Skip to content

Commit 11ffca1

Browse files
committed
Fix MakeViewVariableOptionalSolution to disallow stream wrappers and files that do not end in .blade.php
This is already fixed in 2.5.2, See #334 I could not update to 2.5.2 due to some dependent package required php 7.3, currently clients site is running in php 7.2 On branch 2.4.1-branch Changes to be committed: modified: src/Solutions/MakeViewVariableOptionalSolution.php
1 parent 9fc6c3d commit 11ffca1

1 file changed

Lines changed: 18 additions & 0 deletions

File tree

src/Solutions/MakeViewVariableOptionalSolution.php

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
use Facade\IgnitionContracts\RunnableSolution;
66
use Illuminate\Support\Facades\Blade;
7+
use Illuminate\Support\Str;
78

89
class MakeViewVariableOptionalSolution implements RunnableSolution
910
{
@@ -70,8 +71,25 @@ public function run(array $parameters = [])
7071
}
7172
}
7273

74+
protected function isSafePath(string $path): bool
75+
{
76+
if (!Str::startsWith($path, ['/', './'])) {
77+
return false;
78+
}
79+
80+
if (!Str::endsWith($path, '.blade.php')) {
81+
return false;
82+
}
83+
84+
return true;
85+
}
86+
7387
public function makeOptional(array $parameters = [])
7488
{
89+
if (!$this->isSafePath($parameters['viewFile'])) {
90+
return false;
91+
}
92+
7593
$originalContents = file_get_contents($parameters['viewFile']);
7694
$newContents = str_replace('$'.$parameters['variableName'], '$'.$parameters['variableName']." ?? ''", $originalContents);
7795

0 commit comments

Comments
 (0)