1:   2:   3:   4:   5:   6:   7:   8:   9:  10:  11:  12:  13:  14:  15:  16:  17:  18:  19:  20:  21:  22:  23:  24:  25:  26:  27:  28:  29:  30:  31:  32:  33:  34:  35:  36:  37:  38:  39:  40:  41:  42:  43:  44:  45:  46:  47:  48:  49:  50:  51:  52:  53:  54:  55:  56:  57:  58:  59:  60:  61:  62:  63:  64:  65:  66:  67:  68:  69:  70:  71:  72:  73:  74:  75:  76:  77:  78:  79:  80:  81:  82:  83:  84:  85:  86:  87:  88:  89:  90:  91:  92:  93:  94:  95:  96:  97:  98:  99: 100: 101: 102: 103: 104: 105: 106: 107: 108: 109: 110: 111: 112: 113: 114: 115: 116: 117: 118: 119: 120: 121: 122: 123: 124: 125: 126: 127: 128: 129: 130: 131: 132: 133: 134: 135: 136: 137: 138: 139: 140: 141: 142: 143: 144: 145: 146: 147: 148: 149: 150: 151: 152: 153: 154: 155: 156: 157: 158: 159: 160: 161: 162: 163: 164: 165: 166: 167: 168: 169: 170: 171: 172: 173: 174: 175: 176: 177: 178: 179: 180: 181: 182: 183: 184: 185: 186: 187: 188: 189: 190: 191: 192: 193: 194: 195: 196: 197: 198: 199: 200: 201: 202: 203: 204: 205: 206: 207: 208: 209: 210: 211: 212: 213: 214: 215: 216: 217: 218: 219: 220: 221: 222: 223: 224: 225: 226: 227: 228: 229: 230: 231: 232: 233: 234: 235: 236: 237: 238: 239: 240: 241: 242: 243: 244: 245: 246: 247: 248: 249: 250: 251: 252: 253: 254: 255: 256: 257: 258: 259: 

<?php

/**
 * MvcCore
 *
 * This source file is subject to the BSD 3 License
 * For the full copyright and license information, please view 
 * the LICENSE.md file that are distributed with this source code.
 *
 * @copyright   Copyright (c) 2016 Tom Flidr (https://github.com/mvccore)
 * @license     https://mvccore.github.io/docs/mvccore/5.0.0/LICENCE.md
 */

namespace MvcCore\Ext\Forms\Validators\Files\Validations;

use \MvcCore\Ext\Forms\Validators\Files\Validations\IBombScanner;

/**
 * Responsibility: Detect if uploaded file is not ZIP or PNG bomb.
 */
trait Bomb {

    /**
     * Try to detect archive bomb if necessary.
     * @param string $tmpFullPath
     * @param string $uploadedFileName
     * @param int $level
     * @return bool|NULL
     */
    protected function validateBomb (& $file) {
        $recursiveInfo = (object) [
            'uploadedFileName'  => $file->name,
            'entriesTotalCount' => 0,
            'entriesTotalSize'  => 0,
            'allEntriesMaxSize' => NULL,
        ];
        $oldMask = umask(0);
        $result = $this->validateBombRecursive(
            $file->tmpFullPath, $recursiveInfo
        );
        umask($oldMask);
        if (!$result->success) {
            $this->field->AddValidationError(
                isset($result->message)
                    ? $result->message
                    : static::GetErrorMessage(static::UPLOAD_ERR_FILE_BOMB), 
                [$file->name]
            );
            return $this->removeAllTmpFiles();
        }
        return TRUE;
    }

    /**
     * Try to detect file bomb recursively.
     * @param string    $fullPath 
     * @param \stdClass $recursiveInfo 
     * @param int       $level 
     * @return \stdClass
     */
    protected function validateBombRecursive (
        $fullPath, \stdClass & $recursiveInfo, $level = 0
    ) {
        $possibleBombAdapter = $this->validateBombGetPossibleType($fullPath);
        if ($possibleBombAdapter === NULL)
            return (object) [
                'success' => TRUE // `TRUE` means no bomb
            ];
        return $this->validateBombRecursiveArchive(
            $possibleBombAdapter, $recursiveInfo, $level
        );
    }
    
    /**
     * Get possible file bomb type by first magic bytes.
     * @param string $fullPath 
     * @return \MvcCore\Ext\Forms\Validators\Files\Validations\IBombScanner|NULL
     */
    protected function validateBombGetPossibleType ($fullPath) {
        if ($this->bombScanners === NULL) return NULL;
        $spl = new \SplFileObject($fullPath);
        $spl->rewind();
        $firstFourBytes = $spl->fread(4);
        /** @var $bombScannerClass \MvcCore\Ext\Forms\Validators\Files\Validations\IBombScanner */
        foreach ($this->bombScanners as $bombScannerClass) 
            if ($bombScannerClass::MatchMagicBytes($firstFourBytes)) 
                return new $bombScannerClass($this, $spl);
        return NULL;
    }

    /**
     * Try to detect ZIP bomb recursively.
     * @param IBombScanner $adapter 
     * @param \stdClass    $recursiveInfo 
     * @param int          $level 
     * @return \stdClass
     */
    protected function validateBombRecursiveArchive (
        IBombScanner $adapter, \stdClass & $recursiveInfo, $level
    ) {
        if (!$adapter::IsSupported()) 
            return (object) [
                'success'   => FALSE, // `FALSE` means bomb
                'message'   => $adapter::GetNotSupportedError()
            ];
        
