353 lines
15 KiB
PHP
353 lines
15 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/*
|
|
* This file is part of the TYPO3 CMS project.
|
|
*
|
|
* It is free software; you can redistribute it and/or modify it under
|
|
* the terms of the GNU General Public License, either version 2
|
|
* of the License, or any later version.
|
|
*
|
|
* For the full copyright and license information, please read the
|
|
* LICENSE.txt file that was distributed with this source code.
|
|
*
|
|
* The TYPO3 project - inspiring people to share!
|
|
*/
|
|
|
|
namespace TYPO3\CMS\Form\Domain\Configuration;
|
|
|
|
use Symfony\Component\DependencyInjection\Attribute\Autoconfigure;
|
|
use TYPO3\CMS\Core\Crypto\HashService;
|
|
use TYPO3\CMS\Core\Utility\GeneralUtility;
|
|
use TYPO3\CMS\Form\Domain\Configuration\ArrayProcessing\ArrayProcessing;
|
|
use TYPO3\CMS\Form\Domain\Configuration\ArrayProcessing\ArrayProcessor;
|
|
use TYPO3\CMS\Form\Domain\Configuration\Exception\PropertyException;
|
|
use TYPO3\CMS\Form\Domain\Configuration\FormDefinition\Validators\CreatableFormElementPropertiesValidator;
|
|
use TYPO3\CMS\Form\Domain\Configuration\FormDefinition\Validators\CreatablePropertyCollectionElementPropertiesValidator;
|
|
use TYPO3\CMS\Form\Domain\Configuration\FormDefinition\Validators\FormElementHmacDataValidator;
|
|
use TYPO3\CMS\Form\Domain\Configuration\FormDefinition\Validators\PropertyCollectionElementHmacDataValidator;
|
|
use TYPO3\CMS\Form\Domain\Configuration\FormDefinition\Validators\ValidationDto;
|
|
|
|
/**
|
|
* @internal
|
|
*/
|
|
#[Autoconfigure(public: true)]
|
|
readonly class FormDefinitionValidationService
|
|
{
|
|
public function __construct(
|
|
protected HashService $hashService,
|
|
protected ConfigurationService $configurationService,
|
|
) {}
|
|
|
|
/**
|
|
* Validate the form definition properties using the form setup.
|
|
* Pseudo workflow:
|
|
* Is the form element type creatable by the form editor?
|
|
* YES
|
|
* foreach(form element properties) (without finishers|validators)
|
|
* is the form element property defined in the form setup (can be manipulated)?
|
|
* YES
|
|
* is the form element property configured to only allow a limited set of values (e.g. Inspector-MultiSelectEditor, Inspector-SingleSelectEditor ...)
|
|
* YES
|
|
* is the form element property value within the set of allowed values?
|
|
* YES
|
|
* valid!
|
|
* NO
|
|
* invalid! throw exception
|
|
* NO
|
|
* valid!
|
|
* NO
|
|
* is the form element property defined in "predefinedDefaults" in the form setup (cannot be manipulated but should be written)?
|
|
* YES
|
|
* is the form element property value equals to the value defined in "predefinedDefaults" in the form setup?
|
|
* YES
|
|
* valid!
|
|
* NO
|
|
* invalid! throw exception
|
|
* NO
|
|
* is there a hmac hash available for the form element property value (cannot be manipulated but should be written)?
|
|
* YES
|
|
* is the form element property value equals the historical value (and is the historical value valid)?
|
|
* YES
|
|
* valid!
|
|
* NO
|
|
* invalid! throw exception
|
|
* NO
|
|
* invalid! throw exception
|
|
* foreach(form elements finishers|validators)
|
|
* is the form elements finisher|validator creatable by the form editor?
|
|
* YES
|
|
* foreach(form elements finisher|validator properties)
|
|
* is the form elements finisher|validator property defined in the form setup (can be manipulated)?
|
|
* YES
|
|
* is the form elements finisher|validator property configured to only allow a limited set of values (e.g. Inspector-MultiSelectEditor, Inspector-SingleSelectEditor ...)
|
|
* YES
|
|
* is the form elements finisher|validator property value within the set of allowed values?
|
|
* YES
|
|
* valid!
|
|
* NO
|
|
* invalid! throw exception
|
|
* NO
|
|
* valid!
|
|
* NO
|
|
* is the form elements finisher|validator property defined in "predefinedDefaults" in the form setup (cannot be manipulated but should be written)?
|
|
* YES
|
|
* is the form elements finisher|validator property value equals to the value defined in "predefinedDefaults" in the form setup?
|
|
* YES
|
|
* valid!
|
|
* NO
|
|
* invalid! throw exception
|
|
* NO
|
|
* is there a hmac hash available for the form elements finisher|validator property value (can not be manipulated but should be written)?
|
|
* YES
|
|
* is the form elements finisher|validator property value equals the historical value (and is the historical value valid)?
|
|
* YES
|
|
* valid!
