Merge pull request #1763 from PrivateBin/linter-ai-findings

Linter AI findings

bin/configuration-test-generator

@@ -517,7 +517,7 @@ EOT;
 EOT;
                 }
                 $code .= PHP_EOL . <<<'EOT'
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';

doc/Installation.md

@@ -110,7 +110,7 @@ file is divided into multiple sections, which are enclosed in square brackets.
 
 In the `[main]` section you can enable or disable the discussion feature, set
 the limit of stored pastes and comments in bytes. The `[traffic]` section lets
-you set a time limit in seconds. Users may not post more often then this limit
+you set a time limit in seconds. Users may not post more often than this limit
 to your PrivateBin installation.
 
 More details can be found in the
@@ -120,13 +120,14 @@ More details can be found in the
 
 ### Web server configuration
 
-A `robots.txt` file is provided in the root dir of PrivateBin. It requests bots to
-not access (and potentially burn) your pastes. It is recommend to place it into the
-root of your web directory if you have installed PrivateBin in a subdirectory.
-Make sure to adjust it, so that the file paths match your installation.
-Of course also adjust the file, if you already use a `robots.txt`.  
-More bot detection is implemented in JavaScript, but note none of these mechanisms is a
-100% fail-safe way to prevent non-human visitors on your site.
+A `robots.txt` file is provided in the root dir of PrivateBin. It requests bots
+such as search engines and other automation tools to not index or crawl your
+site, so the paste keys are not leaked. It is recommended to place it into
+the root of your web directory if you have installed PrivateBin in a subdirectory.
+Make sure to adjust it, so that the file paths match your installation. Of course
+you can also adjust an existing `robots.txt` file. More bot detection is
+implemented in JavaScript, but note none of these mechanisms is a 100% fail-safe
+way to prevent non-human visitors on your site.
 
 A `.htaccess.disabled` file is provided in the root dir of PrivateBin. It blocks
 some known robots and link-scanning bots. If you use Apache, you can rename the

tst/Bootstrap.php

@@ -243,7 +243,7 @@ class Helper
     }
 
     /**
-     * restor backup of the config file
+     * restore backup of the config file
      *
      * @return void
      */
@@ -298,6 +298,16 @@ class Helper
         }
     }
 
+    /**
+     * create a temporary file, returns it's file name
+     *
+     * @return string
+     */
+    public static function createTempFile(): string
+    {
+        return tempnam(sys_get_temp_dir(), 'FOO');
+    }
+
     /**
      * a var_export that returns arrays without line breaks
      * by linus@flowingcreativity.net via php.net

