40 abstract class UploadBase {
44 protected $tempFileObj;
46 protected $mDesiredDestName, $mDestName, $mRemoveTempFile, $mSourceType;
47 protected $mTitle =
false, $mTitleError = 0;
48 protected $mFilteredName, $mFinalExtension;
49 protected $mLocalFile, $mStashFile, $mFileSize, $mFileProps;
50 protected $mBlackListedExtensions;
51 protected $mJavaDetected, $mSVGNSError;
53 protected static $safeXmlEncodings = [
73 const MIN_LENGTH_PARTNAME = 4;
74 const ILLEGAL_FILENAME = 5;
75 const OVERWRITE_EXISTING_FILE = 7; # Not
used anymore; handled
by verifyTitlePermissions()
76 const FILETYPE_MISSING = 8;
77 const FILETYPE_BADTYPE = 9;
78 const VERIFICATION_ERROR = 10;
79 const HOOK_ABORTED = 11;
80 const FILE_TOO_LARGE = 12;
81 const WINDOWS_NONASCII_FILENAME = 13;
82 const FILENAME_TOO_LONG = 14;
90 self::EMPTY_FILE =>
'empty-file',
91 self::FILE_TOO_LARGE =>
'file-too-large',
92 self::FILETYPE_MISSING =>
'filetype-missing',
93 self::FILETYPE_BADTYPE =>
'filetype-banned',
94 self::MIN_LENGTH_PARTNAME =>
'filename-tooshort',
95 self::ILLEGAL_FILENAME =>
'illegal-filename',
96 self::OVERWRITE_EXISTING_FILE =>
'overwrite',
97 self::VERIFICATION_ERROR =>
'verification-error',
98 self::HOOK_ABORTED =>
'hookaborted',
99 self::WINDOWS_NONASCII_FILENAME =>
'windows-nonascii-filename',
100 self::FILENAME_TOO_LONG =>
'filename-toolong',
102 return $code_to_status[$error] ??
'unknown-error';
110 public static function isEnabled() {
117 # Check php's file_uploads setting
129 public static function isAllowed(
$user ) {
130 foreach ( [
'upload',
'edit' ]
as $permission ) {
131 if ( !
$user->isAllowed( $permission ) ) {
145 public static function isThrottled(
$user ) {
146 return $user->pingLimiter(
'upload' );
150 private static $uploadHandlers = [
'Stash',
'File',
'Url' ];
159 public static function createFromRequest( &
$request,
$type =
null ) {
172 if ( is_null( $className ) ) {
173 $className =
'UploadFrom' .
$type;
174 wfDebug( __METHOD__ .
": class name: $className\n" );
175 if ( !in_array(
$type, self::$uploadHandlers ) ) {
181 if ( !call_user_func( [ $className,
'isEnabled' ] ) ) {
186 if ( !call_user_func( [ $className,
'isValidRequest' ],
$request ) ) {
203 public static function isValidRequest(
$request ) {
207 public function __construct() {
216 public function getSourceType() {
228 public function initializePathInfo(
$name, $tempPath, $fileSize, $removeTempFile =
false ) {
229 $this->mDesiredDestName =
$name;
231 throw new MWException( __METHOD__ .
" given storage path `$tempPath`." );
234 $this->setTempFile( $tempPath, $fileSize );
235 $this->mRemoveTempFile = $removeTempFile;
243 abstract public function initializeFromRequest( &
$request );
249 protected function setTempFile( $tempPath, $fileSize =
null ) {
250 $this->mTempPath = $tempPath;
251 $this->mFileSize = $fileSize ?:
null;
252 if ( strlen( $this->mTempPath ) && file_exists( $this->mTempPath ) ) {
253 $this->tempFileObj =
new TempFSFile( $this->mTempPath );
255 $this->mFileSize = filesize( $this->mTempPath );
258 $this->tempFileObj =
null;
266 public function fetchFile() {
274 public function isEmptyFile() {
275 return empty( $this->mFileSize );
282 public function getFileSize() {
283 return $this->mFileSize;
290 public function getTempFileSha1Base36() {
298 public function getRealPath( $srcPath ) {
304 $tmpFile = $repo->getLocalCopy( $srcPath );
306 $tmpFile->bind( $this );
308 $path = $tmpFile ? $tmpFile->getPath() :
false;
320 public function verifyUpload() {
324 if ( $this->isEmptyFile() ) {
325 return [
'status' => self::EMPTY_FILE ];
331 $maxSize = self::getMaxUploadSize( $this->getSourceType() );
332 if ( $this->mFileSize > $maxSize ) {
334 'status' => self::FILE_TOO_LARGE,
344 $verification = $this->verifyFile();
345 if ( $verification !==
true ) {
347 'status' => self::VERIFICATION_ERROR,
348 'details' => $verification
355 $result = $this->validateName();
362 [ $this->mDestName, $this->mTempPath, &$error ],
'1.28' )
364 return [
'status' => self::HOOK_ABORTED,
'error' => $error ];
367 return [
'status' => self::OK ];
376 public function validateName() {
377 $nt = $this->getTitle();
378 if ( is_null( $nt ) ) {
379 $result = [
'status' => $this->mTitleError ];
380 if ( $this->mTitleError == self::ILLEGAL_FILENAME ) {
381 $result[
'filtered'] = $this->mFilteredName;
383 if ( $this->mTitleError == self::FILETYPE_BADTYPE ) {
384 $result[
'finalExt'] = $this->mFinalExtension;
385 if (
count( $this->mBlackListedExtensions ) ) {
386 $result[
'blacklistedExt'] = $this->mBlackListedExtensions;
392 $this->mDestName = $this->getLocalFile()->
getName();
406 protected function verifyMimeType( $mime ) {
