WebRequest.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Request;
 
use HashBagOStuff;
use MediaWiki\Context\RequestContext;
use MediaWiki\Exception\FatalError;
use MediaWiki\Exception\MWException;
use MediaWiki\Hook\GetSecurityLogContextHook;
use MediaWiki\HookContainer\HookRunner;
use MediaWiki\Http\Telemetry;
use MediaWiki\MainConfigNames;
use MediaWiki\MediaWikiServices;
use MediaWiki\Session\PHPSessionHandler;
use MediaWiki\Session\Session;
use MediaWiki\Session\SessionId;
use MediaWiki\User\UserIdentity;
use Wikimedia\IPUtils;
 
// The point of this class is to be a wrapper around super globals
// phpcs:disable MediaWiki.Usage.SuperGlobalsUsage.SuperGlobals
 
class WebRequest {
    protected $data;
 
    protected $queryAndPathParams;
 
    protected $queryParams;
 
    protected $headers = [];
 
    public const GETHEADER_LIST = 1;
 
    protected ?WebResponse $response = null;
 
    private $ip;
 
    protected $requestTime;
 
    protected $protocol;
 
    protected ?SessionId $sessionId = null;
    protected ?Session $session = null;
 
    protected $markedAsSafe = false;
 
    private ?HashBagOStuff $securityLogContext;
 
    public function __construct() {
        $this->requestTime = $_SERVER['REQUEST_TIME_FLOAT'];
 
        // POST overrides GET data
        // We don't use $_REQUEST here to avoid interference from cookies...
        $this->data = $_POST + $_GET;
 
        $this->queryAndPathParams = $this->queryParams = $_GET;
    }
 
    protected function getServerInfo( string $name, ?string $default = null ): ?string {
        return isset( $_SERVER[$name] ) ? (string)$_SERVER[$name] : $default;
    }
 
    protected function getPathInfo( $want = 'all' ) {
        // PATH_INFO is mangled due to https://bugs.php.net/bug.php?id=31892
        // And also by Apache 2.x, double slashes are converted to single slashes.
        // So we will use REQUEST_URI if possible.
        $url = $this->getServerInfo( 'REQUEST_URI' );
        if ( $url !== null ) {
            // Slurp out the path portion to examine...
            if ( !preg_match( '!^https?://!', $url ) ) {
                $url = 'http://unused' . $url;
            }
            $a = parse_url( $url );
            if ( !$a ) {
                return [];
            }
            $path = $a['path'] ?? '';
 
            global $wgScript;
            if ( $path == $wgScript && $want !== 'all' ) {
                // Script inside a rewrite path?
                // Abort to keep from breaking...
                return [];
            }
 
            $router = new PathRouter;
 
            // Raw PATH_INFO style
            $router->add( "$wgScript/$1" );
 
            global $wgArticlePath;
            if ( $wgArticlePath ) {
                $router->validateRoute( $wgArticlePath, 'wgArticlePath' );
                $router->add( $wgArticlePath );
            }
 
            global $wgActionPaths;
            $articlePaths = PathRouter::getActionPaths( $wgActionPaths, $wgArticlePath );
            if ( $articlePaths ) {
                $router->add( $articlePaths, [ 'action' => '$key' ] );
            }
 
            $services = MediaWikiServices::getInstance();
            global $wgVariantArticlePath;
            if ( $wgVariantArticlePath ) {
                $router->validateRoute( $wgVariantArticlePath, 'wgVariantArticlePath' );
                $router->add( $wgVariantArticlePath,
                    [ 'variant' => '$2' ],
                    [ '$2' => $services->getLanguageConverterFactory()
                        ->getLanguageConverter( $services->getContentLanguage() )
                        ->getVariants() ]
                );
            }
 
            ( new HookRunner( $services->getHookContainer() ) )->onWebRequestPathInfoRouter( $router );
 
