class.core.php

Go to the documentation of this file.

<?php
/*
 *
 *  * Copyright (c) 2021-2026 Bearsampp
 *  * License:  GNU General Public License version 3 or later; see LICENSE.txt
 *  * Website: https://bearsampp.com
 *  * Github: https://github.com/Bearsampp
 *
 */

class Core
{
    // Constants for various file names and versions
    const isRoot_FILE = 'root.php';
    const PATH_WIN_PLACEHOLDER = '~BEARSAMPP_WIN_PATH~';
    const PATH_LIN_PLACEHOLDER = '~BEARSAMPP_LIN_PATH~';
 
    const PHP_EXE = 'php-win.exe';
    const SETENV_EXE = 'SetEnv.exe';
    const NSSM_EXE = 'nssm.exe';
    const OPENSSL_EXE = 'openssl.exe';
    const OPENSSL_CONF = 'openssl.cfg';
    const HOSTSEDITOR_EXE = 'hEdit_x64.exe';
    const LN_EXE = 'ln.exe';
    const PWGEN_EXE = "PwTech.exe";
 
    const APP_VERSION = 'version.dat';
    const LAST_PATH = 'lastPath.dat';
    const EXEC = 'exec.dat';
    const LOADING_PID = 'loading.pid';

    public function __construct()
    {
        if (extension_loaded('winbinder')) {
            require_once Path::getLibsPath() . '/winbinder/winbinder.php';
        }
    }

    public function getAppVersion()
    {
        global $bearsamppLang;
 
        $filePath = Path::getResourcesPath() . '/' . self::APP_VERSION;
        if (!is_file($filePath)) {
            Log::error(sprintf($bearsamppLang->getValue(Lang::ERROR_CONF_NOT_FOUND), APP_TITLE, $filePath));
 
            return null;
        }
 
        return trim(file_get_contents($filePath));
    }

    public function getLastPathContent()
    {
        return @file_get_contents(Path::getLastPath());
    }

    public function getPreviousExec()
    {
        $file = $this->getExec();
        if (file_exists($file)) {
            return trim(file_get_contents($file));
        }
 
        return false;
    }

    public function getExec($aetrayPath = false)
    {
        return Path::getTmpPath($aetrayPath) . '/' . self::EXEC;
    }

    public function setExec($action)
    {
        file_put_contents($this->getExec(), $action);
    }

    public function getLoadingPid($aetrayPath = false)
    {
        return Path::getResourcesPath($aetrayPath) . '/' . self::LOADING_PID;
    }

    public function addLoadingPid($pid)
    {
        file_put_contents($this->getLoadingPid(), $pid . PHP_EOL, FILE_APPEND);
    }

    public function __toString()
    {
        return 'core object';
    }

    public function unzipFile($filePath, $destination, $progressCallback = null)
    {
        global $bearsamppRoot;
 
        $sevenZipPath = Path::getLibsPath() . '/7zip/7za.exe';
 
        if (!file_exists($sevenZipPath)) {
            Log::error('7za.exe not found at: ' . $sevenZipPath);
 
            return false;
        }
 
        if ($progressCallback) {
            call_user_func($progressCallback, 'Analyzing archive...');
        }
 
        // Defensive path-traversal scan: parse the structured `7z l -slt` output into
        // each individual entry path and validate every one relative to the destination,
        // so extraction can never escape the intended directory. This must fail closed:
        // any listing/parse failure aborts the operation rather than proceeding unverified.
        // The scan also returns the number of archive entries, used as the extraction
        // file count. A standalone integrity test is not needed: the archive's SHA-256
        // was already verified against its .sha256 sidecar upstream, and `7za x`
        // CRC-checks every file as it is extracted.
        $numFiles = self::isSafeDestinationFileList($sevenZipPath, $filePath);
        if ($numFiles === false) {
            Log::error('Archive path-traversal scan failed or rejected for: ' . $filePath);
 
            return false;
        }
        Log::trace('Number of files to be extracted: ' . $numFiles);
 
        if ($progressCallback) {
            call_user_func($progressCallback, 'Initializing extraction...');
        }
        // Extract the archive, streaming progress line-by-line
        $returnVar = CommandRunner::stream(
            $sevenZipPath,
            ['x', $filePath, '-y', '-bsp1', '-bb0', '-o' . $destination],
            function (string $line) use ($progressCallback) {
                Log::trace("Processing line: $line");
                if ($line === 'Everything is Ok') {
                    if ($progressCallback) {
                        Log::trace('Extraction progress: 100%');
                        call_user_func($progressCallback, 100);
                    }
                } elseif ($progressCallback && preg_match('/(?:^|\s)(\d+)%/', $line, $matches)) {
                    $currentPercentage = intval($matches[1]);
                    Log::trace("Extraction progress: $currentPercentage%");
                    call_user_func($progressCallback, $currentPercentage);
                } else {
                    Log::trace("Line did not match pattern: $line");
                }
            }
        );
 
