Changeset 60771 for trunk/src/wp-includes/SimplePie/src/File.php

Timestamp:

09/16/2025 10:45:37 PM (2 months ago)

Author:

SergeyBiryukov

Message:

External Libraries: Update the SimplePie library to version 1.9.0.

References:

• ​SimplePie 1.9.0 release notes
• ​Full list of changes in SimplePie 1.9.0

Follow-up to [59141], [60490].

Props swissspidy, TobiasBg, SergeyBiryukov.
Fixes #63961.

File:

• trunk/src/wp-includes/SimplePie/src/File.php (modified) (9 diffs)

trunk/src/wp-includes/SimplePie/src/File.php

@@ -1 +1 @@
 <?php
 
-/**
- * SimplePie
- *
- * A PHP-Based RSS and Atom Feed Framework.
- * Takes the hard work out of managing a complete RSS/Atom solution.
- *
- * Copyright (c) 2004-2022, Ryan Parman, Sam Sneddon, Ryan McCue, and contributors
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without modification, are
- * permitted provided that the following conditions are met:
- *
- *  * Redistributions of source code must retain the above copyright notice, this list of
- *    conditions and the following disclaimer.
- *
- *  * Redistributions in binary form must reproduce the above copyright notice, this list
- *    of conditions and the following disclaimer in the documentation and/or other materials
- *    provided with the distribution.
- *
- *  * Neither the name of the SimplePie Team nor the names of its contributors may be used
- *    to endorse or promote products derived from this software without specific prior
- *    written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS
- * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS
- * AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- *
- * @package SimplePie
- * @copyright 2004-2016 Ryan Parman, Sam Sneddon, Ryan McCue
- * @author Ryan Parman
- * @author Sam Sneddon
- * @author Ryan McCue
- * @link http://simplepie.org/ SimplePie
- * @license http://www.opensource.org/licenses/bsd-license.php BSD License
- */
+// SPDX-FileCopyrightText: 2004-2023 Ryan Parman, Sam Sneddon, Ryan McCue
+// SPDX-License-Identifier: BSD-3-Clause
+
+declare(strict_types=1);
 
 namespace SimplePie;
+
+use SimplePie\HTTP\Response;
 
 /**
@@ -52 +17 @@
  * This class can be overloaded with {@see \SimplePie\SimplePie::set_file_class()}
  *
- * @package SimplePie
- * @subpackage HTTP
  * @todo Move to properly supporting RFC2616 (HTTP/1.1)
  */
-class File
+class File implements Response
 {
+    /**
+     * @var string The final URL after following all redirects
+     * @deprecated Use `get_final_requested_uri()` method.
+     */
     public $url;
+
+    /**
+     * @var ?string User agent to use in requests
+     * @deprecated Set the user agent in constructor.
+     */
     public $useragent;
+
+    /** @var bool */
     public $success = true;
+
+    /** @var array<string, non-empty-array<string>> Canonical representation of headers */
+    private $parsed_headers = [];
+    /** @var array<string, string> Last known value of $headers property (used to detect external modification) */
+    private $last_headers = [];
+    /**
+     * @var array<string, string> Headers as string for BC
+     * @deprecated Use `get_headers()` method.
+     */
     public $headers = [];
+
+    /**
+     * @var ?string Body of the HTTP response
+     * @deprecated Use `get_body_content()` method.
+     */
     public $body;
+
+    /**
+     * @var int Status code of the HTTP response
+     * @deprecated Use `get_status_code()` method.
+     */
     public $status_code = 0;
+
+    /** @var non-negative-int Number of redirect that were already performed during this request sequence. */
     public $redirects = 0;
+
+    /** @var ?string */
     public $error;
+
+    /**
+     * @var int-mask-of<SimplePie::FILE_SOURCE_*> Bit mask representing the method used to fetch the file and whether it is a local file or remote file obtained over HTTP.
+     * @deprecated Backend is implementation detail which you should not care about; to see if the file was retrieved over HTTP, check if `get_final_requested_uri()` with `Misc::is_remote_uri()`.
+     */
     public $method = \SimplePie\SimplePie::FILE_SOURCE_NONE;
+
+    /**
+     * @var string The permanent URL or the resource (first URL after the prefix of (only) permanent redirects)
+     * @deprecated Use `get_permanent_uri()` method.
+     */
     public $permanent_url;
-
-    public function __construct($url, $timeout = 10, $redirects = 5, $headers = null, $useragent = null, $force_fsockopen = false, $curl_options = [])
-    {
-        if (class_exists('idna_convert')) {
-            $idn = new \idna_convert();
+    /** @var bool Whether the permanent URL is still writeable (prefix of permanent redirects has not ended) */
+    private $permanentUrlMutable = true;
+
+    /**
+     * @param string $url
+     * @param int $timeout
+     * @param int $redirects
+     * @param ?array<string, string> $headers
+     * @param ?string $useragent
+     * @param bool $force_fsockopen
+     * @param array<int, mixed> $curl_options
+     */
+    public function __construct(string $url, int $timeout = 10, int $redirects = 5, ?array $headers = null, ?string $useragent = null, bool $force_fsockopen = false, array $curl_options = [])
+    {
+        if (function_exists('idn_to_ascii')) {
             $parsed = \SimplePie\Misc::parse_url($url);
-            $url = \SimplePie\Misc::compress_parse_url($parsed['scheme'], $idn->encode($parsed['authority']), $parsed['path'], $parsed['query'], null);
+            if ($parsed['authority'] !== '' && !ctype_print($parsed['authority'])) {
+                $authority = (string) \idn_to_ascii($parsed['authority'], \IDNA_NONTRANSITIONAL_TO_ASCII, \INTL_IDNA_VARIANT_UTS46);
+                $url = \SimplePie\Misc::compress_parse_url($parsed['scheme'], $authority, $parsed['path'], $parsed['query'], null);
+            }
         }
         $this->url = $url;
-        $this->permanent_url = $url;
+        if ($this->permanentUrlMutable) {
+            $this->permanent_url = $url;
+        }
         $this->useragent = $useragent;
         if (preg_match('/^http(s)?:\/\//i', $url)) {
             if ($useragent === null) {
-                $useragent = ini_get('user_agent');
+                $useragent = (string) ini_get('user_agent');
                 $this->useragent = $useragent;
             }
@@ -94 +116 @@
                     $headers2[] = "$key: $value";
                 }
+                if (isset($curl_options[CURLOPT_HTTPHEADER])) {
+                    if (is_array($curl_options[CURLOPT_HTTPHEADER])) {
+                        $headers2 = array_merge($headers2, $curl_options[CURLOPT_HTTPHEADER]);
+                    }
+                    unset($curl_options[CURLOPT_HTTPHEADER]);
+                }
                 if (version_compare(\SimplePie\Misc::get_curl_version(), '7.10.5', '>=')) {
                     curl_setopt($fp, CURLOPT_ENCODING, '');
@@ -110 +138 @@
                 }
 