409 wfDebug(
"mime: <$mime> extension: <{$this->mFinalExtension}>\n" );
412 return [
'filetype-badmime', $mime ];
415 # Check what Internet Explorer would detect
416 $fp = fopen( $this->mTempPath,
'rb' );
417 $chunk = fread( $fp, 256 );
421 $extMime = $magic->guessTypesForExtension( $this->mFinalExtension );
422 $ieTypes = $magic->getIEMimeTypes( $this->mTempPath, $chunk, $extMime );
423 foreach ( $ieTypes
as $ieType ) {
425 return [
'filetype-bad-ie-mime', $ieType ];
438 protected function verifyFile() {
441 $status = $this->verifyPartialFile();
447 $this->mFileProps = $mwProps->getPropsFromPath( $this->mTempPath, $this->mFinalExtension );
448 $mime = $this->mFileProps[
'mime'];
451 # XXX: Missing extension will be caught by validateName() via getTitle()
452 if ( $this->mFinalExtension !=
'' && !$this->verifyExtension( $mime, $this->mFinalExtension ) ) {
453 return [
'filetype-mime-mismatch', $this->mFinalExtension, $mime ];
457 # check for htmlish code and javascript
459 if ( $this->mFinalExtension ==
'svg' || $mime ==
'image/svg+xml' ) {
460 $svgStatus = $this->detectScriptInSvg( $this->mTempPath,
false );
461 if ( $svgStatus !==
false ) {
469 $handlerStatus =
$handler->verifyUpload( $this->mTempPath );
470 if ( !$handlerStatus->isOK() ) {
471 $errors = $handlerStatus->getErrorsArray();
473 return reset( $errors );
478 Hooks::run(
'UploadVerifyFile', [ $this, $mime, &$error ] );
479 if ( $error !==
true ) {
480 if ( !is_array( $error ) ) {
486 wfDebug( __METHOD__ .
": all clear; passing.\n" );
499 protected function verifyPartialFile() {
502 # getTitle() sets some internal parameters like $this->mFinalExtension
506 $this->mFileProps = $mwProps->getPropsFromPath( $this->mTempPath, $this->mFinalExtension );
508 # check MIME type, if desired
509 $mime = $this->mFileProps[
'file-mime'];
510 $status = $this->verifyMimeType( $mime );
515 # check for htmlish code and javascript
517 if ( self::detectScript( $this->mTempPath, $mime, $this->mFinalExtension ) ) {
518 return [
'uploadscripted' ];
520 if ( $this->mFinalExtension ==
'svg' || $mime ==
'image/svg+xml' ) {
521 $svgStatus = $this->detectScriptInSvg( $this->mTempPath,
true );
522 if ( $svgStatus !==
false ) {
528 # Check for Java applets, which if uploaded can bypass cross-site
531 $this->mJavaDetected =
false;
533 [ $this,
'zipEntryCallback' ] );
534 if ( !$zipStatus->isOK() ) {
535 $errors = $zipStatus->getErrorsArray();
536 $error = reset( $errors );
537 if ( $error[0] !==
'zip-wrong-format' ) {
541 if ( $this->mJavaDetected ) {
542 return [
'uploadjava' ];
546 # Scan the uploaded file for viruses
547 $virus = $this->detectVirus( $this->mTempPath );
549 return [
'uploadvirus', $virus ];
560 public function zipEntryCallback( $entry ) {
561 $names = [ $entry[
'name'] ];
568 $nullPos = strpos( $entry[
'name'],
"\000" );
569 if ( $nullPos !==
false ) {
570 $names[] = substr( $entry[
'name'], 0, $nullPos );
575 if ( preg_grep(
'!\.class/?$!', $names ) ) {
576 $this->mJavaDetected =
true;
589 public function verifyPermissions(
$user ) {
590 return $this->verifyTitlePermissions(
$user );
604 public function verifyTitlePermissions(
$user ) {
609 $nt = $this->getTitle();
610 if ( is_null( $nt ) ) {
613 $permErrors = $nt->getUserPermissionsErrors(
'edit',
$user );
614 $permErrorsUpload = $nt->getUserPermissionsErrors(
'upload',
$user );
615 if ( !$nt->exists() ) {
616 $permErrorsCreate = $nt->getUserPermissionsErrors(
'create',
$user );
618 $permErrorsCreate = [];
620 if ( $permErrors || $permErrorsUpload || $permErrorsCreate ) {
621 $permErrors = array_merge( $permErrors,
wfArrayDiff2( $permErrorsUpload, $permErrors ) );
622 $permErrors = array_merge( $permErrors,
wfArrayDiff2( $permErrorsCreate, $permErrors ) );
627 $overwriteError = $this->checkOverwrite(
$user );
628 if ( $overwriteError !==
true ) {
629 return [ $overwriteError ];
642 public function checkWarnings() {
645 $localFile = $this->getLocalFile();
646 $localFile->
load( File::READ_LATEST );
647 $filename = $localFile->
getName();
648 $hash = $this->getTempFileSha1Base36();
650 $badFileName = $this->checkBadFileName( $filename, $this->mDesiredDestName );
651 if ( $badFileName !==
null ) {
652 $warnings[
'badfilename'] = $badFileName;
655 $unwantedFileExtensionDetails = $this->checkUnwantedFileExtensions( $this->mFinalExtension );
656 if ( $unwantedFileExtensionDetails !==
null ) {
657 $warnings[
'filetype-unwanted-type'] = $unwantedFileExtensionDetails;
660 $fileSizeWarnings = $this->checkFileSize( $this->mFileSize );
661 if ( $fileSizeWarnings ) {
662 $warnings = array_merge( $warnings, $fileSizeWarnings );