            $matches = $router->parse( $path );
        } else {
            global $wgUsePathInfo;
            $matches = [];
            if ( $wgUsePathInfo ) {
                $origPathInfo = $this->getServerInfo( 'ORIG_PATH_INFO' ) ?? '';
                $pathInfo = $this->getServerInfo( 'PATH_INFO' ) ?? '';
                if ( $origPathInfo !== '' ) {
                    // Mangled PATH_INFO
                    // https://bugs.php.net/bug.php?id=31892
                    // Also reported when ini_get('cgi.fix_pathinfo')==false
                    $matches['title'] = substr( $origPathInfo, 1 );
                } elseif ( $pathInfo !== '' ) {
                    // Regular old PATH_INFO yay
                    $matches['title'] = substr( $pathInfo, 1 );
                }
            }
        }
 
        return $matches;
    }
 
    public static function getRequestPathSuffix( string $basePath, ?string $requestUrl = null ) {
        $basePath = rtrim( $basePath, '/' ) . '/';
        $requestUrl ??= self::getGlobalRequestURL();
        $qpos = strpos( $requestUrl, '?' );
        if ( $qpos !== false ) {
            $requestPath = substr( $requestUrl, 0, $qpos );
        } else {
            $requestPath = $requestUrl;
        }
        if ( !str_starts_with( $requestPath, $basePath ) ) {
            return false;
        }
        return rawurldecode( substr( $requestPath, strlen( $basePath ) ) );
    }
 
    public static function detectServer( $assumeProxiesUseDefaultProtocolPorts = null ) {
        $assumeProxiesUseDefaultProtocolPorts ??= $GLOBALS['wgAssumeProxiesUseDefaultProtocolPorts'];
 
        $proto = self::detectProtocol();
        $stdPort = $proto === 'https' ? 443 : 80;
 
        $varNames = [ 'HTTP_HOST', 'SERVER_NAME', 'HOSTNAME', 'SERVER_ADDR' ];
        $host = 'localhost';
        $port = $stdPort;
        foreach ( $varNames as $varName ) {
            if ( !isset( $_SERVER[$varName] ) ) {
                continue;
            }
 
            $parts = IPUtils::splitHostAndPort( $_SERVER[$varName] );
            if ( !$parts ) {
                // Invalid, do not use
                continue;
            }
 
            $host = $parts[0];
            if ( $assumeProxiesUseDefaultProtocolPorts && isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) ) {
                // T72021: Assume that upstream proxy is running on the default
                // port based on the protocol. We have no reliable way to determine
                // the actual port in use upstream.
                $port = $stdPort;
            } elseif ( $parts[1] === false ) {
                if ( isset( $_SERVER['SERVER_PORT'] ) ) {
                    $port = intval( $_SERVER['SERVER_PORT'] );
                } // else leave it as $stdPort
            } else {
                $port = $parts[1];
            }
            break;
        }
 
        return $proto . '://' . IPUtils::combineHostAndPort( $host, $port, $stdPort );
    }
 
    public static function detectProtocol() {
        if ( ( !empty( $_SERVER['HTTPS'] ) && $_SERVER['HTTPS'] !== 'off' ) ||
            ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) &&
            $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) ) {
            return 'https';
        } else {
            return 'http';
        }
    }
 
    public function getElapsedTime() {
        return microtime( true ) - $this->requestTime;
    }
 
    public static function getRequestId() {
        return Telemetry::getInstance()->getRequestId();
    }
 
    public static function overrideRequestId( $newId ) {
        $telemetry = Telemetry::getInstance();
        if ( $newId === null ) {
            $telemetry->regenerateRequestId();
        } else {
            $telemetry->overrideRequestId( $newId );
        }
    }
 
    public function getProtocol() {
        $this->protocol ??= self::detectProtocol();
        return $this->protocol;
    }
 
    public function interpolateTitle() {
        $matches = $this->getPathInfo( 'title' );
        foreach ( $matches as $key => $val ) {
            $this->data[$key] = $this->queryAndPathParams[$key] = $val;
        }
    }
 
    public static function extractTitle( $path, $bases, $key = false ) {
        foreach ( (array)$bases as $keyValue => $base ) {
            // Find the part after $wgArticlePath
            $base = str_replace( '$1', '', $base );
            if ( str_starts_with( $path, $base ) ) {
                $raw = substr( $path, strlen( $base ) );
                if ( $raw !== '' ) {
                    $matches = [ 'title' => rawurldecode( $raw ) ];
                    if ( $key ) {
                        $matches[$key] = $keyValue;
                    }
                    return $matches;
                }
            }
        }
        return [];
    }
 
    public function normalizeUnicode( $data ) {
        if ( is_array( $data ) ) {
            foreach ( $data as $key => $val ) {
                $data[$key] = $this->normalizeUnicode( $val );
            }
        } else {
            $contLang = MediaWikiServices::getInstance()->getContentLanguage();
            $data = $contLang->normalize( $data );
        }
        return $data;
    }
 