|
|
* NO
|
|
* invalid! throw exception
|
|
* NO
|
|
* invalid! throw exception
|
|
* NO
|
|
* foreach(form elements finisher|validator properties)
|
|
* is there a hmac hash available for the form elements finisher|validator property value (can not be manipulated but should be written)?
|
|
* YES
|
|
* is the form elements finisher|validator property value equals the historical value (and is the historical value valid)?
|
|
* YES
|
|
* valid!
|
|
* NO
|
|
* invalid! throw exception
|
|
* NO
|
|
* invalid! throw exception
|
|
* NO
|
|
* foreach(form element properties) (without finishers|validators)
|
|
* is there a hmac hash available for the form element property value (cannot be manipulated but should be written)?
|
|
* YES
|
|
* is the form element property value equals the historical value (and is the historical value valid)?
|
|
* YES
|
|
* valid!
|
|
* NO
|
|
* invalid! throw exception
|
|
* NO
|
|
* invalid! throw exception
|
|
* foreach(form elements finisher|validator properties)
|
|
* is there a hmac hash available for the form elements finisher|validator property value (can not be manipulated but should be written)?
|
|
* YES
|
|
* is the form elements finisher|validator property value equals the historical value (and is the historical value valid)?
|
|
* YES
|
|
* valid!
|
|
* NO
|
|
* invalid! throw exception
|
|
* NO
|
|
* invalid! throw exception
|
|
*
|
|
* @throws PropertyException
|
|
*/
|
|
public function validateFormDefinitionProperties(
|
|
array $currentFormElement,
|
|
string $prototypeName,
|
|
string $sessionToken
|
|
): void {
|
|
$renderables = $currentFormElement['renderables'] ?? [];
|
|
$propertyCollectionElements = $currentFormElement['finishers'] ?? $currentFormElement['validators'] ?? [];
|
|
$propertyCollectionName = $currentFormElement['type'] === 'Form' ? 'finishers' : 'validators';
|
|
unset($currentFormElement['renderables'], $currentFormElement['finishers'], $currentFormElement['validators']);
|
|
|
|
$validationDto = GeneralUtility::makeInstance(
|
|
ValidationDto::class,
|
|
$prototypeName,
|
|
$currentFormElement['type'],
|
|
$currentFormElement['identifier'],
|
|
null,
|
|
$propertyCollectionName
|
|
);
|
|
|
|
if ($this->configurationService->isFormElementTypeCreatableByFormEditor($validationDto)) {
|
|
$this->validateAllPropertyValuesFromCreatableFormElement(
|
|
$currentFormElement,
|
|
$sessionToken,
|
|
$validationDto
|
|
);
|
|
foreach ($propertyCollectionElements as $propertyCollectionElement) {
|
|
$validationDto = $validationDto->withPropertyCollectionElementIdentifier(
|
|
$propertyCollectionElement['identifier']
|
|
);
|
|
if ($this->configurationService->isPropertyCollectionElementIdentifierCreatableByFormEditor($validationDto)) {
|
|
$this->validateAllPropertyValuesFromCreatablePropertyCollectionElement(
|
|
$propertyCollectionElement,
|
|
$sessionToken,
|
|
$validationDto
|
|
);
|
|
} else {
|
|
$this->validateAllPropertyCollectionElementValuesByHmac(
|
|
$propertyCollectionElement,
|
|
$sessionToken,
|
|
$validationDto
|
|
);
|
|
}
|
|
}
|
|
} else {
|
|
$this->validateAllFormElementPropertyValuesByHmac($currentFormElement, $sessionToken, $validationDto);
|
|
foreach ($propertyCollectionElements as $propertyCollectionElement) {
|
|
$this->validateAllPropertyCollectionElementValuesByHmac(
|
|
$propertyCollectionElement,
|
|
$sessionToken,
|
|
$validationDto
|
|
);
|
|
}
|
|
}
|
|
|
|
foreach ($renderables as $renderable) {
|
|
$this->validateFormDefinitionProperties($renderable, $prototypeName, $sessionToken);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Returns TRUE if a property value is equals to the historical value
|
|
* and FALSE if not.
|
|
* "Historical values" means values which are available within the form definition
|
|
* while the form editor is loaded and the values which are available after a
|
|
* successful validation of the form definition on a save operation.
|
|
* The value must be equal to the historical value if the property key for the value
|
|
* is not defined within the form setup.
|
|
* This means that the property can not be changed by the form editor but we want to keep the value
|
|
* in its original state.
|
|
* If this is not the case (return value is FALSE), an exception must be thrown.