665 $localFileExistsWarnings = $this->checkLocalFileExists( $localFile, $hash );
666 if ( $localFileExistsWarnings ) {
667 $warnings = array_merge( $warnings, $localFileExistsWarnings );
670 if ( $this->checkLocalFileWasDeleted( $localFile ) ) {
671 $warnings[
'was-deleted'] = $filename;
676 $ignoreLocalDupes = isset( $warnings[
'exists '] );
677 $dupes = $this->checkAgainstExistingDupes( $hash, $ignoreLocalDupes );
679 $warnings[
'duplicate'] = $dupes;
682 $archivedDupes = $this->checkAgainstArchiveDupes( $hash );
683 if ( $archivedDupes !==
null ) {
684 $warnings[
'duplicate-archive'] = $archivedDupes;
699 private function checkBadFileName( $filename, $desiredFileName ) {
700 $comparableName = str_replace(
' ',
'_', $desiredFileName );
703 if ( $desiredFileName != $filename && $comparableName != $filename ) {
718 private function checkUnwantedFileExtensions( $fileExtension ) {
723 if ( !$this->checkFileExtension( $fileExtension, $extensions ) ) {
726 $wgLang->commaList( $extensions ),
740 private function checkFileSize( $fileSize ) {
749 if ( $fileSize == 0 ) {
750 $warnings[
'empty-file'] =
true;
762 private function checkLocalFileExists(
LocalFile $localFile, $hash ) {
765 $exists = self::getExistsWarning( $localFile );
766 if ( $exists !==
false ) {
767 $warnings[
'exists'] = $exists;
770 if ( $hash === $localFile->
getSha1() ) {
771 $warnings[
'no-change'] = $localFile;
776 foreach ( $history
as $oldFile ) {
777 if ( $hash === $oldFile->getSha1() ) {
778 $warnings[
'duplicate-version'][] = $oldFile;
786 private function checkLocalFileWasDeleted(
LocalFile $localFile ) {
796 private function checkAgainstExistingDupes( $hash, $ignoreLocalDupes ) {
798 $title = $this->getTitle();
799 foreach ( $dupes
as $key => $dupe ) {
803 $title->equals( $dupe->getTitle() )
805 unset( $dupes[$key] );
818 private function checkAgainstArchiveDupes( $hash ) {
820 if ( $archivedFile->getID() > 0 ) {
822 return $archivedFile->getName();
844 public function performUpload( $comment, $pageText, $watch,
$user, $tags = [] ) {
845 $this->getLocalFile()->load( File::READ_LATEST );
846 $props = $this->mFileProps;
849 Hooks::run(
'UploadVerifyUpload', [ $this,
$user, $props, $comment, $pageText, &$error ] );
851 if ( !is_array( $error ) ) {
857 $status = $this->getLocalFile()->upload(
871 $this->getLocalFile()->getTitle(),
878 Hooks::run(
'UploadComplete', [ &$uploadBase ] );
880 $this->postProcessUpload();
891 public function postProcessUpload() {
900 public function getTitle() {
901 if ( $this->mTitle !==
false ) {
902 return $this->mTitle;
904 if ( !is_string( $this->mDesiredDestName ) ) {
905 $this->mTitleError = self::ILLEGAL_FILENAME;
906 $this->mTitle =
null;
908 return $this->mTitle;
915 $this->mFilteredName =
$title->getDBkey();
917 $this->mFilteredName = $this->mDesiredDestName;
920 # oi_archive_name is max 255 bytes, which include a timestamp and an
921 # exclamation mark, so restrict file name to 240 bytes.
922 if ( strlen( $this->mFilteredName ) > 240 ) {
923 $this->mTitleError = self::FILENAME_TOO_LONG;
924 $this->mTitle =
null;
926 return $this->mTitle;
937 if ( is_null( $nt ) ) {
938 $this->mTitleError = self::ILLEGAL_FILENAME;
939 $this->mTitle =
null;
941 return $this->mTitle;
943 $this->mFilteredName = $nt->getDBkey();
949 list( $partname,
$ext ) = $this->splitExtensions( $this->mFilteredName );
952 $this->mFinalExtension = trim( end(
$ext ) );
954 $this->mFinalExtension =
'';
956 # No extension, try guessing one
958 $mime = $magic->guessMimeType( $this->mTempPath );
959 if ( $mime !==
'unknown/unknown' ) {
960 # Get a space separated list of extensions
961 $extList = $magic->getExtensionsForType( $mime );
963 # Set the extension to the canonical extension
964 $this->mFinalExtension = strtok( $extList,
' ' );
966 # Fix up the other variables
967 $this->mFilteredName .=
".{$this->mFinalExtension}";
969 $ext = [ $this->mFinalExtension ];
980 if ( $this->mFinalExtension ==
'' ) {
981 $this->mTitleError = self::FILETYPE_MISSING;
982 $this->mTitle =
null;
984 return $this->mTitle;
985 } elseif ( $blackListedExtensions ||
989 $this->mBlackListedExtensions = $blackListedExtensions;
990 $this->mTitleError = self::FILETYPE_BADTYPE;
991 $this->mTitle =
null;
993 return $this->mTitle;
997 if ( !preg_match(
'/^[\x0-\x7f]*$/', $nt->getText() )
1000 $this->mTitleError = self::WINDOWS_NONASCII_FILENAME;
1001 $this->mTitle =
null;
1003 return $this->mTitle;
1006 # If there was more than one "extension", reassemble the base
1007 # filename to prevent bogus complaints about length
1010 for ( $i = 0; $i < $iterations; $i++ ) {
1011 $partname .=
'.' .
