1<?php 2 3/** 4 * webtrees: online genealogy 5 * Copyright (C) 2023 webtrees development team 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation, either version 3 of the License, or 9 * (at your option) any later version. 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * You should have received a copy of the GNU General Public License 15 * along with this program. If not, see <https://www.gnu.org/licenses/>. 16 */ 17 18declare(strict_types=1); 19 20namespace Fisharebest\Webtrees; 21 22use Aura\Router\Route; 23use Closure; 24use Fisharebest\Webtrees\Contracts\UserInterface; 25use Fisharebest\Webtrees\Http\Exceptions\HttpBadRequestException; 26use Psr\Http\Message\ServerRequestInterface; 27 28use function array_reduce; 29use function array_walk_recursive; 30use function ctype_digit; 31use function in_array; 32use function is_array; 33use function is_int; 34use function is_string; 35use function parse_url; 36use function preg_match; 37use function str_starts_with; 38use function substr; 39 40/** 41 * Validate a parameter from an HTTP request 42 */ 43class Validator 44{ 45 /** @var array<int|string|Tree|UserInterface|array<int|string>> */ 46 private array $parameters; 47 48 private ServerRequestInterface $request; 49 50 /** @var array<Closure> */ 51 private array $rules = []; 52 53 /** 54 * @param array<int|string|Tree|UserInterface|array<int|string>> $parameters 55 * @param ServerRequestInterface $request 56 * @param string $encoding 57 */ 58 private function __construct(array $parameters, ServerRequestInterface $request, string $encoding) 59 { 60 if ($encoding === 'UTF-8') { 61 // All keys and values must be valid UTF-8 62 $check_utf8 = static function ($value, $key): void { 63 if (is_string($key) && preg_match('//u', $key) !== 1) { 64 throw new HttpBadRequestException('Invalid UTF-8 characters in request'); 65 } 66 if (is_string($value) && preg_match('//u', $value) !== 1) { 67 throw new HttpBadRequestException('Invalid UTF-8 characters in request'); 68 } 69 }; 70 71 array_walk_recursive($parameters, $check_utf8); 72 } 73 74 $this->parameters = $parameters; 75 $this->request = $request; 76 } 77 78 /** 79 * @param ServerRequestInterface $request 80 * 81 * @return self 82 */ 83 public static function attributes(ServerRequestInterface $request): self 84 { 85 return new self($request->getAttributes(), $request, 'UTF-8'); 86 } 87 88 /** 89 * @param ServerRequestInterface $request 90 * 91 * @return self 92 */ 93 public static function parsedBody(ServerRequestInterface $request): self 94 { 95 return new self((array) $request->getParsedBody(), $request, 'UTF-8'); 96 } 97 98 /** 99 * @param ServerRequestInterface $request 100 * 101 * @return self 102 */ 103 public static function queryParams(ServerRequestInterface $request): self 104 { 105 return new self($request->getQueryParams(), $request, 'UTF-8'); 106 } 107 108 /** 109 * @param ServerRequestInterface $request 110 * 111 * @return self 112 */ 113 public static function serverParams(ServerRequestInterface $request): self 114 { 115 // Headers should be ASCII. 116 // However, we cannot enforce this as some servers add GEOIP headers with non-ASCII placenames. 117 return new self($request->getServerParams(), $request, 'ASCII'); 118 } 119 120 /** 121 * @param int $minimum 122 * @param int $maximum 123 * 124 * @return self 125 */ 126 public function isBetween(int $minimum, int $maximum): self 127 { 128 $this->rules[] = static function (?int $value) use ($minimum, $maximum): ?int { 129 if (is_int($value) && $value >= $minimum && $value <= $maximum) { 130 return $value; 131 } 132 133 return null; 134 }; 135 136 return $this; 137 } 138 139 /** 140 * @param array<int|string,int|string> $values 141 * 142 * @return self 143 */ 144 public function isInArray(array $values): self 145 { 146 $this->rules[] = static fn (int|string|null $value): int|string|null => in_array($value, $values, true) ? $value : null; 147 148 return $this; 149 } 150 151 /** 152 * @param array<int|string,int|string> $values 153 * 154 * @return self 155 */ 156 public function isInArrayKeys(array $values): self 157 { 158 return $this->isInArray(array_keys($values)); 159 } 160 161 /** 162 * @return self 163 */ 164 public function isNotEmpty(): self 165 { 166 $this->rules[] = static fn (?string $value): ?string => $value !== null && $value !== '' ? $value : null; 167 168 return $this; 169 } 170 171 /** 172 * @return self 173 */ 174 public function isLocalUrl(): self 175 { 176 $base_url = $this->request->getAttribute('base_url', ''); 177 178 $this->rules[] = static function (?string $value) use ($base_url): ?string { 179 if ($value !== null) { 180 $value_info = parse_url($value); 181 $base_url_info = parse_url($base_url); 182 183 if (is_array($value_info) && is_array($base_url_info)) { 184 $scheme_ok = ($value_info['scheme'] ?? 'http') === ($base_url_info['scheme'] ?? 