tst/ControllerTest.php

@@ -136,10 +136,6 @@ class ControllerTest extends TestCase
         );
     }
 
-    /**
-     * @expectedException Exception
-     * @expectedExceptionCode 2
-     */
     public function testConf()
     {
         file_put_contents(CONF, '');
@@ -176,7 +172,7 @@ class ControllerTest extends TestCase
         $options['traffic']['limit'] = 0;
         Helper::createIniFile(CONF, $options);
         $paste = Helper::getPasteJson();
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -207,12 +203,13 @@ class ControllerTest extends TestCase
         $options['traffic']['limit'] = 0;
         Helper::createIniFile(CONF, $options);
         $paste = Helper::getPasteJson(array('expire' => 25));
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         $_SERVER['REQUEST_METHOD']        = 'POST';
         $_SERVER['REMOTE_ADDR']           = '::1';
+        // Explicitly invoke TrafficLimiter to ensure limit applies to this test
         TrafficLimiter::canPass();
         ob_start();
         new Controller;
@@ -239,7 +236,7 @@ class ControllerTest extends TestCase
         $options['traffic']['limit']  = 0;
         Helper::createIniFile(CONF, $options);
         $paste = Helper::getPasteJson();
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -263,7 +260,7 @@ class ControllerTest extends TestCase
         $options['traffic']['header'] = 'X_FORWARDED_FOR';
         Helper::createIniFile(CONF, $options);
         $paste = Helper::getPasteJson();
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_FORWARDED_FOR']  = '::2';
@@ -296,7 +293,7 @@ class ControllerTest extends TestCase
         $paste = Helper::getPaste();
         $this->_data->create(Helper::getPasteId(), $paste);
         $paste = Helper::getPasteJson();
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -320,7 +317,7 @@ class ControllerTest extends TestCase
         $options['traffic']['limit'] = 0;
         Helper::createIniFile(CONF, $options);
         $paste = Helper::getPasteJson();
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -352,7 +349,7 @@ class ControllerTest extends TestCase
         $options['traffic']['limit'] = 0;
         Helper::createIniFile(CONF, $options);
         $paste = Helper::getPasteJson();
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -385,7 +382,7 @@ class ControllerTest extends TestCase
         $options['traffic']['limit'] = 0;
         Helper::createIniFile(CONF, $options);
         $paste = Helper::getPasteJson(array('expire' => 'foo'));
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -416,7 +413,7 @@ class ControllerTest extends TestCase
         Helper::createIniFile(CONF, $options);
         $paste             = Helper::getPastePost();
         $paste['adata'][3] = 'neither 1 nor 0';
-        $file              = tempnam(sys_get_temp_dir(), 'FOO');
+        $file              = Helper::createTempFile();
         file_put_contents($file, json_encode($paste));
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -441,7 +438,7 @@ class ControllerTest extends TestCase
         Helper::createIniFile(CONF, $options);
         $paste             = Helper::getPastePost();
         $paste['adata'][2] = 'neither 1 nor 0';
-        $file              = tempnam(sys_get_temp_dir(), 'FOO');
+        $file              = Helper::createTempFile();
         file_put_contents($file, json_encode($paste));
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -465,7 +462,7 @@ class ControllerTest extends TestCase
     public function testCreateBrokenUpload()
     {
         $paste = substr(Helper::getPasteJson(), 0, -10);
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -487,7 +484,7 @@ class ControllerTest extends TestCase
     public function testCreateTooSoon()
     {
         $paste = Helper::getPasteJson();
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -514,7 +511,7 @@ class ControllerTest extends TestCase
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
         Helper::createIniFile(CONF, $options);
-        $file = tempnam(sys_get_temp_dir(), 'FOO');
+        $file = Helper::createTempFile();
         file_put_contents($file, '{"data":"","meta":{}}');
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -538,7 +535,7 @@ class ControllerTest extends TestCase
         $options['traffic']['limit'] = 0;
         Helper::createIniFile(CONF, $options);
         $comment = Helper::getCommentJson();
-        $file    = tempnam(sys_get_temp_dir(), 'FOO');
+        $file    = Helper::createTempFile();
         file_put_contents($file, $comment);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -565,7 +562,7 @@ class ControllerTest extends TestCase
         Helper::createIniFile(CONF, $options);
         $comment             = Helper::getCommentPost();
         $comment['parentid'] = 'foo';
-        $file                = tempnam(sys_get_temp_dir(), 'FOO');
+        $file                = Helper::createTempFile();
         file_put_contents($file, json_encode($comment));
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -591,7 +588,7 @@ class ControllerTest extends TestCase
         $options['traffic']['limit'] = 0;
         Helper::createIniFile(CONF, $options);
         $comment = Helper::getCommentJson();
-        $file    = tempnam(sys_get_temp_dir(), 'FOO');
+        $file    = Helper::createTempFile();
         file_put_contents($file, $comment);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -618,7 +615,7 @@ class ControllerTest extends TestCase
         $options['traffic']['limit'] = 0;
         Helper::createIniFile(CONF, $options);
         $comment = Helper::getCommentJson();
-        $file    = tempnam(sys_get_temp_dir(), 'FOO');
+        $file    = Helper::createTempFile();
         file_put_contents($file, $comment);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -647,7 +644,7 @@ class ControllerTest extends TestCase
         $this->_data->createComment(Helper::getPasteId(), Helper::getPasteId(), Helper::getPasteId(), $comment);
         $this->assertTrue($this->_data->existsComment(Helper::getPasteId(), Helper::getPasteId(), Helper::getPasteId()), 'comment exists before posting data');
         $comment = Helper::getCommentJson();
-        $file    = tempnam(sys_get_temp_dir(), 'FOO');
+        $file    = Helper::createTempFile();
         file_put_contents($file, $comment);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -884,7 +881,7 @@ class ControllerTest extends TestCase
         $paste = Helper::getPaste();
         $this->_data->create(Helper::getPasteId(), $paste);
         $this->assertTrue($this->_data->exists(Helper::getPasteId()), 'paste exists before deleting data');
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, json_encode(array(
             'deletetoken' => 'burnafterreading',
         )));

