class TemporaryFiles in Security Review 8

Check for sensitive temporary files like settings.php~.

Hierarchy

• class \Drupal\security_review\Check uses DependencySerializationTrait, StringTranslationTrait
  • class \Drupal\security_review\Checks\TemporaryFiles

1 file declares its use of TemporaryFiles

security_review.module in ./security_review.module

Site security review and reporting Drupal module.

File

src/Checks/TemporaryFiles.php, line 11

Namespace

Drupal\security_review\Checks

class TemporaryFiles extends Check {

  /**
   * {@inheritdoc}
   */
  public function getNamespace() {
    return 'Security Review';
  }

  /**
   * {@inheritdoc}
   */
  public function getTitle() {
    return 'Temporary files';
  }

  /**
   * {@inheritdoc}
   */
  public function run() {
    $result = CheckResult::SUCCESS;
    $findings = [];

    // Get list of files from the site directory.
    $files = [];
    $site_path = $this
      ->security()
      ->sitePath() . '/';
    $dir = scandir($site_path);
    foreach ($dir as $file) {

      // Set full path to only files.
      if (!is_dir($file)) {
        $files[] = $site_path . $file;
      }
    }
    $this
      ->moduleHandler()
      ->alter('security_review_temporary_files', $files);

    // Analyze the files' names.
    foreach ($files as $path) {
      $matches = [];
      if (file_exists($path) && preg_match('/.*(~|\\.sw[op]|\\.bak|\\.orig|\\.save)$/', $path, $matches) !== FALSE && !empty($matches)) {

        // Found a temporary file.
        $findings[] = $path;
      }
    }
    if (!empty($findings)) {
      $result = CheckResult::FAIL;
    }
    return $this
      ->createResult($result, $findings);
  }

  /**
   * {@inheritdoc}
   */
  public function help() {
    $paragraphs = [];
    $paragraphs[] = $this
      ->t("Some file editors create temporary copies of a file that can be left on the file system. A copy of a sensitive file like Drupal's settings.php may be readable by a malicious user who could use that information to further attack a site.");
    return [
      '#theme' => 'check_help',
      '#title' => $this
        ->t('Sensitive temporary files'),
      '#paragraphs' => $paragraphs,
    ];
  }

  /**
   * {@inheritdoc}
   */
  public function evaluate(CheckResult $result) {
    $findings = $result
      ->findings();
    if (empty($findings)) {
      return [];
    }
    $paragraphs = [];
    $paragraphs[] = $this
      ->t("The following are extraneous files in your Drupal installation that can probably be removed. You should confirm you have saved any of your work in the original files prior to removing these.");
    return [
      '#theme' => 'check_evaluation',
      '#paragraphs' => $paragraphs,
      '#items' => $findings,
    ];
  }

  /**
   * {@inheritdoc}
   */
  public function evaluatePlain(CheckResult $result) {
    $findings = $result
      ->findings();
    if (empty($findings)) {
      return '';
    }
    $output = $this
      ->t('Temporary files:') . "\n";
    foreach ($findings as $file) {
      $output .= "\t" . $file . "\n";
    }
    return $output;
  }

  /**
   * {@inheritdoc}
   */
  public function getMessage($result_const) {
    switch ($result_const) {
      case CheckResult::SUCCESS:
        return $this
          ->t('No sensitive temporary files were found.');
      case CheckResult::FAIL:
        return $this
          ->t('Sensitive temporary files were found on your files system.');
      default:
        return $this
          ->t('Unexpected result.');
    }
  }

}

Members

Name	Modifiers	Type	Description	Overrides
Check::$config	protected	property	The configuration storage for this check.
Check::$container	protected	property	The service container.
Check::$settings	protected	property	Settings handler for this check.
Check::$state	protected	property	The State system.
Check::$statePrefix	protected	property	The check's prefix in the State system.
Check::checklist	protected	function	Returns the Security Review Checklist service.
Check::configFactory	protected	function	Returns the Config factory.
Check::container	protected	function	Returns the service container.
Check::createResult	public	function	Creates a new CheckResult for this Check.
Check::currentUser	protected	function	Returns the current Drupal user.
Check::database	protected	function	Returns the database connection.
Check::enable	public	function	Enables the check. Has no effect if the check was not skipped.
Check::entityTypeManager	protected	function	Returns the entity type manager.
Check::getMachineNamespace	public	function	Returns the namespace of the check.
Check::getMachineTitle	public	function	Returns the machine name of the check.	5
Check::id	final public	function	Returns the identifier constructed using the namespace and title values.
Check::isSkipped	public	function	Returns whether the check is skipped. Checks are not skipped by default.
Check::kernel	protected	function	Returns the Drupal Kernel.
Check::lastResult	public	function	Returns the last stored result of the check.
Check::lastRun	public	function	Returns the timestamp the check was last run.
Check::moduleHandler	protected	function	Returns the module handler.
Check::runCli	public	function	Same as run(), but used in CLI context such as Drush.	2
Check::security	protected	function	Returns the Security Review Security service.
Check::securityReview	protected	function	Returns the Security Review service.
Check::settings	public	function	Returns the check-specific settings' handler.
Check::skip	public	function	Marks the check as skipped.
Check::skippedBy	public	function	Returns the user the check was skipped by.
Check::skippedOn	public	function	Returns the timestamp the check was last skipped on.
Check::storeResult	public	function	Stores a result in the state system.
Check::storesFindings	public	function	Returns whether the findings should be stored or reproduced when needed.	2
Check::__construct	public	function	Initializes the configuration storage and the settings handler.	2
DependencySerializationTrait::$_entityStorages	protected	property	An array of entity type IDs keyed by the property name of their storages.
DependencySerializationTrait::$_serviceIds	protected	property	An array of service IDs keyed by property name used for serialization.
DependencySerializationTrait::__sleep	public	function		1
DependencySerializationTrait::__wakeup	public	function		2
StringTranslationTrait::$stringTranslation	protected	property	The string translation service.	1
StringTranslationTrait::formatPlural	protected	function	Formats a string containing a count of items.
StringTranslationTrait::getNumberOfPlurals	protected	function	Returns the number of plurals supported by a given language.
StringTranslationTrait::getStringTranslation	protected	function	Gets the string translation service.
StringTranslationTrait::setStringTranslation	public	function	Sets the string translation service to use.	2
StringTranslationTrait::t	protected	function	Translates a string to the current language or to a given language.
TemporaryFiles::evaluate	public	function	Returns the evaluation page of a result. Overrides Check::evaluate
TemporaryFiles::evaluatePlain	public	function	Evaluates a CheckResult and returns a plaintext output. Overrides Check::evaluatePlain
TemporaryFiles::getMessage	public	function	Converts a result integer to a human-readable result message. Overrides Check::getMessage
TemporaryFiles::getNamespace	public	function	Returns the namespace of the check. Overrides Check::getNamespace
TemporaryFiles::getTitle	public	function	Returns the human-readable title of the check. Overrides Check::getTitle
TemporaryFiles::help	public	function	Returns the check-specific help page. Overrides Check::help
TemporaryFiles::run	public	function	The actual procedure of carrying out the check. Overrides Check::run