+++ /dev/null
-<?php
-
-namespace Drupal\security_review\Checks;
-
-use Drupal\Component\PhpStorage\FileStorage;
-use Drupal\Core\StreamWrapper\PublicStream;
-use Drupal\security_review\Check;
-use Drupal\security_review\CheckResult;
-use GuzzleHttp\Exception\RequestException;
-
-/**
- * Checks if PHP files written to the files directory can be executed.
- */
-class ExecutablePhp extends Check {
-
- /**
- * Drupal's HTTP Client.
- *
- * @var \Drupal\Core\Http\Client
- */
- protected $httpClient;
-
- /**
- * {@inheritdoc}
- */
- public function __construct() {
- parent::__construct();
- $this->httpClient = $this->container->get('http_client');
- }
-
- /**
- * {@inheritdoc}
- */
- public function getNamespace() {
- return 'Security Review';
- }
-
- /**
- * {@inheritdoc}
- */
- public function getTitle() {
- return 'Executable PHP';
- }
-
- /**
- * {@inheritdoc}
- */
- public function run($cli = FALSE) {
- global $base_url;
- $result = CheckResult::SUCCESS;
- $findings = [];
-
- // Set up test file data.
- $message = 'Security review test ' . date('Ymdhis');
- $content = "<?php\necho '" . $message . "';";
- $file_path = PublicStream::basePath() . '/security_review_test.php';
-
- // Create the test file.
- if ($test_file = @fopen('./' . $file_path, 'w')) {
- fwrite($test_file, $content);
- fclose($test_file);
- }
-
- // Try to access the test file.
- try {
- $response = $this->httpClient->get($base_url . '/' . $file_path);
- if ($response->getStatusCode() == 200 && $response->getBody() === $message) {
- $result = CheckResult::FAIL;
- $findings[] = 'executable_php';
- }
- }
- catch (RequestException $e) {
- // Access was denied to the file.
- }
-
- // Remove the test file.
- if (file_exists('./' . $file_path)) {
- @unlink('./' . $file_path);
- }
-
- // Check for presence of the .htaccess file and if the contents are correct.
- $htaccess_path = PublicStream::basePath() . '/.htaccess';
- if (!file_exists($htaccess_path)) {
- $result = CheckResult::FAIL;
- $findings[] = 'missing_htaccess';
- }
- else {
- // Check whether the contents of .htaccess are correct.
- $contents = file_get_contents($htaccess_path);
- $expected = FileStorage::htaccessLines(FALSE);
-
- // Trim each line separately then put them back together.
- $contents = implode("\n", array_map('trim', explode("\n", trim($contents))));
- $expected = implode("\n", array_map('trim', explode("\n", trim($expected))));
-
- if ($contents !== $expected) {
- $result = CheckResult::FAIL;
- $findings[] = 'incorrect_htaccess';
- }
-
- // Check whether .htaccess is writable.
- if (!$cli) {
- $writable_htaccess = is_writable($htaccess_path);
- }
- else {
- $writable = $this->security()->findWritableFiles([$htaccess_path], TRUE);
- $writable_htaccess = !empty($writable);
- }
-
- if ($writable_htaccess) {
- $findings[] = 'writable_htaccess';
- if ($result !== CheckResult::FAIL) {
- $result = CheckResult::WARN;
- }
- }
- }
-
- return $this->createResult($result, $findings);
- }
-
- /**
- * {@inheritdoc}
- */
- public function runCli() {
- return $this->run(TRUE);
- }
-
- /**
- * {@inheritdoc}
- */
- public function help() {
- $paragraphs = [];
- $paragraphs[] = $this->t('The Drupal files directory is for user-uploaded files and by default provides some protection against a malicious user executing arbitrary PHP code against your site.');
- $paragraphs[] = $this->t('Read more about the <a href="https://drupal.org/node/615888">risk of PHP code execution on Drupal.org</a>.');
-
- return [
- '#theme' => 'check_help',
- '#title' => $this->t('Executable PHP in files directory'),
- '#paragraphs' => $paragraphs,
- ];
- }
-
- /**
- * {@inheritdoc}
- */
- public function evaluate(CheckResult $result) {
- $paragraphs = [];
- foreach ($result->findings() as $label) {
- switch ($label) {
- case 'executable_php':
- $paragraphs[] = $this->t('Security Review was able to execute a PHP file written to your files directory.');
- break;
-
- case 'missing_htaccess':
- $directory = PublicStream::basePath();
- $paragraphs[] = $this->t("The .htaccess file is missing from the files directory at @path", ['@path' => $directory]);
- $paragraphs[] = $this->t("Note, if you are using a webserver other than Apache you should consult your server's documentation on how to limit the execution of PHP scripts in this directory.");
- break;
-
- case 'incorrect_htaccess':
- $paragraphs[] = $this->t("The .htaccess file exists but does not contain the correct content. It is possible it's been maliciously altered.");
- break;
-
- case 'writable_htaccess':
- $paragraphs[] = $this->t("The .htaccess file is writable which poses a risk should a malicious user find a way to execute PHP code they could alter the .htaccess file to allow further PHP code execution.");
- break;
- }
- }
-
- return [
- '#theme' => 'check_evaluation',
- '#paragraphs' => $paragraphs,
- '#items' => [],
- ];
- }
-
- /**
- * {@inheritdoc}
- */
- public function evaluatePlain(CheckResult $result) {
- $paragraphs = [];
- $directory = PublicStream::basePath();
- foreach ($result->findings() as $label) {
- switch ($label) {
- case 'executable_php':
- $paragraphs[] = $this->t('PHP file executed in @path', ['@path' => $directory]);
- break;
-
- case 'missing_htaccess':
- $paragraphs[] = $this->t('.htaccess is missing from @path', ['@path' => $directory]);
- break;
-
- case 'incorrect_htaccess':
- $paragraphs[] = $this->t('.htaccess wrong content');
- break;
-
- case 'writable_htaccess':
- $paragraphs[] = $this->t('.htaccess writable');
- break;
- }
- }
-
- return implode("\n", $paragraphs);
- }
-
- /**
- * {@inheritdoc}
- */
- public function getMessage($result_const) {
- switch ($result_const) {
- case CheckResult::SUCCESS:
- return $this->t('PHP files in the Drupal files directory cannot be executed.');
-
- case CheckResult::FAIL:
- return $this->t('PHP files in the Drupal files directory can be executed.');
-
- case CheckResult::WARN:
- return $this->t('The .htaccess file in the files directory is writable.');
-
- default:
- return $this->t('Unexpected result.');
- }
- }
-
-}
projects / yaffs-website / blobdiff