$ext[$i];
1015 if ( strlen( $partname ) < 1 ) {
1016 $this->mTitleError = self::MIN_LENGTH_PARTNAME;
1017 $this->mTitle =
null;
1019 return $this->mTitle;
1022 $this->mTitle = $nt;
1024 return $this->mTitle;
1032 public function getLocalFile() {
1033 if ( is_null( $this->mLocalFile ) ) {
1034 $nt = $this->getTitle();
1038 return $this->mLocalFile;
1044 public function getStashFile() {
1045 return $this->mStashFile;
1059 public function tryStashFile(
User $user, $isPartial =
false ) {
1060 if ( !$isPartial ) {
1061 $error = $this->runUploadStashFileHook(
$user );
1078 protected function runUploadStashFileHook(
User $user ) {
1079 $props = $this->mFileProps;
1082 if ( $error && !is_array( $error ) ) {
1083 $error = [ $error ];
1107 public function stashFile(
User $user =
null ) {
1108 return $this->doStashFile(
$user );
1117 protected function doStashFile(
User $user =
null ) {
1119 $file = $stash->stashFile( $this->mTempPath, $this->getSourceType() );
1120 $this->mStashFile =
$file;
1132 public function stashFileGetKey() {
1134 return $this->doStashFile()->getFileKey();
1143 public function stashSession() {
1145 return $this->doStashFile()->getFileKey();
1152 public function cleanupTempFile() {
1153 if ( $this->mRemoveTempFile && $this->tempFileObj ) {
1155 wfDebug( __METHOD__ .
": Marked temporary file '{$this->mTempPath}' for removal\n" );
1156 $this->tempFileObj->autocollect();
1160 public function getTempPath() {
1161 return $this->mTempPath;
1173 public static function splitExtensions( $filename ) {
1174 $bits = explode(
'.', $filename );
1175 $basename = array_shift( $bits );
1177 return [ $basename, $bits ];
1188 public static function checkFileExtension(
$ext, $list ) {
1189 return in_array( strtolower(
$ext ), $list );
1200 public static function checkFileExtensionList(
$ext, $list ) {
1201 return array_intersect( array_map(
'strtolower',
$ext ), $list );
1211 public static function verifyExtension( $mime, $extension ) {
1214 if ( !$mime || $mime ==
'unknown' || $mime ==
'unknown/unknown' ) {
1215 if ( !$magic->isRecognizableExtension( $extension ) ) {
1216 wfDebug( __METHOD__ .
": passing file with unknown detected mime type; " .
1217 "unrecognized extension '$extension', can't verify\n" );
1221 wfDebug( __METHOD__ .
": rejecting file with unknown detected mime type; " .
1222 "recognized extension '$extension', so probably invalid file\n" );
1228 $match = $magic->isMatchingExtension( $extension, $mime );
1230 if ( $match ===
null ) {
1231 if ( $magic->getTypesForExtension( $extension ) !==
null ) {
1232 wfDebug( __METHOD__ .
": No extension known for $mime, but we know a mime for $extension\n" );
1236 wfDebug( __METHOD__ .
": no file extension known for mime type $mime, passing file\n" );
1240 } elseif ( $match ===
true ) {
1241 wfDebug( __METHOD__ .
": mime type $mime matches extension $extension, passing file\n" );
1247 .
": mime type $mime mismatches file extension $extension, rejecting file\n" );
1264 public static function detectScript(
$file, $mime, $extension ) {
1267 # ugly hack: for text files, always look at the entire file.
1268 # For binary field, just check the first K.
1270 if ( strpos( $mime,
'text/' ) === 0 ) {
1271 $chunk = file_get_contents(
$file );
1273 $fp = fopen(
$file,
'rb' );
1274 $chunk = fread( $fp, 1024 );
1278 $chunk = strtolower( $chunk );
1284 # decode from UTF-16 if needed (could be used for obfuscation).
1285 if ( substr( $chunk, 0, 2 ) ==
"\xfe\xff" ) {
1287 } elseif ( substr( $chunk, 0, 2 ) ==
"\xff\xfe" ) {
1294 $chunk = iconv( $enc,
"ASCII//IGNORE", $chunk );
1297 $chunk = trim( $chunk );
1300 wfDebug( __METHOD__ .
": checking for embedded scripts and HTML stuff\n" );
1302 # check for HTML doctype
1303 if ( preg_match(
"/<!DOCTYPE *X?HTML/i", $chunk ) ) {
1309 if ( $extension ==
'svg' || strpos( $mime,
'image/svg' ) === 0 ) {
1310 if ( self::checkXMLEncodingMissmatch(
$file ) ) {
1334 '<html', # also
in safari
1337 '<script', # also
in safari
1345 foreach ( $tags
as $tag ) {
1346 if ( strpos( $chunk, $tag ) !==
false ) {
1347 wfDebug( __METHOD__ .
": found something that may make it be mistaken for html: $tag\n" );
1357 # resolve entity-refs to look at attributes. may be harsh on big files... cache result?
1358 $chunk = Sanitizer::decodeCharReferences( $chunk );
1360 # look for script-types
1361 if ( preg_match(
'!type\s*=\s*[\'"]?\s*(?:\w*/)?(?:ecma|java)!sim', $chunk ) ) {
1362 wfDebug( __METHOD__ .
": found script types\n" );
1367 # look for html-style script-urls
1368 if ( preg_match(
'!(?:href|src|data)\s*=\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) ) {
1369 wfDebug( __METHOD__ .
": found html-style script urls\n" );
1374 # look for css-style script-urls
1375 if ( preg_match(
'!url\s*\(\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) ) {
1376 wfDebug( __METHOD__ .
": found css-style script urls\n" );
1381 wfDebug( __METHOD__ .