-                $this->headers = curl_exec($fp);
-                if (curl_errno($fp) === 23 || curl_errno($fp) === 61) {
+                $responseHeaders = curl_exec($fp);
+                if (curl_errno($fp) === CURLE_WRITE_ERROR || curl_errno($fp) === CURLE_BAD_CONTENT_ENCODING) {
                     curl_setopt($fp, CURLOPT_ENCODING, 'none');
-                    $this->headers = curl_exec($fp);
+                    $responseHeaders = curl_exec($fp);
                 }
                 $this->status_code = curl_getinfo($fp, CURLINFO_HTTP_CODE);
@@ -124 +152 @@
                         $this->url = $info['url'];
                     }
-                    curl_close($fp);
-                    $this->headers = \SimplePie\HTTP\Parser::prepareHeaders($this->headers, $info['redirect_count'] + 1);
-                    $parser = new \SimplePie\HTTP\Parser($this->headers);
+                    // For PHPStan: We already checked that error did not occur.
+                    assert(is_array($info) && $info['redirect_count'] >= 0);
+                    if (\PHP_VERSION_ID < 80000) {
+                        curl_close($fp);
+                    }
+                    $responseHeaders = \SimplePie\HTTP\Parser::prepareHeaders((string) $responseHeaders, $info['redirect_count'] + 1);
+                    $parser = new \SimplePie\HTTP\Parser($responseHeaders, true);
                     if ($parser->parse()) {
-                        $this->headers = $parser->headers;
-                        $this->body = trim($parser->body);
+                        $this->set_headers($parser->headers);
+                        $this->body = $parser->body;
                         $this->status_code = $parser->status_code;
-                        if ((in_array($this->status_code, [300, 301, 302, 303, 307]) || $this->status_code > 307 && $this->status_code < 400) && isset($this->headers['location']) && $this->redirects < $redirects) {
+                        if ((in_array($this->status_code, [300, 301, 302, 303, 307]) || $this->status_code > 307 && $this->status_code < 400) && ($locationHeader = $this->get_header_line('location')) !== '' && $this->redirects < $redirects) {
                             $this->redirects++;
-                            $location = \SimplePie\Misc::absolutize_url($this->headers['location'], $url);
-                            $previousStatusCode = $this->status_code;
+                            $location = \SimplePie\Misc::absolutize_url($locationHeader, $url);
+                            if ($location === false) {
+                                $this->error = "Invalid redirect location, trying to base “{$locationHeader}” onto “{$url}”";
+                                $this->success = false;
+                                return;
+                            }
+                            $this->permanentUrlMutable = $this->permanentUrlMutable && ($this->status_code == 301 || $this->status_code == 308);
                             $this->__construct($location, $timeout, $redirects, $headers, $useragent, $force_fsockopen, $curl_options);
-                            $this->permanent_url = ($previousStatusCode == 301) ? $location : $url;
                             return;
                         }
@@ -143 +179 @@
             } else {
                 $this->method = \SimplePie\SimplePie::FILE_SOURCE_REMOTE | \SimplePie\SimplePie::FILE_SOURCE_FSOCKOPEN;
-                $url_parts = parse_url($url);
+                if (($url_parts = parse_url($url)) === false) {
+                    throw new \InvalidArgumentException('Malformed URL: ' . $url);
+                }
+                if (!isset($url_parts['host'])) {
+                    throw new \InvalidArgumentException('Missing hostname: ' . $url);
+                }
                 $socket_host = $url_parts['host'];
                 if (isset($url_parts['scheme']) && strtolower($url_parts['scheme']) === 'https') {
-                    $socket_host = "ssl://$url_parts[host]";
+                    $socket_host = 'ssl://' . $socket_host;
                     $url_parts['port'] = 443;
                 }
@@ -185 +226 @@
                     $info = stream_get_meta_data($fp);
 
