use modern string checks for readality

kudos @rugk

bin/configuration-test-generator

@@ -387,7 +387,7 @@ class ConfigurationTestGenerator
                         }
                         $args = array();
                         foreach ($test['args'] as $arg) {
-                            if (is_string($arg) && strpos($arg, '$') === 0) {
+                            if (is_string($arg) && str_starts_with($arg, '$')) {
                                 $args[] = $arg;
                             } else {
                                 $args[] = Helper::varExportMin($arg, true);

js/privatebin.js

@@ -503,12 +503,8 @@ jQuery.PrivateBin = (function($) {
             const name = cname + '=',
                   ca   = document.cookie.split(';');
             for (let i = 0; i < ca.length; ++i) {
-                let c = ca[i];
-                while (c.charAt(0) === ' ')
-                {
-                    c = c.substring(1);
-                }
-                if (c.indexOf(name) === 0)
+                let c = ca[i].trim();
+                if (c.startsWith(name))
                 {
                     return c.substring(name.length, c.length);
                 }
@@ -920,15 +916,15 @@ jQuery.PrivateBin = (function($) {
             // auto-select language based on browser settings
             if (newLanguage.length === 0) {
                 newLanguage = (navigator.language || navigator.userLanguage || 'en').toLowerCase();
-                const isTraditionalChinese = newLanguage.indexOf('zh-tw-') === 0 ||
-                    newLanguage === 'zh-hant' || newLanguage.indexOf('zh-hant-') === 0 ||
-                    newLanguage === 'zh-hk' || newLanguage.indexOf('zh-hk-') === 0 ||
-                    newLanguage === 'zh-mo' || newLanguage.indexOf('zh-mo-') === 0;
+                const isTraditionalChinese = newLanguage.startsWith('zh-tw-') ||
+                    newLanguage === 'zh-hant' || newLanguage.startsWith('zh-hant-') ||
+                    newLanguage === 'zh-hk' || newLanguage.startsWith('zh-hk-') ||
+                    newLanguage === 'zh-mo' || newLanguage.startsWith('zh-mo-');
                 // alias Traditional Chinese browser tags to PrivateBin's zh-tw locale;
                 // otherwise try the full tag and fall back to the base language
-                if (isTraditionalChinese && supportedLanguages.indexOf('zh-tw') !== -1) {
+                if (isTraditionalChinese && supportedLanguages.includes('zh-tw')) {
                     newLanguage = 'zh-tw';
-                } else if (supportedLanguages.indexOf(newLanguage) === -1 && newLanguage.indexOf('-') > 0) {
+                } else if (!supportedLanguages.includes(newLanguage) && newLanguage.includes('-')) {
                     newLanguage = newLanguage.split('-')[0];
                 }
             }
@@ -945,7 +941,7 @@ jQuery.PrivateBin = (function($) {
             }
 
             // if language is not supported, show error
-            if (supportedLanguages.indexOf(newLanguage) === -1) {
+            if (!supportedLanguages.includes(newLanguage)) {
                 console.error('Language \'%s\' is not supported. Translation failed, fallback to English.', newLanguage);
                 language = 'en';
                 return;
@@ -987,7 +983,7 @@ jQuery.PrivateBin = (function($) {
         function isStringContainsHtml(messageId) {
             // message IDs are allowed to contain anchors, spans, keyboard and emphasis tags
             // we can recognize all of them by only checking for anchors and keyboard tags
-            return messageId.indexOf('<a') !== -1 || messageId.indexOf('<kbd') !== -1;
+            return messageId.includes('<a') || messageId.includes('<kbd');
         }
 
         return me;
@@ -1532,7 +1528,7 @@ jQuery.PrivateBin = (function($) {
          */
         me.hasDeleteToken = function()
         {
-            return window.location.search.indexOf('deletetoken') !== -1;
+            return window.location.search.includes('deletetoken');
         }
 
         /**
@@ -3052,7 +3048,7 @@ jQuery.PrivateBin = (function($) {
          * Evaluates whether this is known a safe mime type.
          *
          * This means, the media can safely be displayed and e.g. no XSS should be possible.
-         * 
+         *
          * @name AttachmentViewer.isSafeMimeType
          * @function
          * @param {string}
@@ -3060,7 +3056,7 @@ jQuery.PrivateBin = (function($) {
          */
         me.isSafeMimeType = function(mimeType) {
             return (
-                    mimeType.startsWith('image/') && 
+                    mimeType.startsWith('image/') &&
                     !mimeType.includes('svg')
                 ) ||
                 mimeType.startsWith('video/') ||
@@ -3253,6 +3249,9 @@ jQuery.PrivateBin = (function($) {
         {
             // position in data URI string of where mimeType ends
             const mimeTypeEnd = attachmentData.indexOf(';');
+            if (mimeTypeEnd < 6) {
+                return '';
+            }
 
