public function Field::run in Security Review 8

The actual procedure of carrying out the check.

Return value

\Drupal\security_review\CheckResult The result of running the check.

Overrides Check::run

File

src/Checks/Field.php, line 40

Class

Field

Checks for Javascript and PHP in submitted content.

Namespace

Drupal\security_review\Checks

Code

public function run() {
  $result = CheckResult::SUCCESS;
  $findings = [];
  $field_types = [
    'text_with_summary',
    'text_long',
  ];
  $tags = [
    'Javascript' => 'script',
    'PHP' => '?php',
  ];

  /** @var \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager */
  $entity_type_manager = \Drupal::service('entity_type.manager');

  /** @var \Drupal\Core\Entity\EntityFieldManagerInterface $field_manager */
  $field_manager = \Drupal::service('entity_field.manager');
  foreach ($field_manager
    ->getFieldMap() as $entity_type_id => $fields) {
    $field_storage_definitions = $field_manager
      ->getFieldStorageDefinitions($entity_type_id);
    foreach ($fields as $field_name => $field) {
      if (!isset($field_storage_definitions[$field_name])) {
        continue;
      }
      $field_storage_definition = $field_storage_definitions[$field_name];
      if (in_array($field_storage_definition
        ->getType(), $field_types)) {
        if ($field_storage_definition instanceof FieldStorageConfig) {
          $table = $entity_type_id . '__' . $field_name;
          $separator = '_';
          $id = 'entity_id';
        }
        else {
          $entity = $entity_type_manager
            ->getStorage($entity_type_id)
            ->getEntityType();
          $translatable = $entity
            ->isTranslatable();
          $table = '';
          if ($translatable) {
            $table = $entity
              ->getDataTable() ?: $entity_type_id . '_field_data';
          }
          else {
            $table = $entity
              ->getBaseTable() ?: $entity_type_id;
          }
          $separator = '__';
          $id = $entity
            ->getKey('id');
        }
        $rows = \Drupal::database()
          ->select($table, 't')
          ->fields('t')
          ->execute()
          ->fetchAll();
        foreach ($rows as $row) {
          foreach (array_keys($field_storage_definition
            ->getSchema()['columns']) as $column) {
            $column_name = $field_name . $separator . $column;
            foreach ($tags as $vulnerability => $tag) {
              if (strpos($row->{$column_name}, '<' . $tag) !== FALSE) {

                // Vulnerability found.
                $findings[$entity_type_id][$row->{$id}][$field_name][] = $vulnerability;
              }
            }
          }
        }
      }
    }
  }
  if (!empty($findings)) {
    $result = CheckResult::FAIL;
  }
  return $this
    ->createResult($result, $findings);
}