tst/I18nTest.php

@@ -141,14 +141,14 @@ class I18nTest extends TestCase
         $_SERVER['HTTP_ACCEPT_LANGUAGE'] = 'sl;q=0.8,en-GB;q=0.6,en-US;q=0.4,en;q=0.2';
         I18n::loadTranslations();
         $this->assertEquals('sl', I18n::getLanguage(), 'browser language sl');
-        $this->assertEquals('0 ura',  I18n::_('%d hours', 0), '0 hours in Slowene');
-        $this->assertEquals('1 uri',  I18n::_('%d hours', 1), '1 hour in Slowene');
-        $this->assertEquals('2 ure', I18n::_('%d hours', 2), '2 hours in Slowene');
-        $this->assertEquals('3 ur',  I18n::_('%d hours', 3), '3 hours in Slowene');
-        $this->assertEquals('11 ura',  I18n::_('%d hours', 11), '11 hours in Slowene');
-        $this->assertEquals('101 uri',  I18n::_('%d hours', 101), '101 hours in Slowene');
-        $this->assertEquals('102 ure', I18n::_('%d hours', 102), '102 hours in Slowene');
-        $this->assertEquals('104 ur',  I18n::_('%d hours', 104), '104 hours in Slowene');
+        $this->assertEquals('0 ura',  I18n::_('%d hours', 0), '0 hours in Slovene');
+        $this->assertEquals('1 uri',  I18n::_('%d hours', 1), '1 hour in Slovene');
+        $this->assertEquals('2 ure', I18n::_('%d hours', 2), '2 hours in Slovene');
+        $this->assertEquals('3 ur',  I18n::_('%d hours', 3), '3 hours in Slovene');
+        $this->assertEquals('11 ura',  I18n::_('%d hours', 11), '11 hours in Slovene');
+        $this->assertEquals('101 uri',  I18n::_('%d hours', 101), '101 hours in Slovene');
+        $this->assertEquals('102 ure', I18n::_('%d hours', 102), '102 hours in Slovene');
+        $this->assertEquals('104 ur',  I18n::_('%d hours', 104), '104 hours in Slovene');
     }
 
     public function testBrowserLanguageCsDetection()

tst/JsonApiTest.php

@@ -51,7 +51,7 @@ class JsonApiTest extends TestCase
         $options['traffic']['limit'] = 0;
         Helper::createIniFile(CONF, $options);
         $paste = Helper::getPasteJson();
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -83,7 +83,7 @@ class JsonApiTest extends TestCase
         $options['traffic']['limit'] = 0;
         Helper::createIniFile(CONF, $options);
         $paste = Helper::getPasteJson();
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, $paste);
         Request::setInputStream($file);
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
@@ -118,7 +118,7 @@ class JsonApiTest extends TestCase
         $this->_model->create(Helper::getPasteId(), $data);
         $this->assertTrue($this->_model->exists(Helper::getPasteId()), 'paste exists before deleting data');
         $paste = $this->_model->read(Helper::getPasteId());
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, json_encode(array(
             'deletetoken' => hash_hmac('sha256', Helper::getPasteId(), $paste['meta']['salt']),
         )));
@@ -146,7 +146,7 @@ class JsonApiTest extends TestCase
         $this->_model->create(Helper::getPasteId(), $data);
         $this->assertTrue($this->_model->exists(Helper::getPasteId()), 'paste exists before deleting data');
         $paste = $this->_model->read(Helper::getPasteId());
-        $file  = tempnam(sys_get_temp_dir(), 'FOO');
+        $file  = Helper::createTempFile();
         file_put_contents($file, json_encode(array(
             'pasteid'     => Helper::getPasteId(),
             'deletetoken' => hash_hmac('sha256', Helper::getPasteId(), $paste['meta']['salt']),

tst/RequestTest.php

@@ -89,7 +89,7 @@ class RequestTest extends TestCase
         $this->reset();
         $_SERVER['REQUEST_METHOD']        = 'PUT';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
-        $file                             = tempnam(sys_get_temp_dir(), 'FOO');
+        $file                             = Helper::createTempFile();
         file_put_contents($file, '{"ct":"foo"}');
         Request::setInputStream($file);
         $request = new Request;
@@ -104,7 +104,7 @@ class RequestTest extends TestCase
         $this->reset();
         $_SERVER['REQUEST_METHOD'] = 'POST';
         $_SERVER['HTTP_ACCEPT']    = 'application/json, text/javascript, */*; q=0.01';
-        $file                      = tempnam(sys_get_temp_dir(), 'FOO');
+        $file                      = Helper::createTempFile();
         file_put_contents($file, '{"ct":"foo"}');
         Request::setInputStream($file);
         $request = new Request;
@@ -135,7 +135,7 @@ class RequestTest extends TestCase
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         $_SERVER['QUERY_STRING']          = $id;
         $_GET                             = array($id => '');
-        $file                             = tempnam(sys_get_temp_dir(), 'FOO');
+        $file                             = Helper::createTempFile();
         file_put_contents($file, '{"deletetoken":"bar"}');
         Request::setInputStream($file);
         $request = new Request;
@@ -149,7 +149,7 @@ class RequestTest extends TestCase
     {
         $this->reset();
         $_SERVER['REQUEST_METHOD']        = 'POST';
-        $file                             = tempnam(sys_get_temp_dir(), 'FOO');
+        $file                             = Helper::createTempFile();
         file_put_contents($file, random_bytes(256));
         Request::setInputStream($file);
         $request = new Request;