                                         $this->elementData( $reader->value );
 243                                         break;
 244
 245                                 case XMLReader::ENTITY_REF:
 246                                         // Unexpanded entity (maybe external?),
 247                                         // don't send to the filter (xml_parse didn't)
 248                                         break;
 249
 250                                 case XMLReader::COMMENT:
 251                                         // Don't send to the filter (xml_parse didn't)
 252                                         break;
 253
 254                                 case XMLReader::PI:
 255                                         // Processing instructions can happen after the header too
 256                                         $this->processingInstructionHandler(
 257                                                 $reader->name,
 258                                                 $reader->value
 259                                         );
 260                                         break;
 261                                 case XMLReader::DOC_TYPE:
 262                                         // We should never see a doctype after first
 263                                         // element.
 264                                         $this->wellFormed = false;
 265                                         break;
 266                                 default:
 267                                         // One of DOC, ENTITY, END_ENTITY,
 268                                         // NOTATION, or XML_DECLARATION
 269                                         // xml_parse didn't send these to the filter, so we won't.
 270                         }
 271                 } while ( $this->readNext( $reader ) );
 272
 273                 if ( $this->stackDepth !== 0 ) {
 274                         $this->wellFormed = false;
 275                 } elseif ( $this->wellFormed === null ) {
 276                         $this->wellFormed = true;
 277                 }
 278         }
 279
 280         /**
 281          * Get all of the attributes for an XMLReader's current node
 282          * @param XMLReader $r
 283          * @return array of attributes
 284          */
 285         private function getAttributesArray( XMLReader $r ) {
 286                 $attrs = [];
 287                 while ( $r->moveToNextAttribute() ) {
 288                         if ( $r->namespaceURI === 'http://www.w3.org/2000/xmlns/' ) {
 289                                 // XMLReader treats xmlns attributes as normal
 290                                 // attributes, while xml_parse doesn't
 291                                 continue;
 292                         }
 293                         $name = $this->expandNS( $r->name, $r->namespaceURI );
 294                         $attrs[$name] = $r->value;
 295                 }
 296                 return $attrs;
 297         }
 298
 299         /**
 300          * @param string $name element or attribute name, maybe with a full or short prefix
 301          * @param string $namespaceURI
 302          * @return string the name prefixed with namespaceURI
 303          */
 304         private function expandNS( $name, $namespaceURI ) {
 305                 if ( $namespaceURI ) {
 306                         $parts = explode( ':', $name );
 307                         $localname = array_pop( $parts );
 308                         return "$namespaceURI:$localname";
 309                 }
 310                 return $name;
 311         }
 312
 313         /**
 314          * @param string $name
 315          * @param array $attribs
 316          */
 317         private function elementOpen( $name, $attribs ) {
 318                 $this->elementDataContext[] = [ $name, $attribs ];
 319                 $this->elementData[] = '';
 320                 $this->stackDepth++;
 321         }
 322
 323         private function elementClose() {
 324                 list( $name, $attribs ) = array_pop( $this->elementDataContext );
 325                 $data = array_pop( $this->elementData );
 326                 $this->stackDepth--;
 327                 $callbackReturn = false;
 328
 329                 if ( is_callable( $this->filterCallback ) ) {
 330                         $callbackReturn = call_user_func(
 331                                 $this->filterCallback,
 332                                 $name,
 333                                 $attribs,
 334                                 $data
 335                         );
 336                 }
 337                 if ( $callbackReturn ) {
 338                         // Filter hit!
 339                         $this->filterMatch = true;
 340                         $this->filterMatchType = $callbackReturn;
 341                 }
 342         }
 343
 344         /**
 345          * @param string $data
 346          */
 347         private function elementData( $data ) {
 348                 // Collect any data here, and we'll run the callback in elementClose
 349                 $this->elementData[ $this->stackDepth - 1 ] .= trim( $data );
 350         }
 351
 352         /**
 353          * @param string $target
 354          * @param string $data
 355          */
 356         private function processingInstructionHandler( $target, $data ) {
 357                 $callbackReturn = false;
 358                 if ( $this->parserOptions['processing_instruction_handler'] ) {
 359                         $callbackReturn = call_user_func(
 360                                 $this->parserOptions['processing_instruction_handler'],
 361                                 $target,
 362                                 $data
 363                         );
 364                 }
 365                 if ( $callbackReturn ) {
 366                         // Filter hit!
 367                         $this->filterMatch = true;
 368                         $this->filterMatchType = $callbackReturn;
 369                 }
 370         }
 371
 372         /**
 373          * Handle coming across a <!DOCTYPE declaration.
 374          *
 375          * @param XMLReader $reader Reader currently pointing at DOCTYPE node.
 376          */
 377         private function DTDHandler( XMLReader $reader ) {
 378                 $externalCallback = $this->parserOptions['external_dtd_handler'];
 379                 $generalCallback = $this->parserOptions['dtd_handler'];
 380                 $checkIfSafe = $this->parserOptions['require_safe_dtd'];
 381                 if ( !$externalCallback && !$generalCallback && !$checkIfSafe ) {
 382                         return;
 383                 }
 384                 $dtd = $reader->readOuterXml();
 385                 $callbackReturn = false;
 386
 387                 if ( $generalCallback ) {
 388                         $callbackReturn = call_user_func( $generalCallback, $dtd );
 389                 }
 390                 if ( $callbackReturn ) {
 391                         // Filter hit!
