Skip to content

Commit f2dc8ba

Browse files
Backport security for old PHP versions (#334)
1 parent 9fc6c3d commit f2dc8ba

File tree

1 file changed

+18
-0
lines changed

1 file changed

+18
-0
lines changed

src/Solutions/MakeViewVariableOptionalSolution.php

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
use Facade\IgnitionContracts\RunnableSolution;
66
use Illuminate\Support\Facades\Blade;
7+
use Illuminate\Support\Str;
78

89
class MakeViewVariableOptionalSolution implements RunnableSolution
910
{
@@ -72,6 +73,10 @@ public function run(array $parameters = [])
7273

7374
public function makeOptional(array $parameters = [])
7475
{
76+
if (!$this->isSafePath($parameters['viewFile'])) {
77+
return false;
78+
}
79+
7580
$originalContents = file_get_contents($parameters['viewFile']);
7681
$newContents = str_replace('$'.$parameters['variableName'], '$'.$parameters['variableName']." ?? ''", $originalContents);
7782

@@ -87,6 +92,19 @@ public function makeOptional(array $parameters = [])
8792
return $newContents;
8893
}
8994

95+
protected function isSafePath(string $path): bool
96+
{
97+
if (!Str::startsWith($path, ['/', './'])) {
98+
return false;
99+
}
100+
101+
if (!Str::endsWith($path, '.blade.php')) {
102+
return false;
103+
}
104+
105+
return true;
106+
}
107+
90108
protected function generateExpectedTokens(array $originalTokens, string $variableName): array
91109
{
92110
$expectedTokens = [];

0 commit comments

Comments
 (0)