-                    $this->headers = '';
+                    $responseHeaders = '';
                     while (!$info['eof'] && !$info['timed_out']) {
-                        $this->headers .= fread($fp, 1160);
+                        $responseHeaders .= fread($fp, 1160);
                         $info = stream_get_meta_data($fp);
                     }
                     if (!$info['timed_out']) {
-                        $parser = new \SimplePie\HTTP\Parser($this->headers);
+                        $parser = new \SimplePie\HTTP\Parser($responseHeaders, true);
                         if ($parser->parse()) {
-                            $this->headers = $parser->headers;
+                            $this->set_headers($parser->headers);
                             $this->body = $parser->body;
                             $this->status_code = $parser->status_code;
-                            if ((in_array($this->status_code, [300, 301, 302, 303, 307]) || $this->status_code > 307 && $this->status_code < 400) && isset($this->headers['location']) && $this->redirects < $redirects) {
+                            if ((in_array($this->status_code, [300, 301, 302, 303, 307]) || $this->status_code > 307 && $this->status_code < 400) && ($locationHeader = $this->get_header_line('location')) !== '' && $this->redirects < $redirects) {
                                 $this->redirects++;
-                                $location = \SimplePie\Misc::absolutize_url($this->headers['location'], $url);
-                                $previousStatusCode = $this->status_code;
+                                $location = \SimplePie\Misc::absolutize_url($locationHeader, $url);
+                                $this->permanentUrlMutable = $this->permanentUrlMutable && ($this->status_code == 301 || $this->status_code == 308);
+                                if ($location === false) {
+                                    $this->error = "Invalid redirect location, trying to base “{$locationHeader}” onto “{$url}”";
+                                    $this->success = false;
+                                    return;
+                                }
                                 $this->__construct($location, $timeout, $redirects, $headers, $useragent, $force_fsockopen, $curl_options);
-                                $this->permanent_url = ($previousStatusCode == 301) ? $location : $url;
                                 return;
                             }
-                            if (isset($this->headers['content-encoding'])) {
+                            if (($contentEncodingHeader = $this->get_header_line('content-encoding')) !== '') {
                                 // Hey, we act dumb elsewhere, so let's do that here too
-                                switch (strtolower(trim($this->headers['content-encoding'], "\x09\x0A\x0D\x20"))) {
+                                switch (strtolower(trim($contentEncodingHeader, "\x09\x0A\x0D\x20"))) {
                                     case 'gzip':
                                     case 'x-gzip':
-                                        $decoder = new \SimplePie\Gzdecode($this->body);
-                                        if (!$decoder->parse()) {
+                                        if (($decompressed = gzdecode($this->body)) === false) {
                                             $this->error = 'Unable to decode HTTP "gzip" stream';
                                             $this->success = false;
                                         } else {
-                                            $this->body = trim($decoder->data);
+                                            $this->body = $decompressed;
                                         }
                                         break;
@@ -223 +267 @@
                                         } elseif (($decompressed = gzuncompress($this->body)) !== false) {
                                             $this->body = $decompressed;
-                                        } elseif (function_exists('gzdecode') && ($decompressed = gzdecode($this->body)) !== false) {
+                                        } elseif (($decompressed = gzdecode($this->body)) !== false) {
                                             $this->body = $decompressed;
                                         } else {
@@ -246 +290 @@
         } else {
             $this->method = \SimplePie\SimplePie::FILE_SOURCE_LOCAL | \SimplePie\SimplePie::FILE_SOURCE_FILE_GET_CONTENTS;
-            if (empty($url) || !($this->body = trim(file_get_contents($url)))) {
-                $this->error = 'file_get_contents could not read the file';
+            if (empty($url) || !is_readable($url) ||  false === $filebody = file_get_contents($url)) {