    private function getGPCVal( $arr, $name, $default ) {
        # PHP is so nice to not touch input data, except sometimes:
        # https://www.php.net/variables.external#language.variables.external.dot-in-names
        # Work around PHP *feature* to avoid *bugs* elsewhere.
        $name = strtr( $name, '.', '_' );
 
        if ( !isset( $arr[$name] ) ) {
            return $default;
        }
 
        $data = $arr[$name];
        # Optimisation: Skip UTF-8 normalization and legacy transcoding for simple ASCII strings.
        $isAsciiStr = ( is_string( $data ) && preg_match( '/[^\x20-\x7E]/', $data ) === 0 );
        if ( !$isAsciiStr ) {
            if ( isset( $_GET[$name] ) && is_string( $data ) ) {
                # Check for alternate/legacy character encoding.
                $data = MediaWikiServices::getInstance()
                    ->getContentLanguage()
                    ->checkTitleEncoding( $data );
            }
            $data = $this->normalizeUnicode( $data );
        }
 
        return $data;
    }
 
    public function getRawVal( $name ): ?string {
        $name = strtr( $name, '.', '_' ); // See comment in self::getGPCVal()
        if ( !isset( $this->data[$name] ) || is_array( $this->data[$name] ) ) {
            return null;
        }
        return (string)$this->data[$name];
    }
 
    public function getVal( $name, $default = null ) {
        $val = $this->getGPCVal( $this->data, $name, $default );
        if ( is_array( $val ) ) {
            $val = $default;
        }
 
        return $val === null ? null : (string)$val;
    }
 
    public function getText( $name, $default = '' ) {
        $val = $this->getVal( $name, $default );
        return str_replace( "\r\n", "\n", $val );
    }
 
    public function setVal( $key, $value ) {
        $ret = $this->data[$key] ?? null;
        $this->data[$key] = $value;
        return $ret;
    }
 
    public function unsetVal( $key ) {
        if ( !isset( $this->data[$key] ) ) {
            $ret = null;
        } else {
            $ret = $this->data[$key];
            unset( $this->data[$key] );
        }
        return $ret;
    }
 
    public function getArray( $name, $default = null ) {
        $val = $this->getGPCVal( $this->data, $name, $default );
        if ( $val === null ) {
            return null;
        } else {
            return (array)$val;
        }
    }
 
    public function getIntArray( $name, $default = null ) {
        $val = $this->getArray( $name, $default );
        if ( is_array( $val ) ) {
            // Drop multi-dimensional array elements
            $val = array_map( intval( ... ), array_filter( $val, is_string( ... ) ) );
        }
        return $val;
    }
 
    public function getInt( $name, $default = 0 ): int {
        return intval( $this->getRawVal( $name ) ?? $default );
    }
 
    public function getIntOrNull( $name ): ?int {
        $val = $this->getRawVal( $name );
        return is_numeric( $val ) ? intval( $val ) : null;
    }
 
    public function getFloat( $name, $default = 0.0 ): float {
        return floatval( $this->getRawVal( $name ) ?? $default );
    }
 
    public function getBool( $name, $default = false ): bool {
        return (bool)( $this->getRawVal( $name ) ?? $default );
    }
 
    public function getFuzzyBool( $name, $default = false ): bool {
        $value = $this->getRawVal( $name );
        if ( $value === null ) {
            return (bool)$default;
        }
 
        return $value && strcasecmp( $value, 'false' ) !== 0;
    }
 
    public function getCheck( $name ): bool {
        # Checkboxes and buttons are only present when clicked
        # Presence connotes truth, absence false
        return $this->getRawVal( $name ) !== null;
    }
 
    public function getValues( ...$names ) {
        if ( $names === [] ) {
            $names = array_keys( $this->data );
        }
 