": no scripts found\n" );
1393 public static function checkXMLEncodingMissmatch(
$file ) {
1396 $encodingRegex =
'!encoding[ \t\n\r]*=[ \t\n\r]*[\'"](.*?)[\'"]!si';
1398 if ( preg_match(
"!<\?xml\b(.*?)\?>!si", $contents,
$matches ) ) {
1399 if ( preg_match( $encodingRegex,
$matches[1], $encMatch )
1400 && !in_array( strtoupper( $encMatch[1] ), self::$safeXmlEncodings )
1402 wfDebug( __METHOD__ .
": Found unsafe XML encoding '{$encMatch[1]}'\n" );
1406 } elseif ( preg_match(
"!<\?xml\b!si", $contents ) ) {
1409 wfDebug( __METHOD__ .
": Unmatched XML declaration start\n" );
1412 } elseif ( substr( $contents, 0, 4 ) ==
"\x4C\x6F\xA7\x94" ) {
1414 wfDebug( __METHOD__ .
": EBCDIC Encoded XML\n" );
1421 $attemptEncodings = [
'UTF-16',
'UTF-16BE',
'UTF-32',
'UTF-32BE' ];
1422 foreach ( $attemptEncodings
as $encoding ) {
1423 Wikimedia\suppressWarnings();
1424 $str = iconv( $encoding,
'UTF-8', $contents );
1425 Wikimedia\restoreWarnings();
1426 if ( $str !=
'' && preg_match(
"!<\?xml\b(.*?)\?>!si", $str,
$matches ) ) {
1427 if ( preg_match( $encodingRegex,
$matches[1], $encMatch )
1428 && !in_array( strtoupper( $encMatch[1] ), self::$safeXmlEncodings )
1430 wfDebug( __METHOD__ .
": Found unsafe XML encoding '{$encMatch[1]}'\n" );
1434 } elseif ( $str !=
'' && preg_match(
"!<\?xml\b!si", $str ) ) {
1437 wfDebug( __METHOD__ .
": Unmatched XML declaration start\n" );
1451 protected function detectScriptInSvg( $filename, $partial ) {
1452 $this->mSVGNSError =
false;
1455 [ $this,
'checkSvgScriptCallback' ],
1458 'processing_instruction_handler' =>
'UploadBase::checkSvgPICallback',
1459 'external_dtd_handler' =>
'UploadBase::checkSvgExternalDTD',
1462 if ( $check->wellFormed !==
true ) {
1465 return $partial ?
false : [
'uploadinvalidxml' ];
1466 } elseif ( $check->filterMatch ) {
1467 if ( $this->mSVGNSError ) {
1468 return [
'uploadscriptednamespace', $this->mSVGNSError ];
1471 return $check->filterMatchType;
1483 public static function checkSvgPICallback( $target,
$data ) {
1485 if ( preg_match(
'/xml-stylesheet/i', $target ) ) {
1486 return [
'upload-scripted-pi-callback' ];
1503 public static function checkSvgExternalDTD(
$type, $publicId, $systemId ) {
1507 'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd',
1508 'http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd',
1509 'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-basic.dtd',
1510 'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd',
1512 'http://www.w3.org/TR/2001/PR-SVG-20010719/DTD/svg10.dtd',
1514 if (
$type !==
'PUBLIC'
1515 || !in_array( $systemId, $allowedDTDs )
1516 || strpos( $publicId,
"-//W3C//" ) !== 0
1518 return [
'upload-scripted-dtd' ];
1530 public function checkSvgScriptCallback( $element,
$attribs,
$data =
null ) {
1531 list( $namespace, $strippedElement ) = $this->splitXmlNamespace( $element );
1535 static $validNamespaces = [
1538 'http://creativecommons.org/ns#',
1539 'http://inkscape.sourceforge.net/dtd/sodipodi-0.dtd',
1540 'http://ns.adobe.com/adobeillustrator/10.0/',
1541 'http://ns.adobe.com/adobesvgviewerextensions/3.0/',
1542 'http://ns.adobe.com/extensibility/1.0/',
1543 'http://ns.adobe.com/flows/1.0/',
1544 'http://ns.adobe.com/illustrator/1.0/',
1545 'http://ns.adobe.com/imagereplacement/1.0/',
1546 'http://ns.adobe.com/pdf/1.3/',
1547 'http://ns.adobe.com/photoshop/1.0/',
1548 'http://ns.adobe.com/saveforweb/1.0/',
1549 'http://ns.adobe.com/variables/1.0/',
1550 'http://ns.adobe.com/xap/1.0/',
1551 'http://ns.adobe.com/xap/1.0/g/',
1552 'http://ns.adobe.com/xap/1.0/g/img/',
1553 'http://ns.adobe.com/xap/1.0/mm/',
1554 'http://ns.adobe.com/xap/1.0/rights/',
1555 'http://ns.adobe.com/xap/1.0/stype/dimensions#',
1556 'http://ns.adobe.com/xap/1.0/stype/font#',
1557 'http://ns.adobe.com/xap/1.0/stype/manifestitem#',
1558 'http://ns.adobe.com/xap/1.0/stype/resourceevent#',
1559 'http://ns.adobe.com/xap/1.0/stype/resourceref#',
1560 'http://ns.adobe.com/xap/1.0/t/pg/',
1561 'http://purl.org/dc/elements/1.1/',
1562 'http://purl.org/dc/elements/1.1',
1563 'http://schemas.microsoft.com/visio/2003/svgextensions/',
1564 'http://sodipodi.sourceforge.net/dtd/sodipodi-0.dtd',
1565 'http://taptrix.com/inkpad/svg_extensions',
1566 'http://web.resource.org/cc/',
1567 'http://www.freesoftware.fsf.org/bkchem/cdml',
1568 'http://www.inkscape.org/namespaces/inkscape',
1569 'http://www.opengis.net/gml',
1570 'http://www.w3.org/1999/02/22-rdf-syntax-ns#',
1571 'http://www.w3.org/2000/svg',
1572 'http://www.w3.org/tr/rec-rdf-syntax/',
1573 'http://www.w3.org/2000/01/rdf-schema#',
1578 $isBuggyInkscape = preg_match(
'/^&(#38;)*ns_[a-z_]+;$/', $namespace );
1580 if ( !( $isBuggyInkscape || in_array( $namespace, $validNamespaces ) ) ) {
1581 wfDebug( __METHOD__ .