|
|
*
|
|
* @throws PropertyException
|
|
*/
|
|
public function isPropertyValueEqualToHistoricalValue(
|
|
array $hmacContent,
|
|
mixed $propertyValue,
|
|
array $hmacData,
|
|
string $sessionToken
|
|
): bool {
|
|
$this->checkHmacDataIntegrity($hmacData, $hmacContent, $sessionToken);
|
|
$hmacContent[] = $propertyValue;
|
|
$expectedHash = $this->hashService->hmac(serialize($hmacContent), $sessionToken);
|
|
return hash_equals($expectedHash, $hmacData['hmac']);
|
|
}
|
|
|
|
/**
|
|
* Compares the historical value and the hmac hash to ensure the integrity
|
|
* of the data.
|
|
* An exception will be thrown if the value is modified.
|
|
*
|
|
* @throws PropertyException
|
|
*/
|
|
protected function checkHmacDataIntegrity(array $hmacData, array $hmacContent, string $sessionToken)
|
|
{
|
|
$hmac = $hmacData['hmac'] ?? null;
|
|
if (empty($hmac)) {
|
|
throw new PropertyException('Hmac must not be empty. #1528538222', 1528538222);
|
|
}
|
|
$hmacContent[] = $hmacData['value'] ?? '';
|
|
$expectedHash = $this->hashService->hmac(serialize($hmacContent), $sessionToken);
|
|
if (!hash_equals($expectedHash, $hmac)) {
|
|
throw new PropertyException('Unauthorized modification of historical data. #1528538252', 1528538252);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Walk through all form element properties and checks
|
|
* if the values matches to their hmac hashes.
|
|
*/
|
|
protected function validateAllFormElementPropertyValuesByHmac(
|
|
array $currentElement,
|
|
string $sessionToken,
|
|
ValidationDto $validationDto
|
|
): void {
|
|
GeneralUtility::makeInstance(ArrayProcessor::class, $currentElement)->forEach(
|
|
GeneralUtility::makeInstance(
|
|
ArrayProcessing::class,
|
|
'validateProperties',
|
|
'^(?!(_orig_.*|.*\._orig_.*)$).*',
|
|
GeneralUtility::makeInstance(
|
|
FormElementHmacDataValidator::class,
|
|
$currentElement,
|
|
$sessionToken,
|
|
$validationDto
|
|
)
|
|
)
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Walk through all property collection properties and checks
|
|
* if the values matches to their hmac hashes.
|
|
*/
|
|
protected function validateAllPropertyCollectionElementValuesByHmac(
|
|
array $currentElement,
|
|
string $sessionToken,
|
|
ValidationDto $validationDto
|
|
): void {
|
|
GeneralUtility::makeInstance(ArrayProcessor::class, $currentElement)->forEach(
|
|
GeneralUtility::makeInstance(
|
|
ArrayProcessing::class,
|
|
'validateProperties',
|
|
'^(?!(_orig_.*|.*\._orig_.*)$).*',
|
|
GeneralUtility::makeInstance(
|
|
PropertyCollectionElementHmacDataValidator::class,
|
|
$currentElement,
|
|
$sessionToken,
|
|
$validationDto
|
|
)
|
|
)
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Walk through all form element properties and checks
|
|
* if the property is defined within the form editor setup
|
|
* or if the property is defined within the "predefinedDefaults" in the form editor setup
|
|
* and the property value matches the predefined value
|
|
* or if there is a valid hmac hash for the value.
|
|
*/
|
|
protected function validateAllPropertyValuesFromCreatableFormElement(
|
|
array $currentElement,
|
|
string $sessionToken,
|
|
ValidationDto $validationDto
|
|
): void {
|
|
GeneralUtility::makeInstance(ArrayProcessor::class, $currentElement)->forEach(
|
|
GeneralUtility::makeInstance(
|
|
ArrayProcessing::class,
|
|
'validateProperties',
|
|
'^(?!(_orig_.*|.*\._orig_.*|type|identifier)$).*',
|
|
GeneralUtility::makeInstance(
|
|
CreatableFormElementPropertiesValidator::class,
|
|
$currentElement,
|
|
$sessionToken,
|
|
$validationDto
|
|
)
|
|
)
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Walk through all property collection properties and checks
|
|
* if the property is defined within the form editor setup
|
|
* or if the property is defined within the "predefinedDefaults" in the form editor setup
|
|
* and the property value matches the predefined value
|
|
* or if there is a valid hmac hash for the value.
|
|
*/
|
|
protected function validateAllPropertyValuesFromCreatablePropertyCollectionElement(
|
|
array $currentElement,
|
|
string $sessionToken,
|
|
ValidationDto $validationDto
|
|
): void {
|
|
GeneralUtility::makeInstance(ArrayProcessor::class, $currentElement)->forEach(
|
|
GeneralUtility::makeInstance(
|
|
ArrayProcessing::class,
|
|
'validateProperties',
|
|
'^(?!(_orig_.*|.*\._orig_.*|identifier)$).*',
|
|
GeneralUtility::makeInstance(
|
|
CreatablePropertyCollectionElementPropertiesValidator::class,
|
|
$currentElement,
|
|
$sessionToken,
|
|
$validationDto
|
|
)
|
|
)
|
|
);
|
|
}
|
|
}
|