        $retVal = [];
        foreach ( $names as $name ) {
            $value = $this->getGPCVal( $this->data, $name, null );
            if ( $value !== null ) {
                $retVal[$name] = $value;
            }
        }
        return $retVal;
    }
 
    public function getValueNames( $exclude = [] ) {
        return array_diff( array_keys( $this->getValues() ), $exclude );
    }
 
    public function getQueryValues() {
        return $this->queryAndPathParams;
    }
 
    public function getQueryValuesOnly() {
        return $this->queryParams;
    }
 
    public function getPostValues() {
        return $_POST;
    }
 
    public function getRawQueryString() {
        return $this->getServerInfo( 'QUERY_STRING' ) ?? '';
    }
 
    public function getRawPostString() {
        if ( !$this->wasPosted() ) {
            return '';
        }
        return $this->getRawInput();
    }
 
    public function getRawInput() {
        static $input = null;
        $input ??= file_get_contents( 'php://input' );
        return $input;
    }
 
    public function getMethod() {
        return $this->getServerInfo( 'REQUEST_METHOD' ) ?: 'GET';
    }
 
    public function wasPosted() {
        return $this->getMethod() == 'POST';
    }
 
    public function getSession(): Session {
        $sessionId = $this->getSessionId();
        $sessionManager = MediaWikiServices::getInstance()->getSessionManager();
 
        // Destroy the old session if someone has set a new session ID
        if ( $this->session && $sessionId && $this->session->getId() !== $sessionId->getId() ) {
            $this->session = null;
        }
 
        // Look up session by ID if provided
        if ( !$this->session && $sessionId ) {
            $this->session = $sessionManager->getSessionById( $sessionId->getId(), true, $this );
        }
 
        // If it was not provided, or a session with that ID doesn't exist, create a new one
        if ( !$this->session ) {
            $this->session = $sessionManager->getSessionForRequest( $this );
            $this->sessionId = $this->session->getSessionId();
        }
        return $this->session;
    }
 
    public function setSessionId( SessionId $sessionId ) {
        $this->sessionId = $sessionId;
    }
 
    public function getSessionId() {
        // If this is the main request, and we're using built-in PHP session handling,
        // and the session ID wasn't overridden, return the PHP session's ID.
        if ( PHPSessionHandler::isEnabled() && $this === RequestContext::getMain()->getRequest() ) {
            $id = session_id();
            if ( $id !== '' ) {
                // Someone used session_id(), so we need to follow suit.
                // We can't even cache this in $this->sessionId.
                return new SessionId( $id );
            }
        }
 
        return $this->sessionId;
    }
 
    public function getCookie( $key, $prefix = null, $default = null ) {
        if ( $prefix === null ) {
            global $wgCookiePrefix;
            $prefix = $wgCookiePrefix;
        }
        $name = $prefix . $key;
        // Work around mangling of $_COOKIE
        $name = strtr( $name, '.', '_' );
        if ( isset( $_COOKIE[$name] ) ) {
            // For duplicate cookies in the format of name[]=value;name[]=value2,
            // PHP will assign an array value for the 'name' cookie in $_COOKIE.
            // Neither RFC 6265 nor its preceding RFCs define such behavior,
            // and MediaWiki does not rely on it either, so treat the cookie as absent if so (T363980).
            if ( is_array( $_COOKIE[$name] ) ) {
                return $default;
            }
            return $_COOKIE[$name];
        } else {
            return $default;
        }
    }
 
    public function getCrossSiteCookie( $key, $prefix = '', $default = null ) {
        wfDeprecated( __METHOD__, '1.42' );
        return $this->getCookie( $key, $prefix, $default );
    }
 
    public static function getGlobalRequestURL() {
        // This method is called on fatal errors; it should not depend on anything complex.
 
        if ( isset( $_SERVER['REQUEST_URI'] ) && strlen( $_SERVER['REQUEST_URI'] ) ) {
            $base = $_SERVER['REQUEST_URI'];
        } elseif ( isset( $_SERVER['HTTP_X_ORIGINAL_URL'] )
            && strlen( $_SERVER['HTTP_X_ORIGINAL_URL'] )
        ) {
            // Probably IIS; doesn't set REQUEST_URI
            $base = $_SERVER['HTTP_X_ORIGINAL_URL'];
        } elseif ( isset( $_SERVER['SCRIPT_NAME'] ) ) {
            $base = $_SERVER['SCRIPT_NAME'];
            if ( isset( $_SERVER['QUERY_STRING'] ) && $_SERVER['QUERY_STRING'] != '' ) {
                $base .= '?' . $_SERVER['QUERY_STRING'];
            }
        } else {
            // This shouldn't happen!
            throw new MWException(
                "Web server doesn't provide either " .
                "REQUEST_URI, HTTP_X_ORIGINAL_URL or SCRIPT_NAME. Report details " .
                "of your web server configuration to https://phabricator.wikimedia.org/"
            );
        }
        // User-agents should not send a fragment with the URI, but
        // if they do, and the web server passes it on to us, we
        // need to strip it or we get false-positive redirect loops
        // or weird output URLs
        $hash = strpos( $base, '#' );
        if ( $hash !== false ) {
            $base = substr( $base, 0, $hash );
        }
 