": Non-svg namespace '$namespace' in uploaded file.\n" );
1583 $this->mSVGNSError = $namespace;
1591 if ( $strippedElement ==
'script' ) {
1592 wfDebug( __METHOD__ .
": Found script element '$element' in uploaded file.\n" );
1594 return [
'uploaded-script-svg', $strippedElement ];
1597 # e.g., <svg xmlns="http://www.w3.org/2000/svg">
1598 # <handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert(1)</handler> </svg>
1599 if ( $strippedElement ==
'handler' ) {
1600 wfDebug( __METHOD__ .
": Found scriptable element '$element' in uploaded file.\n" );
1602 return [
'uploaded-script-svg', $strippedElement ];
1605 # SVG reported in Feb '12 that used xml:stylesheet to generate javascript block
1606 if ( $strippedElement ==
'stylesheet' ) {
1607 wfDebug( __METHOD__ .
": Found scriptable element '$element' in uploaded file.\n" );
1609 return [
'uploaded-script-svg', $strippedElement ];
1612 # Block iframes, in case they pass the namespace check
1613 if ( $strippedElement ==
'iframe' ) {
1614 wfDebug( __METHOD__ .
": iframe in uploaded file.\n" );
1616 return [
'uploaded-script-svg', $strippedElement ];
1620 if ( $strippedElement ==
'style'
1621 && self::checkCssFragment( Sanitizer::normalizeCss(
$data ) )
1623 wfDebug( __METHOD__ .
": hostile css in style element.\n" );
1624 return [
'uploaded-hostile-svg' ];
1628 $stripped = $this->stripXmlNamespace( $attrib );
1631 if ( substr( $stripped, 0, 2 ) ==
'on' ) {
1633 .
": Found event-handler attribute '$attrib'='$value' in uploaded file.\n" );
1635 return [
'uploaded-event-handler-on-svg', $attrib,
$value ];
1638 # Do not allow relative links, or unsafe url schemas.
1639 # For <a> tags, only data:, http: and https: and same-document
1640 # fragment links are allowed. For all other tags, only data:
1641 # and fragment are allowed.
1642 if ( $stripped ==
'href'
1644 && strpos(
$value,
'data:' ) !== 0
1645 && strpos(
$value,
'#' ) !== 0
1647 if ( !( $strippedElement ===
'a'
1648 && preg_match(
'!^https?://!i',
$value ) )
1650 wfDebug( __METHOD__ .
": Found href attribute <$strippedElement "
1651 .
"'$attrib'='$value' in uploaded file.\n" );
1653 return [
'uploaded-href-attribute-svg', $strippedElement, $attrib,
$value ];
1657 # only allow data: targets that should be safe. This prevents vectors like,
1658 # image/svg, text/xml, application/xml, and text/html, which can contain scripts
1659 if ( $stripped ==
'href' && strncasecmp(
'data:',
$value, 5 ) === 0 ) {
1662 $parameters =
'(?>;[a-zA-Z0-9\!#$&\'*+.^_`{|}~-]+=(?>[a-zA-Z0-9\!#$&\'*+.^_`{|}~-]+|"(?>[\0-\x0c\x0e-\x21\x23-\x5b\x5d-\x7f]+|\\\\[\0-\x7f])*"))*(?:;base64)?';
1664 if ( !preg_match(
"!^data:\s*image/(gif|jpeg|jpg|png)$parameters,!i",
$value ) ) {
1665 wfDebug( __METHOD__ .
": Found href to unwhitelisted data: uri "
1666 .
"\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );
1667 return [
'uploaded-href-unsafe-target-svg', $strippedElement, $attrib,
$value ];
1671 # Change href with animate from (http://html5sec.org/#137).
1672 if ( $stripped ===
'attributename'
1673 && $strippedElement ===
'animate'
1674 && $this->stripXmlNamespace(
$value ) ==
'href'
1676 wfDebug( __METHOD__ .
": Found animate that might be changing href using from "
1677 .
"\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );
1679 return [
'uploaded-animate-svg', $strippedElement, $attrib,
$value ];
1682 # use set/animate to add event-handler attribute to parent
1683 if ( ( $strippedElement ==
'set' || $strippedElement ==
'animate' )
1684 && $stripped ==
'attributename'
1685 && substr(
$value, 0, 2 ) ==
'on'
1687 wfDebug( __METHOD__ .
": Found svg setting event-handler attribute with "
1688 .
"\"<$strippedElement $stripped='$value'...\" in uploaded file.\n" );
1690 return [
'uploaded-setting-event-handler-svg', $strippedElement, $stripped,
$value ];
1693 # use set to add href attribute to parent element
1694 if ( $strippedElement ==
'set'
1695 && $stripped ==
'attributename'
1696 && strpos(
$value,
'href' ) !==
false
1698 wfDebug( __METHOD__ .
": Found svg setting href attribute '$value' in uploaded file.\n" );
1700 return [
'uploaded-setting-href-svg' ];
1703 # use set to add a remote / data / script target to an element
1704 if ( $strippedElement ==
'set'
1705 && $stripped ==
'to'
1706 && preg_match(
'!(http|https|data|script):!sim',
$value )
1708 wfDebug( __METHOD__ .