        /**
         * Open archive or return upload error 
         * if opening is not possible.
         */
        if (!$adapter->Open())
            return (object) [
                'success'   => FALSE, // `FALSE` means bomb
                'message'   => $adapter->GetError()
            ];

        if (!$adapter::IsArchive()) 
            return (object) [
                'success' => TRUE // PNG images are OK, `TRUE` means no bomb
            ];

        // Complete archive uncompressed size:
        $compressedSize = $adapter->GetCompressedSize();

        // Complete ZIP file size from all ZIP archive items together:
        if ($level === 0)
            $recursiveInfo->allEntriesMaxSize = (
                $compressedSize * $this->archiveMaxCompressPercentage
            );

        /**
         * Complete all nested items size recursivelly.
         * If there is detected any ZIP bomb aspect, 
         * stop the recursion.
         */
        $bombDetection = $this->validateBombRecursiveArchiveEntriesSize(
            $adapter, $recursiveInfo, $level
        );

        // If any bomb type detected:
        if (
            $bombDetection->tooHighExpansion || 
            $bombDetection->tooManyLevels ||
            $bombDetection->tooManyFiles
        ) return (object) [ // `FALSE` means bomb
            'success' => FALSE
        ];

        // If all entries are emty files - it's not a bomb.
        if ($recursiveInfo->entriesTotalSize === 0) 
            return (object) [
                'success' => TRUE // `TRUE` means no bomb
            ];

        /**
         * Archive is not bomb if it's compress 
         * percentage is larger than 10% by default.
         * If compress percentage is lower - it's 
         * probably an archive bomb!
         */
        $compressPercentage = (
            $compressedSize / $recursiveInfo->entriesTotalSize
        ) * 100.0;
        $result = (
            $compressPercentage > $this->archiveMaxCompressPercentage
        );

        return (object) [
            'success' => $result // `TRUE` means no bomb, `FALSE` means bomb
        ];
    }

    /**
     * Complete all nested items size recursivelly.
     * If there is detected any ZIP bomb aspect, 
     * stop the recursion.
     * @param IBombScanner $adapter
     * @param \stdClass    $recursiveInfo 
     * @param int          $level 
     * @return \stdClass
     */
    protected function validateBombRecursiveArchiveEntriesSize (
        IBombScanner $adapter, \stdClass & $recursiveInfo, $level
    ) {
        $bombDetection = (object) [
            'tooHighExpansion'  => FALSE,
            'tooManyFiles'      => FALSE,
            'tooManyLevels'     => FALSE,
        ];
        while ($adapter->Move()) {
            $recursiveInfo->entriesTotalCount++;
            if ($recursiveInfo->entriesTotalCount > $this->archiveMaxItems) {
                $bombDetection->tooManyFiles = TRUE;
                break;
            }
            $entrySize = $adapter->GetEntrySize();
            if ($recursiveInfo->entriesTotalSize + $entrySize > $recursiveInfo->allEntriesMaxSize) {
                $bombDetection->tooHighExpansion = TRUE;
                break;
            }
            $entryName = $adapter->GetEntryName();
            if ($entryName === NULL) continue;
            $entryNameBase = preg_replace('#[^A-Za-z0-9_\.]#', '', basename($entryName));
            $itemDir = $this->uploadsTmpDir . '/' . $entryNameBase . '.' . uniqid();
            $itemDirCreated = mkdir($itemDir, 0600);
            $itemFullPath = $itemDir . '/' . $entryNameBase;
            if ($itemDirCreated) {
                $extractedItemFullPath = $adapter->ExtractEntry($itemFullPath);
                if ($extractedItemFullPath === NULL) {
                    $recursiveInfo->entriesTotalSize += $entrySize;
                } else {
                    $recursiveInfo->entriesTotalSize += filesize($extractedItemFullPath);
                    $possibleBombAdapter = $this->validateBombGetPossibleType($extractedItemFullPath);
                    $bombRecursionResult = (object) [
                        'success'   => TRUE,// `TRUE` means no bomb
                    ];
                    if ($possibleBombAdapter !== NULL) {
                        if ($level + 1 === $this->archiveMaxLevels) {
                            $bombDetection->tooManyLevels = TRUE;
                            $this->removeItemWithDir($extractedItemFullPath);
                            break;
                        }
                        $bombRecursionResult = $this->validateBombRecursiveArchive(
                            $possibleBombAdapter, $recursiveInfo, $level + 1
                        );
                    }
                    $this->removeItemWithDir($extractedItemFullPath);
                    if (!$bombRecursionResult->success) {
                        $bombDetection->tooManyLevels = TRUE;
                        break;
                    }
                }
            }
        }
        // Close archive object before any return.
        $adapter->Close();
        return $bombDetection;
    }

    /**
     * @param string $fullPath 
     * @return void
     */
    protected function removeItemWithDir ($itemFullPath) {
        unlink($itemFullPath);
        clearstatcache(TRUE, $itemFullPath);
        $lastSlashPos = mb_strrpos($itemFullPath, '/');
        if ($lastSlashPos === FALSE) return;
        $dirFullPath = mb_substr($itemFullPath, 0, $lastSlashPos);
        $dirRemoved = @rmdir($dirFullPath);
        if (!$dirRemoved && function_exists('shell_exec')) {
            $cmd = strtoupper(substr(PHP_OS, 0, 3)) === 'WIN'
                ? "rmdir /Q /S \"{$dirFullPath}\""
                : "rm -rf \"{$dirFullPath}\"";
            shell_exec($cmd);
        }
    }
}