 392                         $this->filterMatch = true;
 393                         $this->filterMatchType = $callbackReturn;
 394                         $callbackReturn = false;
 395                 }
 396
 397                 $parsedDTD = $this->parseDTD( $dtd );
 398                 if ( $externalCallback && isset( $parsedDTD['type'] ) ) {
 399                         $callbackReturn = call_user_func(
 400                                 $externalCallback,
 401                                 $parsedDTD['type'],
 402                                 $parsedDTD['publicid'] ?? null,
 403                                 $parsedDTD['systemid'] ?? null
 404                         );
 405                 }
 406                 if ( $callbackReturn ) {
 407                         // Filter hit!
 408                         $this->filterMatch = true;
 409                         $this->filterMatchType = $callbackReturn;
 410                         $callbackReturn = false;
 411                 }
 412
 413                 if ( $checkIfSafe && isset( $parsedDTD['internal'] ) &&
 414                         !$this->checkDTDIsSafe( $parsedDTD['internal'] )
 415                 ) {
 416                         $this->wellFormed = false;
 417                 }
 418         }
 419
 420         /**
 421          * Check if the internal subset of the DTD is safe.
 422          *
 423          * We whitelist an extremely restricted subset of DTD features.
 424          *
 425          * Safe is defined as:
 426          *  * Only contains entity definitions (e.g. No <!ATLIST )
 427          *  * Entity definitions are not "system" entities
 428          *  * Entity definitions are not "parameter" (i.e. %) entities
 429          *  * Entity definitions do not reference other entities except &amp;
 430          *    and quotes. Entity aliases (where the entity contains only
 431          *    another entity are allowed)
 432          *  * Entity references aren't overly long (>255 bytes).
 433          *  * <!ATTLIST svg xmlns:xlink CDATA #FIXED "http://www.w3.org/1999/xlink">
 434          *    allowed if matched exactly for compatibility with graphviz
 435          *  * Comments.
 436          *
 437          * @param string $internalSubset The internal subset of the DTD
 438          * @return bool true if safe.
 439          */
 440         private function checkDTDIsSafe( $internalSubset ) {
 441                 $offset = 0;
 442                 $res = preg_match(
 443                         '/^(?:\s*<!ENTITY\s+\S+\s+' .
 444                                 '(?:"(?:&[^"%&;]{1,64};|(?:[^"%&]|&amp;|&quot;){0,255})"' .
 445                                 '|\'(?:&[^"%&;]{1,64};|(?:[^\'%&]|&amp;|&apos;){0,255})\')\s*>' .
 446                                 '|\s*<!--(?:[^-]|-[^-])*-->' .
 447                                 '|\s*<!ATTLIST svg xmlns:xlink CDATA #FIXED ' .
 448                                 '"http:\/\/www.w3.org\/1999\/xlink">)*\s*$/',
 449                         $internalSubset
 450                 );
 451
 452                 return (bool)$res;
 453         }
 454
 455         /**
 456          * Parse DTD into parts.
 457          *
 458          * If there is an error parsing the dtd, sets wellFormed to false.
 459          *
 460          * @param string $dtd
 461          * @return array Possibly containing keys publicid, systemid, type and internal.
 462          */
 463         private function parseDTD( $dtd ) {
 464                 $m = [];
 465                 $res = preg_match(
 466                         '/^<!DOCTYPE\s*\S+\s*' .
 467                         '(?:(?P<typepublic>PUBLIC)\s*' .
 468                                 '(?:"(?P<pubquote>[^"]*)"|\'(?P<pubapos>[^\']*)\')' . // public identifer
 469                                 '\s*"(?P<pubsysquote>[^"]*)"|\'(?P<pubsysapos>[^\']*)\'' . // system identifier
 470                         '|(?P<typesystem>SYSTEM)\s*' .
 471                                 '(?:"(?P<sysquote>[^"]*)"|\'(?P<sysapos>[^\']*)\')' .
 472                         ')?\s*' .
 473                         '(?:\[\s*(?P<internal>.*)\])?\s*>$/s',
 474                         $dtd,
 475                         $m
 476                 );
 477                 if ( !$res ) {
 478                         $this->wellFormed = false;
 479                         return [];
 480                 }
 481                 $parsed = [];
 482                 foreach ( $m as $field => $value ) {
 483                         if ( $value === '' || is_numeric( $field ) ) {
 484                                 continue;
 485                         }
 486                         switch ( $field ) {
 487                                 case 'typepublic':
 488                                 case 'typesystem':
 489                                         $parsed['type'] = $value;
 490                                         break;
 491                                 case 'pubquote':
 492                                 case 'pubapos':
 493                                         $parsed['publicid'] = $value;
 494                                         break;
 495                                 case 'pubsysquote':
 496                                 case 'pubsysapos':
 497                                 case 'sysquote':
 498                                 case 'sysapos':
 499                                         $parsed['systemid'] = $value;
 500                                         break;
 501                                 case 'internal':
 502                                         $parsed['internal'] = $value;
 503                                         break;
 504                         }
 505                 }
 506                 return $parsed;
 507         }
 508 }