": Found svg setting attribute to '$value' in uploaded file.\n" );
1710 return [
'uploaded-wrong-setting-svg',
$value ];
1713 # use handler attribute with remote / data / script
1714 if ( $stripped ==
'handler' && preg_match(
'!(http|https|data|script):!sim',
$value ) ) {
1715 wfDebug( __METHOD__ .
": Found svg setting handler with remote/data/script "
1716 .
"'$attrib'='$value' in uploaded file.\n" );
1718 return [
'uploaded-setting-handler-svg', $attrib,
$value ];
1721 # use CSS styles to bring in remote code
1722 if ( $stripped ==
'style'
1723 && self::checkCssFragment( Sanitizer::normalizeCss(
$value ) )
1725 wfDebug( __METHOD__ .
": Found svg setting a style with "
1726 .
"remote url '$attrib'='$value' in uploaded file.\n" );
1727 return [
'uploaded-remote-url-svg', $attrib,
$value ];
1730 # Several attributes can include css, css character escaping isn't allowed
1731 $cssAttrs = [
'font',
'clip-path',
'fill',
'filter',
'marker',
1732 'marker-end',
'marker-mid',
'marker-start',
'mask',
'stroke' ];
1733 if ( in_array( $stripped, $cssAttrs )
1734 && self::checkCssFragment(
$value )
1736 wfDebug( __METHOD__ .
": Found svg setting a style with "
1737 .
"remote url '$attrib'='$value' in uploaded file.\n" );
1738 return [
'uploaded-remote-url-svg', $attrib,
$value ];
1741 # image filters can pull in url, which could be svg that executes scripts
1742 # Only allow url( "#foo" ). Do not allow url( http://example.com )
1743 if ( $strippedElement ==
'image'
1744 && $stripped ==
'filter'
1745 && preg_match(
'!url\s*\(\s*["\']?[^#]!sim',
$value )
1747 wfDebug( __METHOD__ .
": Found image filter with url: "
1748 .
"\"<$strippedElement $stripped='$value'...\" in uploaded file.\n" );
1750 return [
'uploaded-image-filter-svg', $strippedElement, $stripped,
$value ];
1764 private static function checkCssFragment(
$value ) {
1765 # Forbid external stylesheets, for both reliability and to protect viewer's privacy
1766 if ( stripos(
$value,
'@import' ) !==
false ) {
1770 # We allow @font-face to embed fonts with data: urls, so we snip the string
1771 # 'url' out so this case won't match when we check for urls below
1772 $pattern =
'!(@font-face\s*{[^}]*src:)url(\("data:;base64,)!im';
1775 # Check for remote and executable CSS. Unlike in Sanitizer::checkCss, the CSS
1776 # properties filter and accelerator don't seem to be useful for xss in SVG files.
1777 # Expression and -o-link don't seem to work either, but filtering them here in case.
1778 # Additionally, we catch remote urls like url("http:..., url('http:..., url(http:...,
1779 # but not local ones such as url("#..., url('#..., url(#....
1780 if ( preg_match(
'!expression
1782 | -o-link-source\s*:
1783 | -o-replace\s*:!imx',
$value ) ) {
1787 if ( preg_match_all(
1788 "!(\s*(url|image|image-set)\s*\(\s*[\"']?\s*[^#]+.*?\))!sim",
1793 # TODO: redo this in one regex. Until then, url("#whatever") matches the first
1795 if ( !preg_match(
"!\s*(url|image|image-set)\s*\(\s*(#|'#|\"#)!im", $match ) ) {
1801 if ( preg_match(
'/[\000-\010\013\016-\037\177]/',
$value ) ) {
1813 private static function splitXmlNamespace( $element ) {
1815 $parts = explode(
':', strtolower( $element ) );
1816 $name = array_pop( $parts );
1817 $ns = implode(
':', $parts );
1819 return [ $ns,
$name ];
1826 private function stripXmlNamespace(
$name ) {
1828 $parts = explode(
':', strtolower(
$name ) );
1830 return array_pop( $parts );
1843 public static function detectVirus(
$file ) {
1847 wfDebug( __METHOD__ .
": virus scanner disabled\n" );
1853 wfDebug( __METHOD__ .
": unknown virus scanner: $wgAntivirus\n" );
1854 $wgOut->wrapWikiMsg(
"<div class=\"error\">\n$1\n</div>",
1857 return wfMessage(
'virus-unknownscanner' )->text() .
" $wgAntivirus";
1860 # look up scanner configuration
1865 if ( strpos(
$command,
"%f" ) ===
false ) {
1866 # simple pattern: append file to scan
1869 # complex pattern: replace "%f" with file to scan
1873 wfDebug( __METHOD__ .
": running virus scan: $command \n" );
1875 # execute virus scanner
1878 # NOTE: there's a 50 line workaround to make stderr redirection work on windows, too.
1879 # that does not seem to be worth the pain.
1880 # Ask me (Duesentrieb) about it if it's ever needed.
1883 # map exit code to AV_xxx constants.
1884 $mappedCode = $exitCode;
1885 if ( $exitCodeMap ) {
1886 if ( isset( $exitCodeMap[$exitCode] ) ) {
1887 $mappedCode = $exitCodeMap[$exitCode];
1888 } elseif ( isset( $exitCodeMap[
"*"] ) ) {
1889 $mappedCode = $exitCodeMap[
"*"];
1897 # scan failed (code was mapped to false by $exitCodeMap)
1898 wfDebug( __METHOD__ .
": failed to scan $file (code $exitCode).\n" );
1901 ?
wfMessage(
'virus-scanfailed', [ $exitCode ] )->text()
1904 # scan failed because filetype is unknown (probably imune)
1905 wfDebug( __METHOD__ .
