class MTimeProtectedFileStorage

Stores PHP code in files with securely hashed names.

The goal of this class is to ensure that if a PHP file is replaced with an untrusted one, it does not get loaded. Since mtime granularity is 1 second, we cannot prevent an attack that happens within one second of the initial save(). However, it is very unlikely for an attacker exploiting an upload or file write vulnerability to also know when a legitimate file is being saved, discover its hash, undo its file permissions, and override the file with an upload all within a single second. Being able to accomplish that would indicate a site very likely vulnerable to many other attack vectors.

Each file is stored in its own unique containing directory. The hash is based on the virtual file name, the containing directory's mtime, and a cryptographically hard to guess secret string. Thus, even if the hashed file name is discovered and replaced by an untrusted file (e.g., via a move_uploaded_file() invocation by a script that performs insufficient validation), the directory's mtime gets updated in the process, invalidating the hash and preventing the untrusted file from getting loaded. Also, the file mtime will be checked providing security against overwriting in-place, at the cost of an additional system call for every load() and exists().

The containing directory is created with the same name as the virtual file name (slashes replaced with hashmarks) to assist with debugging, since the file itself is stored with a name that's meaningless to humans.

Hierarchy

Expanded class hierarchy of MTimeProtectedFileStorage

File

drupal/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFileStorage.php, line 36
Definition of Drupal\Component\PhpStorage\MTimeProtectedFileStorage.

Namespace

Drupal\Component\PhpStorage
View source
class MTimeProtectedFileStorage extends MTimeProtectedFastFileStorage {

  /**
   * Implements Drupal\Component\PhpStorage\PhpStorageInterface::load().
   */
  public function load($name) {
    if (($filename = $this
      ->checkFile($name)) !== FALSE) {

      // Inline parent::load() to avoid an expensive getFullPath() call.
      return @(include_once $filename) !== FALSE;
    }
    return FALSE;
  }

  /**
   * Implements Drupal\Component\PhpStorage\PhpStorageInterface::exists().
   */
  public function exists($name) {
    return $this
      ->checkFile($name) !== FALSE;
  }

  /**
   * Determines whether a protected file exists and sets the filename too.
   *
   * @param string $name
   *   The virtual file name. Can be a relative path.
   * return string
   *   The full path where the file is if it is valid, FALSE otherwise.
   */
  protected function checkFile($name) {
    $filename = $this
      ->getFullPath($name, $directory, $directory_mtime);
    return file_exists($filename) && filemtime($filename) <= $directory_mtime ? $filename : FALSE;
  }

}

Members

Namesort descending Modifiers Type Description Overrides
FileStorage::$directory protected property The directory where the files should be stored.
FileStorage::deleteAll function Implements Drupal\Component\PhpStorage\PhpStorageInterface::deleteAll(). Overrides PhpStorageInterface::deleteAll
FileStorage::filePreDeleteCallback public static function Ensures files and directories are deletable.
FileStorage::writeable function Implements Drupal\Component\PhpStorage\PhpStorageInterface::writeable(). Overrides PhpStorageInterface::writeable
MTimeProtectedFastFileStorage::$secret protected property The secret used in the HMAC.
MTimeProtectedFastFileStorage::cleanDirectory protected function Removes everything in a directory, leaving it empty.
MTimeProtectedFastFileStorage::delete public function Implements Drupal\Component\PhpStorage\PhpStorageInterface::delete(). Overrides FileStorage::delete
MTimeProtectedFastFileStorage::ensureDirectory protected function Ensures the root directory exists and has correct permissions.
MTimeProtectedFastFileStorage::getContainingDirectoryFullPath protected function Returns the full path of the containing directory where the file is or should be stored.
MTimeProtectedFastFileStorage::getFullPath protected function Returns the full path where the file is or should be stored. Overrides FileStorage::getFullPath
MTimeProtectedFastFileStorage::getUncachedMTime protected function Clears PHP's stat cache and returns the directory's mtime.
MTimeProtectedFastFileStorage::HTACCESS constant
MTimeProtectedFastFileStorage::save public function Implements Drupal\Component\PhpStorage\PhpStorageInterface::save(). Overrides FileStorage::save
MTimeProtectedFastFileStorage::__construct public function Constructs this MTimeProtectedFastFileStorage object. Overrides FileStorage::__construct
MTimeProtectedFileStorage::checkFile protected function Determines whether a protected file exists and sets the filename too.
MTimeProtectedFileStorage::exists public function Implements Drupal\Component\PhpStorage\PhpStorageInterface::exists(). Overrides FileStorage::exists
MTimeProtectedFileStorage::load public function Implements Drupal\Component\PhpStorage\PhpStorageInterface::load(). Overrides FileStorage::load