Merge branch 'develop' into fix/request-refresh-after-uri-normalization

Author: rahul05ranjan

.github/workflows/verify-release.yml

@@ -76,7 +76,7 @@ jobs:
           php-version: '8.2'
           tools: composer
           extensions: intl, gd
-          coverage: none
+          coverage: xdebug
 
       - name: Wait for Packagist to serve the new framework version
         run: |

CHANGELOG.md

@@ -30,7 +30,7 @@ class View extends BaseView
      *  { title|esc(js) }
      *  { created_on|date(Y-m-d)|esc(attr) }
      *
-     * @var array<string, (callable(mixed): mixed)&string>
+     * @var array<string, callable(mixed): mixed>
      */
     public $filters = [];
 
@@ -43,6 +43,14 @@ class View extends BaseView
      */
     public $plugins = [];
 
+    /**
+     * When true, Parser conditionals may only contain variables, literals,
+     * arithmetic, comparison and logical operators, and parentheses. Enable
+     * this when less-trusted users can edit Parser templates. Can be overridden per
+     * call with the `restrictConditionals` render option.
+     */
+    public bool $restrictParserConditionals = false;
+
     /**
      * View Decorators are class methods that will be run in sequence to
      * have a chance to alter the generated output just prior to caching

app/Config/View.php

@@ -10,7 +10,7 @@
         <output>api/build/</output>
         <cache>api/cache/</cache>
     </paths>
-    <version number="4.7.4">
+    <version number="4.7.5">
         <api format="php">
             <source dsn=".">
                 <path>system</path>

phpdoc.dist.xml

@@ -55,7 +55,7 @@ class CodeIgniter
     /**
      * The current version of CodeIgniter Framework
      */
-    public const CI_VERSION = '4.7.5-dev';
+    public const CI_VERSION = '4.7.6-dev';
 
     /**
      * App startup time.

system/CodeIgniter.php

@@ -37,7 +37,7 @@ class View extends BaseConfig
      *
      * @psalm-suppress UndefinedDocblockClass
      *
-     * @var array<string, (callable(mixed): mixed)&string>
+     * @var array<string, callable(mixed): mixed>
      */
     public $filters = [];
 
@@ -52,6 +52,14 @@ class View extends BaseConfig
      */
     public $plugins = [];
 
+    /**
+     * When true, Parser conditionals may only contain variables, literals,
+     * arithmetic, comparison and logical operators, and parentheses. Enable
+     * this when less-trusted users can edit Parser templates. Can be overridden per
+     * call with the `restrictConditionals` render option.
+     */
+    public bool $restrictParserConditionals = false;
+
     /**
      * Built-in View filters.
      *

system/Config/View.php

@@ -48,6 +48,11 @@ class CURLRequest extends OutgoingRequest
      */
     protected $baseURI;
 
+    /**
+     * The constructor's base URI, preserved independently of per-request changes.
+     */
+    private readonly URI $defaultBaseURI;
+
     /**
      * The setting values
      *
@@ -138,6 +143,7 @@ public function __construct(App $config, URI $uri, ?ResponseInterface $response
 
         $this->config = $this->defaultConfig;
         $this->parseOptions($options);
+        $this->defaultBaseURI = clone $this->baseURI;
 
         // Share Connection
         $optShareConnection = config(ConfigCURLRequest::class)->shareConnectionOptions ?? [ // @phpstan-ignore nullCoalesce.property
@@ -165,16 +171,18 @@ public function request($method, string $url, array $options = []): ResponseInte
     {
         $this->response = clone $this->responseOrig;
 
-        $this->parseOptions($options);
+        try {
+            $this->parseOptions($options);
 
-        $url = $this->prepareURL($url);
+            $url = $this->prepareURL($url);
 
-        $method = esc(strip_tags($method));
+            $method = esc(strip_tags($method));
 
-        $this->send($method, $url);
-
-        if ($this->shareOptions === false) {
-            $this->resetOptions();
+            $this->send($method, $url);
+        } finally {
+            if ($this->shareOptions === false) {
+                $this->resetOptions();
+            }
         }
 
         return $this->response;
@@ -197,6 +205,9 @@ protected function resetOptions()
         // Reset configs
         $this->config = $this->defaultConfig;
 