": unsupported file type $file (code $exitCode).\n" );
1909 wfDebug( __METHOD__ .
": file passed virus scan.\n" );
1916 } elseif ( $msgPattern ) {
1918 if ( preg_match( $msgPattern, $output, $groups ) && $groups[1] ) {
1919 $output = $groups[1];
1923 wfDebug( __METHOD__ . ": FOUND VIRUS! scanner feedback: $output \n" );
1937 private function checkOverwrite( $user ) {
1938 // First check whether the local file can be overwritten
1939 $file = $this->getLocalFile();
1940 $file->load( File::READ_LATEST );
1941 if ( $file->exists() ) {
1942 if ( !self::userCanReUpload( $user, $file ) ) {
1943 return [ 'fileexists-forbidden
', $file->getName() ];
1949 /* Check shared conflicts: if the local file does not exist, but
1950 * wfFindFile finds a file, it exists in a shared repository.
1952 $file = wfFindFile( $this->getTitle(), [ 'latest
' => true ] );
1953 if ( $file && !$user->isAllowed( 'reupload-shared
' ) ) {
1954 return [ 'fileexists-shared-forbidden
', $file->getName() ];
1967 public static function userCanReUpload( User $user, File $img ) {
1968 if ( $user->isAllowed( 'reupload
' ) ) {
1969 return true; // non-conditional
1970 } elseif ( !$user->isAllowed( 'reupload-
own' ) ) {
1974 if ( !( $img instanceof LocalFile ) ) {
1980 return $user->getId() == $img->getUser( 'id' );
1994 public static function getExistsWarning( $file ) {
1995 if ( $file->exists() ) {
1996 return [ 'warning
' => 'exists
', 'file' => $file ];
1999 if ( $file->getTitle()->getArticleID() ) {
2000 return [ 'warning
' => 'page-exists
', 'file' => $file ];
2003 if ( strpos( $file->getName(), '.
' ) == false ) {
2004 $partname = $file->getName();
2007 $n = strrpos( $file->getName(), '.
' );
2008 $extension = substr( $file->getName(), $n + 1 );
2009 $partname = substr( $file->getName(), 0, $n );
2011 $normalizedExtension = File::normalizeExtension( $extension );
2013 if ( $normalizedExtension != $extension ) {
2014 // We're
not using the normalized
form of the extension.
2022 if ( $file_lc->exists() ) {
2024 'warning' =>
'exists-normalized',
2026 'normalizedFile' => $file_lc
2033 "{$partname}.", 1 );
2034 if (
count( $similarFiles ) ) {
2036 'warning' =>
'exists-normalized',
2038 'normalizedFile' => $similarFiles[0],
2042 if ( self::isThumbName(
$file->getName() ) ) {
2043 # Check for filenames like 50px- or 180px-, these are mostly thumbnails
2045 substr( $partname, strpos( $partname,
'-' ) + 1 ) .
'.' . $extension,
2049 if ( $file_thb->exists() ) {
2051 'warning' =>
'thumb',
2053 'thumbFile' => $file_thb
2058 'warning' =>
'thumb-name',
2060 'thumbFile' => $file_thb
2065 foreach ( self::getFilenamePrefixBlacklist()
as $prefix ) {
2066 if ( substr( $partname, 0, strlen( $prefix ) ) == $prefix ) {
2068 'warning' =>
'bad-prefix',
2083 public static function isThumbName( $filename ) {
2084 $n = strrpos( $filename,
'.' );
2085 $partname = $n ? substr( $filename, 0, $n ) : $filename;
2088 substr( $partname, 3, 3 ) ==
'px-' ||
2089 substr( $partname, 2, 3 ) ==
'px-'
2091 preg_match(
"/[0-9]{2}/", substr( $partname, 0, 2 ) );
2099 public static function getFilenamePrefixBlacklist() {
2101 $message =
wfMessage(
'filename-prefix-blacklist' )->inContentLanguage();
2102 if ( !$message->isDisabled() ) {
2103 $lines = explode(
"\n", $message->plain() );
2106 $comment = substr( trim(
$line ), 0, 1 );
2107 if ( $comment ==
'#' || $comment ==
'' ) {
2111 $comment = strpos(
$line,
'#' );
2112 if ( $comment > 0 ) {
2115 $blacklist[] = trim(
$line );
2133 public function getImageInfo(
$result ) {
2134 $localFile = $this->getLocalFile();
2135 $stashFile = $this->getStashFile();
2153 public function convertVerifyErrorToStatus( $error ) {
2154 $code = $error[
'status'];
2155 unset(
$code[
'status'] );
2167 public static function getMaxUploadSize( $forType =
null ) {
2188 public static function getMaxPhpUploadSize() {
2190 ini_get(
'upload_max_filesize' ) ?: ini_get(
'hhvm.server.upload.upload_max_file_size' ),
2194 ini_get(
'post_max_size' ) ?: ini_get(
'hhvm.server.max_post_size' ),
2197 return min( $phpMaxFileSize, $phpMaxPostSize );
2209 public static function getSessionStatus(
User $user, $statusKey ) {
2210 $cache = MediaWikiServices::getInstance()->getMainObjectStash();
2211 $key =
$cache->makeKey(
'uploadstatus',
$user->getId() ?: md5(
$user->getName() ), $statusKey );
2213 return $cache->get( $key );
2226 public static function setSessionStatus(
User $user, $statusKey,
$value ) {
2227 $cache = MediaWikiServices::getInstance()->getMainObjectStash();
2228 $key =
$cache->makeKey(
'uploadstatus',
$user->getId() ?: md5(
$user->getName() ), $statusKey );
2230 if (
$value ===
false ) {