--- /dev/null
+<?php
+
+namespace Drupal\security_review;
+
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\DependencyInjection\DependencySerializationTrait;
+use Drupal\Core\DrupalKernelInterface;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\user\Entity\Role;
+
+/**
+ * Provides frequently used security-related data.
+ */
+class Security {
+
+ use DependencySerializationTrait;
+
+ /**
+ * The config factory.
+ *
+ * @var \Drupal\Core\Config\ConfigFactoryInterface
+ */
+ protected $configFactory;
+
+ /**
+ * The Drupal kernel.
+ *
+ * @var \Drupal\Core\DrupalKernelInterface
+ */
+ protected $kernel;
+
+ /**
+ * The module handler.
+ *
+ * @var \Drupal\Core\Extension\ModuleHandlerInterface
+ */
+ protected $moduleHandler;
+
+ /**
+ * The security_review service.
+ *
+ * @var \Drupal\security_review\SecurityReview
+ */
+ protected $securityReview;
+
+ /**
+ * Constructs a Security instance.
+ *
+ * @param \Drupal\security_review\SecurityReview $security_review
+ * The SecurityReview service.
+ * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler
+ * The module handler.
+ * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+ * The config factory.
+ * @param \Drupal\Core\DrupalKernelInterface $kernel
+ * The Drupal kernel.
+ */
+ public function __construct(SecurityReview $security_review, ModuleHandlerInterface $module_handler, ConfigFactoryInterface $config_factory, DrupalKernelInterface $kernel) {
+ // Store the dependencies.
+ $this->securityReview = $security_review;
+ $this->moduleHandler = $module_handler;
+ $this->configFactory = $config_factory;
+ $this->kernel = $kernel;
+ }
+
+ /**
+ * Returns the IDs of untrusted roles.
+ *
+ * If the module hasn't been configured yet, it returns the default untrusted
+ * roles.
+ *
+ * @return string[]
+ * Untrusted roles' IDs.
+ */
+ public function untrustedRoles() {
+ // If the module hasn't been manually configured yet, return the untrusted
+ // roles depending on Drupal's actual configuration.
+ if (!$this->securityReview->isConfigured()) {
+ return static::defaultUntrustedRoles();
+ }
+
+ // Else return the stored untrusted roles.
+ return $this->securityReview->getUntrustedRoles();
+ }
+
+ /**
+ * Returns the default untrusted roles.
+ *
+ * The default untrusted roles are:
+ * Anonymous : always
+ * Authenticated : if visitors are allowed to create accounts.
+ *
+ * @return string[]
+ * Default untrusted roles' IDs.
+ */
+ public function defaultUntrustedRoles() {
+ // Add the Anonymous role to the output array.
+ $roles = [AccountInterface::ANONYMOUS_ROLE];
+
+ // Check whether visitors can create accounts.
+ $user_register = $this->configFactory->get('user.settings')
+ ->get('register');
+ if ($user_register !== USER_REGISTER_ADMINISTRATORS_ONLY) {
+ // If visitors are allowed to create accounts they are considered
+ // untrusted.
+ $roles[] = AccountInterface::AUTHENTICATED_ROLE;
+ }
+
+ // Return the untrusted roles.
+ return $roles;
+ }
+
+ /**
+ * Returns the permission strings that a group of roles have.
+ *
+ * @param string[] $role_ids
+ * The array of roleIDs to check.
+ * @param bool $group_by_role_id
+ * Choose whether to group permissions by role ID.
+ *
+ * @return array
+ * An array of the permissions untrusted roles have. If $groupByRoleId is
+ * true, the array key is the role ID, the value is the array of permissions
+ * the role has.
+ */
+ public function rolePermissions(array $role_ids, $group_by_role_id = FALSE) {
+ // Get the permissions the given roles have, grouped by roles.
+ $permissions_grouped = user_role_permissions($role_ids);
+
+ // Fill up the administrative roles' permissions too.
+ foreach ($role_ids as $role_id) {
+ $role = Role::load($role_id);
+ /** @var Role $role */
+ if ($role->isAdmin()) {
+ $permissions_grouped[$role_id] = $this->permissions();
+ }
+ }
+
+ if ($group_by_role_id) {
+ // If the result should be grouped, we have nothing else to do.
+ return $permissions_grouped;
+ }
+ else {
+ // Merge the grouped permissions into $untrusted_permissions.
+ $untrusted_permissions = [];
+ foreach ($permissions_grouped as $permissions) {
+ $untrusted_permissions = array_merge($untrusted_permissions, $permissions);
+ }
+
+ // Remove duplicate elements and fix indexes.
+ $untrusted_permissions = array_values(array_unique($untrusted_permissions));
+ return $untrusted_permissions;
+ }
+ }
+
+ /**
+ * Returns the permission strings that untrusted roles have.
+ *
+ * @param bool $group_by_role_id
+ * Choose whether to group permissions by role ID.
+ *
+ * @return array
+ * An array of the permissions untrusted roles have. If $groupByRoleId is
+ * true, the array key is the role ID, the value is the array of permissions
+ * the role has.
+ */
+ public function untrustedPermissions($group_by_role_id = FALSE) {
+ return $this->rolePermissions($this->untrustedRoles(), $group_by_role_id);
+ }
+
+ /**
+ * Returns the trusted roles.