        if ( $base[0] == '/' ) {
            // More than one slash will look like it is protocol relative
            return preg_replace( '!^/+!', '/', $base );
        } else {
            // We may get paths with a host prepended; strip it.
            return preg_replace( '!^[^:]+://[^/]+/+!', '/', $base );
        }
    }
 
    public function getRequestURL() {
        return self::getGlobalRequestURL();
    }
 
    public function getFullRequestURL() {
        $urlUtils = MediaWikiServices::getInstance()->getUrlUtils();
        // Pass an explicit PROTO constant instead of PROTO_CURRENT so that we
        // do not rely on state from the global $wgRequest object (which it would,
        // via UrlUtils::getServer()/UrlUtils::expand()/$wgRequest->protocol).
        if ( $this->getProtocol() === 'http' ) {
            return ( $urlUtils->getServer( PROTO_HTTP ) ?? '' ) . $this->getRequestURL();
        } else {
            return ( $urlUtils->getServer( PROTO_HTTPS ) ?? '' ) . $this->getRequestURL();
        }
    }
 
    public function appendQueryValue( $key, $value ) {
        return $this->appendQueryArray( [ $key => $value ] );
    }
 
    public function appendQueryArray( $array ) {
        $newquery = $this->getQueryValues();
        unset( $newquery['title'] );
        $newquery = array_merge( $newquery, $array );
 
        return wfArrayToCgi( $newquery );
    }
 
    public function getLimitOffsetForUser( UserIdentity $user, $deflimit = 50, $optionname = 'rclimit' ) {
        $limit = $this->getInt( 'limit', 0 );
        if ( $limit < 0 ) {
            $limit = 0;
        }
        if ( ( $limit == 0 ) && ( $optionname != '' ) ) {
            $limit = MediaWikiServices::getInstance()
                ->getUserOptionsLookup()
                ->getIntOption( $user, $optionname );
        }
        if ( $limit <= 0 ) {
            $limit = $deflimit;
        }
        if ( $limit > 5000 ) {
            $limit = 5000; # We have *some* limits...
        }
 
        $offset = $this->getInt( 'offset', 0 );
        if ( $offset < 0 ) {
            $offset = 0;
        }
 
        return [ $limit, $offset ];
    }
 
    public function getFileTempname( $key ) {
        return $this->getUpload( $key )->getTempName();
    }
 
    public function getUploadError( $key ) {
        return $this->getUpload( $key )->getError();
    }
 
    public function getFileName( $key ) {
        return $this->getUpload( $key )->getName();
    }
 
    public function getUpload( $key ) {
        return new WebRequestUpload( $this, $key );
    }
 
    public function response(): WebResponse {
        /* Lazy initialization of response object for this request */
        if ( !$this->response ) {
            $this->response = new WebResponse();
        }
        return $this->response;
    }
 
    protected function initHeaders() {
        if ( count( $this->headers ) ) {
            return;
        }
 
        $this->headers = array_change_key_case( getallheaders(), CASE_UPPER );
    }
 
    public function getAllHeaders() {
        $this->initHeaders();
        return $this->headers;
    }
 
    public function getHeader( $name, $flags = 0 ) {
        $this->initHeaders();
        $name = strtoupper( $name );
        if ( !isset( $this->headers[$name] ) ) {
            return false;
        }
        $value = $this->headers[$name];
        if ( $flags & self::GETHEADER_LIST ) {
            $value = array_map( 'trim', explode( ',', $value ) );
        }
        return $value;
    }
 
    public function getSessionData( $key ) {
        return $this->getSession()->get( $key );
    }
 
    public function setSessionData( $key, $data ) {
        $this->getSession()->set( $key, $data );
    }
 
    public function getAcceptLang() {
        // Modified version of code found at
        // http://www.thefutureoftheweb.com/blog/use-accept-language-header
        $acceptLang = $this->getHeader( 'Accept-Language' );
        if ( !$acceptLang ) {
            return [];
        }
 
        // Return the language codes in lower case
        $acceptLang = strtolower( $acceptLang );
 
