Code Coverage |
||||||||||
Lines |
Functions and Methods |
Classes and Traits |
||||||||
Total | |
0.00% |
0 / 40 |
|
0.00% |
0 / 4 |
CRAP | |
0.00% |
0 / 1 |
ListFetcher | |
0.00% |
0 / 40 |
|
0.00% |
0 / 4 |
90 | |
0.00% |
0 / 1 |
__construct | |
0.00% |
0 / 1 |
|
0.00% |
0 / 1 |
2 | |||
output | |
0.00% |
0 / 2 |
|
0.00% |
0 / 1 |
6 | |||
getLatestInfo | |
0.00% |
0 / 13 |
|
0.00% |
0 / 1 |
6 | |||
fetchList | |
0.00% |
0 / 24 |
|
0.00% |
0 / 1 |
20 |
1 | <?php |
2 | /** |
3 | * Copyright (C) 2018-2019 Kunal Mehta <legoktm@debian.org> |
4 | * |
5 | * This program is free software; you can redistribute it and/or modify |
6 | * it under the terms of the GNU General Public License as published by |
7 | * the Free Software Foundation; either version 3 of the License, or |
8 | * (at your option) any later version. |
9 | * |
10 | * This program is distributed in the hope that it will be useful, |
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
13 | * GNU General Public License for more details. |
14 | * |
15 | * You should have received a copy of the GNU General Public License |
16 | * along with this program. If not, see <https://www.gnu.org/licenses/>. |
17 | */ |
18 | |
19 | namespace MediaWiki\SecureLinkFixer; |
20 | |
21 | use DateTime; |
22 | use RuntimeException; |
23 | use Wikimedia\StaticArrayWriter; |
24 | |
25 | /** |
26 | * Downloads Mozilla's HSTS preload list and builds it into a PHP file. |
27 | * |
28 | * We explicitly don't use any MediaWiki code so that this class |
29 | * can be run without needing all of MediaWiki to be installed. The |
30 | * only exception right now is the StaticArrayWriter class. |
31 | */ |
32 | class ListFetcher { |
33 | /** @var ?callable */ |
34 | private $output; |
35 | |
36 | private const HTTP_OPTIONS = [ |
37 | 'http' => [ 'method' => 'GET', 'header' => [ 'User-Agent: MediaWiki SecureLinkFixer' ] ] |
38 | ]; |
39 | |
40 | /** |
41 | * @param callable|null $output |
42 | */ |
43 | public function __construct( callable $output = null ) { |
44 | $this->output = $output; |
45 | } |
46 | |
47 | /** |
48 | * @param string $text |
49 | */ |
50 | private function output( $text ) { |
51 | if ( $this->output ) { |
52 | call_user_func( $this->output, $text ); |
53 | } |
54 | } |
55 | |
56 | /** |
57 | * Fetches the latest revision/date available from GitHub mozilla/gecko-dev |
58 | * |
59 | * @return string[] |
60 | */ |
61 | public function getLatestInfo(): array { |
62 | // phpcs:ignore Generic.Files.LineLength |
63 | $changesUrl = 'https://api.github.com/repos/mozilla/gecko-dev/commits?sha=master&per_page=1&path=security%2Fmanager%2Fssl%2FnsSTSPreloadList.inc'; |
64 | $json = json_decode( |
65 | file_get_contents( |
66 | $changesUrl, |
67 | false, |
68 | stream_context_create( self::HTTP_OPTIONS ) |
69 | ) |
70 | ); |
71 | |
72 | if ( !isset( $json[0]->sha ) ) { |
73 | throw new RuntimeException( "Unable to parse revision id/updated date for HSTS preload list" ); |
74 | } |
75 | |
76 | $rev = $json[0]->sha; |
77 | $date = new DateTime( $json[0]->commit->author->date ); |
78 | return [ $rev, $date->format( 'Y-m-d' ) ]; |
79 | } |
80 | |
81 | /** |
82 | * Downloads the list for the given revision/date and formats it for PHP |
83 | * |
84 | * @param string $rev git revision |
85 | * @param string $date YYYY-MM-DD formatted date |
86 | * @return string PHP file code |
87 | */ |
88 | public function fetchList( $rev, $date ) { |
89 | $this->output( "Downloading the HSTS preload list (revision $rev)..." ); |
90 | // phpcs:ignore Generic.Files.LineLength |
91 | $url = "https://github.com/mozilla/gecko-dev/raw/$rev/security/manager/ssl/nsSTSPreloadList.inc"; |
92 | $lines = explode( "\n", |
93 | file_get_contents( |
94 | $url, |
95 | false, |
96 | stream_context_create( self::HTTP_OPTIONS ) |
97 | ) |
98 | ); |
99 | $this->output( "done\n" ); |
100 | $inList = false; |
101 | $header = <<<HEADER |
102 | Generated by fetchList.php using mozilla/gecko-dev@$rev ($date) |
103 | This Source Code Form is subject to the terms of the Mozilla Public |
104 | License, v. 2.0. If a copy of the MPL was not distributed with this |
105 | file, You can obtain one at https://mozilla.org/MPL/2.0/. |
106 | phpcs:ignoreFile |
107 | HEADER; |
108 | |
109 | // XXX: Should we care about gPreloadListExpirationTime? |
110 | $data = []; |
111 | foreach ( $lines as $line ) { |
112 | if ( $line === '%%' ) { |
113 | $inList = !$inList; |
114 | continue; |
115 | } |
116 | |
117 | if ( $inList ) { |
118 | $exploded = explode( ', ', $line ); |
119 | $data[$exploded[0]] = (int)$exploded[1]; |
120 | } |
121 | } |
122 | $writer = new StaticArrayWriter(); |
123 | return $writer->create( $data, $header ); |
124 | } |
125 | } |