+ *
+ * @return array
+ * Trusted roles' IDs.
+ */
+ public function trustedRoles() {
+ // Get the stored/default untrusted roles.
+ $untrusted_roles = $this->untrustedRoles();
+
+ // Iterate through all the roles, and store which are not untrusted.
+ $trusted = [];
+ foreach (user_roles() as $role) {
+ if (!in_array($role->id(), $untrusted_roles)) {
+ $trusted[] = $role->id();
+ }
+ }
+
+ // Return the trusted roles.
+ return $trusted;
+ }
+
+ /**
+ * Returns the permission strings that trusted roles have.
+ *
+ * @param bool $group_by_role_id
+ * Choose whether to group permissions by role ID.
+ *
+ * @return array
+ * An array of the permissions trusted roles have. If $groupByRoleId is
+ * true, the array key is the role ID, the value is the array of permissions
+ * the role has.
+ */
+ public function trustedPermissions($group_by_role_id = FALSE) {
+ return $this->rolePermissions($this->trustedRoles(), $group_by_role_id);
+ }
+
+
+ /**
+ * Gets all the permissions.
+ *
+ * @param bool $meta
+ * Whether to return only permission strings or metadata too.
+ *
+ * @see \Drupal\user\PermissionHandlerInterface::getPermissions()
+ *
+ * @return array
+ * Array of every permission.
+ */
+ public function permissions($meta = FALSE) {
+ // Not injected because of hard testability.
+ $permissions = \Drupal::service('user.permissions')->getPermissions();
+
+ if (!$meta) {
+ return array_keys($permissions);
+ }
+ return $permissions;
+ }
+
+ /**
+ * Gets the list of unsafe HTML tags.
+ *
+ * @return string[]
+ * List of unsafe tags.
+ */
+ public function unsafeTags() {
+ $unsafe_tags = [
+ 'applet',
+ 'area',
+ 'audio',
+ 'base',
+ 'basefont',
+ 'body',
+ 'button',
+ 'comment',
+ 'embed',
+ 'eval',
+ 'form',
+ 'frame',
+ 'frameset',
+ 'head',
+ 'html',
+ 'iframe',
+ 'image',
+ 'img',
+ 'input',
+ 'isindex',
+ 'label',
+ 'link',
+ 'map',
+ 'math',
+ 'meta',
+ 'noframes',
+ 'noscript',
+ 'object',
+ 'optgroup',
+ 'option',
+ 'param',
+ 'script',
+ 'select',
+ 'style',
+ 'svg',
+ 'table',
+ 'td',
+ 'textarea',
+ 'title',
+ 'video',
+ 'vmlframe',
+ ];
+
+ // Alter data.
+ $this->moduleHandler->alter('security_review_unsafe_tags', $unsafe_tags);
+
+ return $unsafe_tags;
+ }
+
+ /**
+ * Gets the list of unsafe file extensions.
+ *
+ * @return string[]
+ * List of unsafe extensions.
+ */
+ public function unsafeExtensions() {
+ $unsafe_ext = [
+ 'swf',
+ 'exe',
+ 'html',
+ 'htm',
+ 'php',
+ 'phtml',
+ 'py',
+ 'js',
+ 'vb',
+ 'vbe',
+ 'vbs',
+ ];
+
+ // Alter data.
+ $this->moduleHandler
+ ->alter('security_review_unsafe_extensions', $unsafe_ext);
+
+ return $unsafe_ext;
+ }
+
+ /**
+ * Returns the site path.
+ *
+ * @return string
+ * Absolute site path.
+ */
+ public function sitePath() {
+ return DRUPAL_ROOT . '/' . $this->kernel->getSitePath();
+ }
+
+ /**
+ * Finds files and directories that are writable by the web server.
+ *
+ * @param string[] $files
+ * The files to iterate through.
+ * @param bool $cli
+ * Whether it is being invoked in CLI context.
+ *
+ * @return string[]
+ * The files that are writable.
+ */
+ public function findWritableFiles(array $files, $cli = FALSE) {
+ $writable = [];
+ if (!$cli) {
+ // Running from UI.
+ foreach ($files as $file) {
+ if (is_writable($file)) {
+ $writable[] = $file;
+ }
+ }
+ }
+ else {
+ // Get the web server's user data.
+ $uid = $this->securityReview->getServerUid();
+ $gids = $this->securityReview->getServerGids();
+
+ foreach ($files as $file) {
+ $perms = 0777 & fileperms($file);
+ // Check write permissions for others.
+ $ow = ($perms >> 1) & 1;
+ if ($ow === 1) {
+ $writable[] = $file;
+ continue;
+ }
+
+ // Check write permissions for owner.
+ $uw = ($perms >> 7) & 1;
+ if ($uw === 1 && fileowner($file) == $uid) {
+ $writable[] = $file;
+ continue;
+ }
+
+ // Check write permissions for group.
+ $gw = ($perms >> 4) & 1;
+ if ($gw === 1 && in_array(filegroup($file), $gids)) {
+ $writable[] = $file;
+ }
+ }
+ }
+ return $writable;
+ }
+
+}
projects / yaffs-website / blobdiff