        // Break up string into pieces (languages and q factors)
        if ( !preg_match_all(
            '/
                # a language code or a star is required
                ([a-z]{1,8}(?:-[a-z]{1,8})*|\*)
                # from here everything is optional
                \s*
                (?:
                    # this accepts only numbers in the range ;q=0.000 to ;q=1.000
                    ;\s*q\s*=\s*
                    (1(?:\.0{0,3})?|0(?:\.\d{0,3})?)?
                )?
            /x',
            $acceptLang,
            $matches,
            PREG_SET_ORDER
        ) ) {
            return [];
        }
 
        // Create a list like "en" => 0.8
        $langs = [];
        foreach ( $matches as $match ) {
            $languageCode = $match[1];
            // When not present, the default value is 1
            $qValue = (float)( $match[2] ?? 1.0 );
            if ( $qValue ) {
                $langs[$languageCode] = $qValue;
            }
        }
 
        // Sort list by qValue
        arsort( $langs, SORT_NUMERIC );
        return $langs;
    }
 
    protected function getRawIP() {
        $remoteAddr = $this->getServerInfo( 'REMOTE_ADDR' );
        if ( !$remoteAddr ) {
            return null;
        }
        if ( str_contains( $remoteAddr, ',' ) ) {
            throw new MWException( 'Remote IP must not contain multiple values' );
        }
 
        return IPUtils::canonicalize( $remoteAddr );
    }
 
    public function getIP(): string {
        global $wgUsePrivateIPs;
 
        # Return cached result
        if ( $this->ip !== null ) {
            return $this->ip;
        }
 
        # collect the originating IPs
        $ip = $this->getRawIP();
        if ( !$ip ) {
            throw new MWException( 'Unable to determine IP.' );
        }
 
        $services = MediaWikiServices::getInstance();
        # Append XFF
        $forwardedFor = $this->getHeader( 'X-Forwarded-For' );
        if ( $forwardedFor !== false ) {
            $proxyLookup = $services->getProxyLookup();
            $isConfigured = $proxyLookup->isConfiguredProxy( $ip );
            $ipchain = array_map( 'trim', explode( ',', $forwardedFor ) );
            $ipchain = array_reverse( $ipchain );
            array_unshift( $ipchain, $ip );
 
            # Step through XFF list and find the last address in the list which is a
            # trusted server. Set $ip to the IP address given by that trusted server,
            # unless the address is not sensible (e.g. private). However, prefer private
            # IP addresses over proxy servers controlled by this site (more sensible).
            # Note that some XFF values might be "unknown" with Squid/Varnish.
            foreach ( $ipchain as $i => $curIP ) {
                $curIP = IPUtils::sanitizeIP(
                    IPUtils::canonicalize(
                        self::canonicalizeIPv6LoopbackAddress( $curIP )
                    )
                );
                if ( !$curIP || !isset( $ipchain[$i + 1] ) || $ipchain[$i + 1] === 'unknown'
                    || !$proxyLookup->isTrustedProxy( $curIP )
                ) {
                    break; // IP is not valid/trusted or does not point to anything
                }
                if (
                    IPUtils::isPublic( $ipchain[$i + 1] ) ||
                    $wgUsePrivateIPs ||
                    // T50919; treat IP as valid
                    $proxyLookup->isConfiguredProxy( $curIP )
                ) {
                    $nextIP = $ipchain[$i + 1];
 
                    // Follow the next IP according to the proxy
                    $nextIP = IPUtils::canonicalize(
                        self::canonicalizeIPv6LoopbackAddress( $nextIP )
                    );
                    if ( !$nextIP && $isConfigured ) {
                        // We have not yet made it past CDN/proxy servers of this site,
                        // so either they are misconfigured or there is some IP spoofing.
                        throw new MWException( "Invalid IP given in XFF '$forwardedFor'." );
                    }
                    $ip = $nextIP;
 
                    // keep traversing the chain
                    continue;
                }
                break;
            }
        }
 
        // Allow extensions to modify the result
        $hookContainer = $services->getHookContainer();
        // Optimisation: Hot code called on most requests (T85805).
        if ( $hookContainer->isRegistered( 'GetIP' ) ) {
            // @phan-suppress-next-line PhanTypeMismatchArgument Type mismatch on pass-by-ref args
            ( new HookRunner( $hookContainer ) )->onGetIP( $ip );
        }
 
        if ( !$ip ) {
            throw new MWException( 'Unable to determine IP.' );
        }
 