             // extract mimeType
             return attachmentData.substring(5, mimeTypeEnd);

lib/Configuration.php

@@ -122,7 +122,7 @@ class Configuration
             'js/kjua-0.10.0.js'      => 'sha512-BYj4xggowR7QD150VLSTRlzH62YPfhpIM+b/1EUEr7RQpdWAGKulxWnOvjFx1FUlba4m6ihpNYuQab51H6XlYg==',
             'js/legacy.js'           => 'sha512-RQEo1hxpNc37i+jz/D9/JiAZhG8GFx3+SNxjYnI7jUgirDIqrCSj6QPAAZeaidditcWzsJ3jxfEj5lVm7ZwTRQ==',
             'js/prettify.js'         => 'sha512-puO0Ogy++IoA2Pb9IjSxV1n4+kQkKXYAEUtVzfZpQepyDPyXk8hokiYDS7ybMogYlyyEIwMLpZqVhCkARQWLMg==',
-            'js/privatebin.js'       => 'sha512-g58rPgrKnvxBDnT6lzYazdEfgY3XhRh7Yt7i1jkJw4oSvN0k/VPZ4zBSL/dCGfXGIOHqlqmX8DO5UFv2XYqsXg==',
+            'js/privatebin.js'       => 'sha512-fa2UoOt+JCzAUZ/VwN5zIwI/ZZKReP9eHl1mrSvhVYPq6Q2tqHItMKm5Ic9YJasOUMGQHlevAPYokzKFbIbAAw==',
             'js/purify-3.4.12.js'    => 'sha512-Akf6HnAJZm0sWWWI4gp2GYff0NDnHUB02XJE5S7Hdq/Z5xtMjkuFacsDA8ZtViv1gi+onBxMhEMIaGyQeGxBng==',
             'js/showdown-2.1.0.js'   => 'sha512-WYXZgkTR0u/Y9SVIA4nTTOih0kXMEd8RRV6MLFdL6YU8ymhR528NLlYQt1nlJQbYz4EW+ZsS0fx1awhiQJme1Q==',
             'js/zlib-1.3.2.js'       => 'sha512-RAhJgxg9siMIA8ky4c10Rc2zUgnK80olHB8Tt1IOYWY4Eh1WmrviQkDn+sgBlb38ZHq3tzufGC41kP360gmosQ==',

lib/I18n.php

@@ -269,13 +269,13 @@ class I18n
         $hasTraditionalChinese = in_array('zh-tw', $availableLanguages, true);
         foreach ($languages as $quality => $languageRanges) {
             foreach ($languageRanges as $index => $languageRange) {
-                $isSimplifiedChinese = $languageRange === 'zh-hans' || strpos($languageRange, 'zh-hans-') === 0 ||
-                    $languageRange === 'zh-cn' || strpos($languageRange, 'zh-cn-') === 0 ||
-                    $languageRange === 'zh-sg' || strpos($languageRange, 'zh-sg-') === 0;
-                $isTraditionalChinese = strpos($languageRange, 'zh-tw-') === 0 ||
-                    $languageRange === 'zh-hant' || strpos($languageRange, 'zh-hant-') === 0 ||
-                    $languageRange === 'zh-hk' || strpos($languageRange, 'zh-hk-') === 0 ||
-                    $languageRange === 'zh-mo' || strpos($languageRange, 'zh-mo-') === 0;
+                $isSimplifiedChinese = $languageRange === 'zh-hans' || str_starts_with($languageRange, 'zh-hans-') ||
+                    $languageRange === 'zh-cn' || str_starts_with($languageRange, 'zh-cn-') ||
+                    $languageRange === 'zh-sg' || str_starts_with($languageRange, 'zh-sg-');
+                $isTraditionalChinese = str_starts_with($languageRange, 'zh-tw-') ||
+                    $languageRange === 'zh-hant' || str_starts_with($languageRange, 'zh-hant-') ||
+                    $languageRange === 'zh-hk' || str_starts_with($languageRange, 'zh-hk-') ||
+                    $languageRange === 'zh-mo' || str_starts_with($languageRange, 'zh-mo-');
                 if ($hasSimplifiedChinese && $isSimplifiedChinese) {
                     $languages[$quality][$index] = 'zh';
                 } elseif ($hasTraditionalChinese && $isTraditionalChinese) {
@@ -343,8 +343,8 @@ class I18n
      */
     public static function getCopyHotkey()
     {
-        return isset($_SERVER['HTTP_USER_AGENT']) &&
-            strpos($_SERVER['HTTP_USER_AGENT'], 'Mac') !== false ? self::_('Cmd') : self::_('Ctrl');
+        return array_key_exists('HTTP_USER_AGENT', $_SERVER) &&
+            str_contains($_SERVER['HTTP_USER_AGENT'], 'Mac') ? self::_('Cmd') : self::_('Ctrl');
     }
 
     /**

tst/I18nTest.php

@@ -216,8 +216,8 @@ class I18nTest extends TestCase
         // For example, the French translation should not have the apostrophe encoded
         // See https://github.com/PrivateBin/PrivateBin/issues/1712
         $message = I18n::_('Document does not exist, has expired or has been deleted.');
-        $this->assertFalse(strpos($message, ''') !== false, 'French apostrophe should not be encoded in translation message');
-        $this->assertTrue(strpos($message, "n'existe") !== false, 'French apostrophe should be present as literal character');
+        $this->assertFalse(str_contains($message, '''), 'French apostrophe should not be encoded in translation message');
+        $this->assertTrue(str_contains($message, "n'existe"), 'French apostrophe should be present as literal character');
     }
 
     public function testFallbackAlwaysPresent()