'http'); 185 $host_ok = ($value_info['host'] ?? '') === ($base_url_info['host'] ?? ''); 186 $port_ok = ($value_info['port'] ?? '') === ($base_url_info['port'] ?? ''); 187 $user_ok = ($value_info['user'] ?? '') === ($base_url_info['user'] ?? ''); 188 $path_ok = str_starts_with($value_info['path'] ?? '/', $base_url_info['path'] ?? '/'); 189 190 if ($scheme_ok && $host_ok && $port_ok && $user_ok && $path_ok) { 191 return $value; 192 } 193 } 194 } 195 196 return null; 197 }; 198 199 return $this; 200 } 201 202 /** 203 * @return self 204 */ 205 public function isTag(): self 206 { 207 $this->rules[] = static function (?string $value): ?string { 208 if ($value !== null && preg_match('/^' . Gedcom::REGEX_TAG . '$/', $value) === 1) { 209 return $value; 210 } 211 212 return null; 213 }; 214 215 return $this; 216 } 217 218 /** 219 * @return self 220 */ 221 public function isXref(): self 222 { 223 $this->rules[] = static function ($value) { 224 if (is_string($value) && preg_match('/^' . Gedcom::REGEX_XREF . '$/', $value) === 1) { 225 return $value; 226 } 227 228 if (is_array($value)) { 229 foreach ($value as $v) { 230 if (!is_string($v) || preg_match('/^' . Gedcom::REGEX_XREF . '$/', $v) !== 1) { 231 return null; 232 } 233 } 234 235 return $value; 236 } 237 238 return null; 239 }; 240 241 return $this; 242 } 243 244 /** 245 * @param string $parameter 246 * @param bool|null $default 247 * 248 * @return bool 249 */ 250 public function boolean(string $parameter, bool $default = null): bool 251 { 252 $value = $this->parameters[$parameter] ?? null; 253 254 if (in_array($value, ['1', 'on', true], true)) { 255 return true; 256 } 257 258 if (in_array($value, ['0', '', false], true)) { 259 return false; 260 } 261 262 if ($default === null) { 263 throw new HttpBadRequestException(I18N::translate('The parameter “%s” is missing.', $parameter)); 264 } 265 266 return $default; 267 } 268 269 /** 270 * @param string $parameter 271 * 272 * @return array<string> 273 */ 274 public function array(string $parameter): array 275 { 276 $value = $this->parameters[$parameter] ?? null; 277 278 if (!is_array($value) && $value !== null) { 279 throw new HttpBadRequestException(I18N::translate('The parameter “%s” is missing.', $parameter)); 280 } 281 282 $callback = static fn (?array $value, Closure $rule): ?array => $rule($value); 283 284 return array_reduce($this->rules, $callback, $value) ?? []; 285 } 286 287 /** 288 * @param string $parameter 289 * @param int|null $default 290 * 291 * @return int 292 */ 293 public function integer(string $parameter, int $default = null): int 294 { 295 $value = $this->parameters[$parameter] ?? null; 296 297 if (is_string($value)) { 298 if (ctype_digit($value)) { 299 $value = (int) $value; 300 } elseif (str_starts_with($value, '-') && ctype_digit(substr($value, 1))) { 301 $value = (int) $value; 302 } 303 } 304 305 if (!is_int($value)) { 306 $value = null; 307 } 308 309 $callback = static fn (?int $value, Closure $rule): ?int => $rule($value); 310 311 $value = array_reduce($this->rules, $callback, $value) ?? $default; 312 313 if ($value === null) { 314 throw new HttpBadRequestException(I18N::translate('The parameter “%s” is missing.', $parameter)); 315 } 316 317 return $value; 318 } 319 320 /** 321 * @param string $parameter 322 * 323 * @return Route 324 */ 325 public function route(string $parameter = 'route'): Route 326 { 327 $value = $this->parameters[$parameter] ?? null; 328 329 if ($value instanceof Route) { 330 return $value; 331 } 332 333 throw new HttpBadRequestException(I18N::translate('The parameter “%s” is missing.', $parameter)); 334 } 335 336 /** 337 * @param string $parameter 338 * @param string|null $default 339 * 340 * @return string 341 */ 342 public function string(string $parameter, string $default = null): string 343 { 344 $value = $this->parameters[$parameter] ?? null; 345 346 if (!is_string($value)) { 347 $value = null; 348 } 349 350 $callback = static fn (?string $value, Closure $rule): ?string => $rule($value); 351 352 $value = array_reduce($this->rules, $callback, $value) ?? $default; 353 354 if ($value === null) { 355 throw new HttpBadRequestException(I18N::translate('The parameter “%s” is missing.', $parameter)); 356 } 357 358 return $value; 359 } 360 361 /** 362 * @param string $parameter 363 * 364 * @return Tree 365 */ 366 public function tree(string $parameter = 'tree'): Tree 367 { 368 $value = $this->parameters[$parameter] ?? null; 369 370 if ($value instanceof Tree) { 371 return $value; 372 } 373 374 throw new HttpBadRequestException(I18N::translate('The parameter “%s” is missing.', $parameter)); 375 } 376 377 /** 378 * @param string $parameter 379 * 380 * @return Tree|null 381 */ 382 public function treeOptional(string $parameter = 'tree'): ?Tree 383 { 384 $value = $this->parameters[$parameter] ?? null; 385 386 if ($value === null || $value instanceof Tree) { 387 return $value; 388 } 389 390 throw new HttpBadRequestException(I18N::translate('The parameter “%s” is missing.', $parameter)); 391 } 392 393 /** 394 * @param string $parameter 395 * 396 * @return UserInterface 397 */ 398 public function user(string $parameter = 'user'): UserInterface 399 { 400 $value = $this->parameters[$parameter] ?? null; 401 402 if ($value instanceof UserInterface) { 403 return $value; 404 } 405 406 throw new HttpBadRequestException(I18N::translate('The parameter “%s” is missing.', $parameter)); 407 } 408} 409