        $this->ip = $ip;
        return $ip;
    }
 
    public static function canonicalizeIPv6LoopbackAddress( $ip ) {
        // Code moved from IPUtils library. See T248237#6614927
        if ( preg_match( '/^0*' . IPUtils::RE_IPV6_GAP . '1$/', $ip ) ) {
            return '127.0.0.1';
        }
        return $ip;
    }
 
    public function setIP( $ip ) {
        $this->ip = $ip;
    }
 
    public function hasSafeMethod() {
        if ( $this->getServerInfo( 'REQUEST_METHOD' ) === null ) {
            return false; // CLI mode
        }
 
        return in_array( $this->getServerInfo( 'REQUEST_METHOD' ), [ 'GET', 'HEAD', 'OPTIONS', 'TRACE' ] );
    }
 
    public function isSafeRequest() {
        wfDeprecated( __METHOD__, '1.41' );
        if ( $this->markedAsSafe && $this->wasPosted() ) {
            return true; // marked as a "safe" POST
        }
 
        return $this->hasSafeMethod();
    }
 
    public function markAsSafeRequest() {
        wfDeprecated( __METHOD__, '1.41' );
        $this->markedAsSafe = true;
    }
 
    public function matchURLForCDN( array $cdnUrls ) {
        $services = MediaWikiServices::getInstance();
        $reqUrl = (string)$services->getUrlUtils()->expand( $this->getRequestURL(), PROTO_INTERNAL );
        $config = $services->getMainConfig();
        if ( $config->get( MainConfigNames::CdnMatchParameterOrder ) ) {
            // Strict matching
            return in_array( $reqUrl, $cdnUrls, true );
        }
 
        // Loose matching (order of query parameters is ignored)
        $reqUrlParts = explode( '?', $reqUrl, 2 );
        $reqUrlBase = $reqUrlParts[0];
        $reqUrlParams = count( $reqUrlParts ) === 2 ? explode( '&', $reqUrlParts[1] ) : [];
        // The order of parameters after the sort() call below does not match
        // the order set by the CDN, and does not need to. The CDN needs to
        // take special care to preserve the relative order of duplicate keys
        // and array-like parameters.
        sort( $reqUrlParams );
        foreach ( $cdnUrls as $cdnUrl ) {
            if ( strlen( $reqUrl ) !== strlen( $cdnUrl ) ) {
                continue;
            }
            $cdnUrlParts = explode( '?', $cdnUrl, 2 );
            $cdnUrlBase = $cdnUrlParts[0];
            if ( $reqUrlBase !== $cdnUrlBase ) {
                continue;
            }
            $cdnUrlParams = count( $cdnUrlParts ) === 2 ? explode( '&', $cdnUrlParts[1] ) : [];
            sort( $cdnUrlParams );
            if ( $reqUrlParams === $cdnUrlParams ) {
                return true;
            }
        }
        return false;
    }
 
    public function getSecurityLogContext( ?UserIdentity $user = null ): array {
        $this->securityLogContext ??= new HashBagOStuff( [ 'maxKeys' => 5 ] );
        $cacheKey = $user
            ? $this->securityLogContext->makeKey( 'user', $user->getName() )
            : $this->securityLogContext->makeKey( 'anon', '-' );
        if ( $this->securityLogContext->hasKey( $cacheKey ) ) {
            return $this->securityLogContext->get( $cacheKey );
        }
 
        $context = [
            'clientIp' => $this->getIP(),
        ];
 
        $userAgent = $this->getHeader( 'User-Agent' );
        $apiUserAgent = null;
        if ( defined( 'MW_API' ) ) {
            // matches ApiMain::getUserAgent()
            $apiUserAgent = $this->getHeader( 'Api-User-Agent' );
        }
        $context['ua'] = $apiUserAgent ?: $userAgent;
        if ( $apiUserAgent ) {
            $context['originalUserAgent'] = $userAgent;
        }
 
        $services = MediaWikiServices::getInstance();
        if ( $user ) {
            $context += [
                'user' => $user->getName(),
                'user_exists_locally' => $user->isRegistered(),
                'user_is_bot' => $services->getUserFactory()->newFromUserIdentity( $user )->isBot(),
            ];
        }
 
        $info = [ 'request' => $this, 'user' => $user ];
        $hookRunner = new HookRunner( $services->getHookContainer() );
        $hookRunner->onGetSecurityLogContext( $info, $context );
 
        $this->securityLogContext->set( $cacheKey, $context );
        return $context;
    }
}
 
class_alias( WebRequest::class, 'WebRequest' );