        if ($returnVar === false) {
            Log::error('Failed to open process for: ' . $sevenZipPath);
 
            return ['error' => 'Failed to open process', 'numFiles' => $numFiles];
        }
 
        Log::trace('Command return value: ' . $returnVar);
 
        if ($returnVar === 0 && $progressCallback) {
            Log::trace('Extraction completed successfully. Setting progress to 100%');
            call_user_func($progressCallback, 100);
            usleep(100000); // 100 milliseconds
        }
 
        if ($returnVar === 0) {
            Log::debug('Successfully unzipped file to: ' . $destination);
 
            return ['success' => true, 'numFiles' => $numFiles];
        }
 
        Log::error('Failed to unzip file. Command return value: ' . $returnVar);
 
        return ['error' => 'Failed to unzip file', 'numFiles' => $numFiles];
    }

    private static function isSafeDestinationFileList($sevenZipPath, $filePath)
    {
        $listingFile = Path::getTmpPath() . '/7z-listing-' . uniqid('', true) . '.txt';
        $stderrFile  = Path::getTmpPath() . '/7z-listing-' . uniqid('', true) . '.err';
 
        $returnVar = CommandRunner::execToFile($sevenZipPath, ['l', '-slt', $filePath], $listingFile, $stderrFile);
        if ($returnVar === false) {
            Log::error('Path-traversal scan: unable to list archive: ' . $filePath);
 
            return false;
        }
 
        $listingOutput = @file_get_contents($listingFile);
        @unlink($listingFile);
        @unlink($stderrFile);
 
        if (!is_string($listingOutput) || $listingOutput === '') {
            Log::error('Path-traversal scan: unable to list archive: ' . $filePath);
 
            return false;
        }
 
        // 7-Zip separates the `-slt` entry blocks with blank lines (a single dash
        // line precedes the first entry, and the banner/header references the archive
        // itself). Normalize line endings and split on blank lines so each block is
        // one archive entry.
        $listingOutput = str_replace("\r\n", "\n", $listingOutput);
        $blocks        = preg_split('/\n[ \t]*\n/', $listingOutput);
        if (empty($blocks)) {
            // No entries listed at all - cannot validate, fail closed.
            Log::error('Path-traversal scan: no entries found in archive: ' . $filePath);
 
            return false;
        }
 
        // The header block's `Path = <archive itself>` entry must not be validated
        // or counted; skip any block that resolves to the archive file.
        $archivePathNormalized = strtolower(str_replace('/', '\\', $filePath));
 
        $numFiles = 0;
        foreach ($blocks as $block) {
            $block = trim($block);
            if ($block === '') {
                continue;
            }
 
            if (!preg_match('/^Path = (.*)$/m', $block, $match)) {
                // Not an entry block (banner/scanning preamble lines) - skip.
                continue;
            }
 
            $entryPath = trim($match[1]);
            if (strtolower(str_replace('/', '\\', $entryPath)) === $archivePathNormalized) {
                // Banner/header (and any trailing archive-summary) block.
                continue;
            }
 
            if (self::isUnsafeArchiveEntryPath($entryPath)) {
                Log::error('Archive contains an unsafe entry path ("' . $entryPath . '"): ' . $filePath);
 
                return false;
            }
 
            // Directories are validated above but not counted as files, matching the
            // file count previously reported by `7z t` (`Files:` excludes folders).
            if (preg_match('/^Attributes = D\s*$/m', $block)) {
                continue;
            }
 
            $numFiles++;
        }
 
        if ($numFiles === 0) {
            // Nothing to extract - cannot validate, fail closed.
            Log::error('Path-traversal scan: no file entries found in archive: ' . $filePath);
 
            return false;
        }
 
        return $numFiles;
    }

    private static function isUnsafeArchiveEntryPath($entryPath)
    {
        if ($entryPath === '') {
            return true;
        }
 
        // Parent-directory traversal (matches any path segment equal to '..').
        if (preg_match('/(?:^|[\\/\\\\])\.\.(?:[\\/\\\\]|$)/', $entryPath)) {
            return true;
        }
 
        // Absolute / rooted paths.
        if (preg_match('#^(?:[A-Za-z]:[\\/\\\\]|[\\/\\\\])#', $entryPath)) {
            return true;
        }
 
        return false;
    }
}