+                $this->body = '';
+                $this->error = sprintf('file "%s" is not readable', $url);
                 $this->success = false;
+            } else {
+                $this->body = $filebody;
+                $this->status_code = 200;
             }
         }
+        if ($this->success) {
+            assert($this->body !== null); // For PHPStan
+            // Leading whitespace may cause XML parsing errors (XML declaration cannot be preceded by anything other than BOM) so we trim it.
+            // Note that unlike built-in `trim` function’s default settings, we do not trim `\x00` to avoid breaking characters in UTF-16 or UTF-32 encoded strings.
+            // We also only do that when the whitespace is followed by `<`, so that we do not break e.g. UTF-16LE encoded whitespace like `\n\x00` in half.
+            $this->body = preg_replace('/^[ \n\r\t\v]+</', '<', $this->body);
+        }
+    }
+
+    public function get_permanent_uri(): string
+    {
+        return (string) $this->permanent_url;
+    }
+
+    public function get_final_requested_uri(): string
+    {
+        return (string) $this->url;
+    }
+
+    public function get_status_code(): int
+    {
+        return (int) $this->status_code;
+    }
+
+    public function get_headers(): array
+    {
+        $this->maybe_update_headers();
+        return $this->parsed_headers;
+    }
+
+    public function has_header(string $name): bool
+    {
+        $this->maybe_update_headers();
+        return $this->get_header($name) !== [];
+    }
+
+    public function get_header(string $name): array
+    {
+        $this->maybe_update_headers();
+        return $this->parsed_headers[strtolower($name)] ?? [];
+    }
+
+    public function with_header(string $name, $value)
+    {
+        $this->maybe_update_headers();
+        $new = clone $this;
+
+        $newHeader = [
+            strtolower($name) => (array) $value,
+        ];
+        $new->set_headers($newHeader + $this->get_headers());
+
+        return $new;
+    }
+
+    public function get_header_line(string $name): string
+    {
+        $this->maybe_update_headers();
+        return implode(', ', $this->get_header($name));
+    }
+
+    public function get_body_content(): string
+    {
+        return (string) $this->body;
+    }
+
+    /**
+     * Check if the $headers property was changed and update the internal state accordingly.
+     */
+    private function maybe_update_headers(): void
+    {
+        if ($this->headers !== $this->last_headers) {
+            $this->parsed_headers = array_map(
+                function (string $header_line): array {
+                    if (strpos($header_line, ',') === false) {
+                        return [$header_line];
+                    } else {
+                        return array_map('trim', explode(',', $header_line));
+                    }
+                },
+                $this->headers
+            );
+        }
+        $this->last_headers = $this->headers;
+    }
+
+    /**
+     * Sets headers internally.
+     *
+     * @param array<string, non-empty-array<string>> $headers
+     */
+    private function set_headers(array $headers): void
+    {
+        $this->parsed_headers = $headers;
+        $this->headers = self::flatten_headers($headers);
+        $this->last_headers = $this->headers;
+    }
+
+    /**
+     * Converts PSR-7 compatible headers into a legacy format.
+     *
+     * @param array<string, non-empty-array<string>> $headers
+     *
+     * @return array<string, string>
+     */
+    private function flatten_headers(array $headers): array
+    {
+        return array_map(function (array $values): string {
+            return implode(',', $values);
+        }, $headers);
+    }
+
+    /**
+     * Create a File instance from another Response
+     *
+     * For BC reasons in some places there MUST be a `File` instance
+     * instead of a `Response` implementation
+     *
+     * @see Locator::__construct()
+     * @internal
+     */
+    final public static function fromResponse(Response $response): self
+    {
+        $headers = [];
+
+        foreach ($response->get_headers() as $name => $header) {
+            $headers[$name] = implode(', ', $header);
+        }
+
+        /** @var File */
+        $file = (new \ReflectionClass(File::class))->newInstanceWithoutConstructor();
+
+        $file->url = $response->get_final_requested_uri();
+        $file->useragent = null;
+        $file->headers = $headers;
+        $file->body = $response->get_body_content();
+        $file->status_code = $response->get_status_code();
+        $file->permanent_url = $response->get_permanent_uri();
+
+        return $file;
     }
 }