← All changes | callback/streams.php +23 -10 5.47 → trunk View file →

		@@ -1,10 +1,17 @@
1	1	<?php
2		-
	2	+// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fread
	3	+// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fwrite
	4	+// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fsockopen
	5	+// We use php method like fread, fwrite to read only a portion of a file, we don't have a direct method for partial reads since WP_Filesystem doesn't support a direct equivalent to fread, fwrite.
	6	+// The entire file deals with custom stream handling
	7	+// We need direct socket/file operations for this functionality
	8	+// WordPress filesystem alternatives wouldn't work for this use case
	9	+// It's better to disable these specific rules at file level than adding individual ignore comments
3	10	if (!defined('ABSPATH')) exit;
4		-if (!class_exists('BVRespStream')) :
	11	+if (!class_exists('WPRRespStream')) :
5	12
6		- class BVStream extends BVCallbackBase {
	13	+ class WPRStream extends WPRCallbackBase {
7	14	public $bvb64stream;
8	15	public $bvb64cksize;
9	16	public $checksum;
10	17
		@@ -19,11 +26,11 @@
19	26
20	27	public static function startStream($account, $request) {
21	28	$result = array();
22	29	$params = $request->params;
23		- $stream = new BVRespStream($request);
	30	+ $stream = new WPRRespStream($request);
24	31	if ($request->isAPICall()) {
25		- $stream = new BVHttpStream($request);
	32	+ $stream = new WPRHttpStream($request);
26	33	if (!$stream->connect()) {
27	34	$apicallstatus = array(
28	35	"httperror" => "Cannot Open Connection to Host",
29	36	"streamerrno" => $stream->errno,
		@@ -67,20 +74,25 @@
67	74	}
68	75	}
69	76	}
70	77
71		-class BVRespStream extends BVStream {
	78	+class WPRRespStream extends WPRStream {
72	79	public $bvboundry;
73	80
74	81	function __construct($request) {
75	82	parent::__construct($request);
76		- $this->bvboundry = $request->bvboundry;
	83	+ // Restrict boundary to safe chars so raw echo cannot inject into response (XSS).
	84	+ $raw = isset($request->bvboundry) ? (string) $request->bvboundry : '';
	85	+ $sanitized = preg_replace('/[^a-zA-Z0-9_-]/', '', $raw);
	86	+ $this->bvboundry = $sanitized !== '' ? $sanitized : 'bvstream';
77	87	}
78	88
79	89	public function writeChunk($chunk) {
	90	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- bvboundry sanitized in constructor; raw stream protocol (not HTML), chunk must not be escaped or stream is corrupted
80	91	echo $this->bvboundry . "ckckckckck" . $chunk . $this->bvboundry . "ckckckckck";
81	92	}
82	93	public function endStream() {
	94	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- bvboundry sanitized in constructor; raw stream protocol (not HTML)
83	95	echo $this->bvboundry . "rerererere";
84	96
85	97	return array();
86	98	}
		@@ -85,10 +97,10 @@
85	97	return array();
86	98	}
87	99	}
88	100
89		-class BVHttpStream extends BVStream {
90		- var $user_agent = 'BVHttpStream';
	101	+class WPRHttpStream extends WPRStream {
	102	+ var $user_agent = 'WPRHttpStream';
91	103	var $host;
92	104	var $port;
93	105	var $timeout = 20;
94	106	var $conn;
		@@ -168,9 +180,9 @@
168	180	$mph = array(
169	181	"Content-Disposition" => "form-data; name=bvinfile; filename=data",
170	182	"Content-Type" => "application/octet-stream"
171	183	);
172		- $rnd = rand(100000, 999999);
	184	+ $rnd = rand(100000, 999999); // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_rand
173	185	$this->boundary = "----".$rnd;
174	186	$prologue = "--".$this->boundary."\r\n";
175	187	foreach($mph as $key=>$val) {
176	188	$prologue .= $key.":".$val."\r\n";
		@@ -243,5 +255,6 @@
243	255	}
244	256	return $response;
245	257	}
246	258	}
	259	+// phpcs:enable
247	260	endif;