+        $this->baseURI = clone $this->defaultBaseURI;
+        $this->delay   = 0.0;
+
         // Set the default options for next request
         $this->parseOptions($this->defaultOptions);
     }

system/HTTP/CURLRequest.php

@@ -20,4 +20,5 @@
     'invalidCellClass'      => 'Unable to locate view cell class: "{0}".',
     'tagSyntaxError'        => 'You have a syntax error in your Parser tags: "{0}"',
     'invalidDecoratorClass' => '"{0}" is not a valid View Decorator.',
+    'restrictedConditional' => 'The Parser conditional is not allowed in restricted mode: "{0}"',
 ];

system/Language/en/View.php

@@ -100,7 +100,7 @@ public function max_size(?string $blank, string $params): bool
             }
 
             if ($file->getError() === UPLOAD_ERR_NO_FILE) {
-                return true;
+                continue;
             }
 
             if ($file->getError() === UPLOAD_ERR_INI_SIZE) {
@@ -135,7 +135,7 @@ public function is_image(?string $blank, string $params): bool
             }
 
             if ($file->getError() === UPLOAD_ERR_NO_FILE) {
-                return true;
+                continue;
             }
 
             // We know that our mimes list always has the first mime
@@ -149,6 +149,10 @@ public function is_image(?string $blank, string $params): bool
             if ($this->hasInvalidImageClientExtension($file)) {
                 return false;
             }
+
+            if ($this->hasUnsafeClientFilename($file)) {
+                return false;
+            }
         }
 
         return true;
@@ -173,7 +177,7 @@ public function mime_in(?string $blank, string $params): bool
             }
 
             if ($file->getError() === UPLOAD_ERR_NO_FILE) {
-                return true;
+                continue;
             }
 
             if (! in_array($file->getMimeType(), $params, true)) {
@@ -183,6 +187,10 @@ public function mime_in(?string $blank, string $params): bool
             if ($this->hasMismatchedClientExtension($file)) {
                 return false;
             }
+
+            if ($this->hasUnsafeClientFilename($file)) {
+                return false;
+            }
         }
 
         return true;
@@ -207,7 +215,7 @@ public function ext_in(?string $blank, string $params): bool
             }
 
             if ($file->getError() === UPLOAD_ERR_NO_FILE) {
-                return true;
+                continue;
             }
 
             // Check the real filename extension, not only the guessed extension.
@@ -220,6 +228,10 @@ public function ext_in(?string $blank, string $params): bool
             if ($file->guessExtension() !== $clientExtension) {
                 return false;
             }
+
+            if ($this->hasUnsafeClientFilename($file)) {
+                return false;
+            }
         }
 
         return true;
@@ -245,7 +257,11 @@ public function max_dims(?string $blank, string $params): bool
             }
 
             if ($file->getError() === UPLOAD_ERR_NO_FILE) {
-                return true;
+                continue;
+            }
+
+            if ($file->getError() !== UPLOAD_ERR_OK) {
+                return false;
             }
 
             // Get Parameter sizes
@@ -291,7 +307,11 @@ public function min_dims(?string $blank, string $params): bool
             }
 
             if ($file->getError() === UPLOAD_ERR_NO_FILE) {
-                return true;
+                continue;
+            }
+
+            if ($file->getError() !== UPLOAD_ERR_OK) {
+                return false;
             }
 
             // Get Parameter sizes
@@ -346,4 +366,35 @@ private function hasMismatchedClientExtension(UploadedFile $file): bool
 
         return $file->guessExtension() !== $clientExtension;
     }
+
+    /**
+     * Reject trailing-dot names and names with a PHP extension before the final extension.
+     */
+    private function hasUnsafeClientFilename(UploadedFile $file): bool
+    {
+        helper('security');
+
+        // Check the name that UploadedFile::move() uses when no name is supplied.
+        $filename = sanitize_filename($file->getClientName());
+        $parts    = explode('.', strtolower(rtrim($filename, ' ')));
+
+        if (count($parts) === 1) {
+            return false;
+        }
+
+        if (array_pop($parts) === '') {
+            return true;
+        }
+
+        // Some server configurations select a PHP handler from an earlier extension.
+        array_shift($parts);
+
+        foreach ($parts as $part) {
+            if (preg_match('/^php[0-9]*$/', $part) === 1 || in_array($part, ['pht', 'phtml', 'phar', 'phps'], true)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
 }

system/Validation/StrictRules/FileRules.php

@@ -111,13 +111,16 @@ final protected function view(?string $view, array $data = []): string
 
         $foundView = current($candidateViews);
 
-        return (function () use ($properties, $foundView): string {
+        // The parameter is variadic on purpose: func_get_arg() returns the current
+        // value of a named parameter, which extract() could overwrite with cell data.
+        return (function (string ...$foundView) use ($properties): string {
+            $foundView = $foundView[0]; // Keep $foundView available to the view as before.
             extract($properties);
             ob_start();
-            include $foundView;
+            include func_get_arg(0);
 
             return ob_get_clean();
-        })();
+        })($foundView);
     }
 
     /**