Reject symlinked .vipgoci_* committed files before reading

.github/workflows/ci.yml

@@ -19,15 +19,15 @@ jobs:
       fail-fast: false
       matrix:
         php:
-          - '8.0'
-          - '8.1'
           - '8.2'
+          - '8.3'
+          - '8.4'
     steps:
       - name: Check out the source code
         uses: actions/checkout@v3
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@c5fc0d8281aba02c7fda07d3a70cc5371548067d # 2.25.2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           coverage: none
           php-version: "${{ matrix.php }}"
@@ -50,36 +50,36 @@ jobs:
       fail-fast: false
       matrix:
         php:
-          - '8.0'
-          - '8.1'
           - '8.2'
+          - '8.3'
+          - '8.4'
     steps:
       - name: Check out the source code
         uses: actions/checkout@v3
 
       - name: Set up PHP 7.4
-        uses: shivammathur/setup-php@c5fc0d8281aba02c7fda07d3a70cc5371548067d # 2.25.2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           coverage: none
           php-version: "7.4"
 
-      - name: Set up PHP 8.0
-        uses: shivammathur/setup-php@c5fc0d8281aba02c7fda07d3a70cc5371548067d # 2.25.2
+      - name: Set up PHP 8.2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           coverage: none
-          php-version: "8.0"
+          php-version: "8.2"
 
-      - name: Set up PHP 8.1
-        uses: shivammathur/setup-php@c5fc0d8281aba02c7fda07d3a70cc5371548067d # 2.25.2
+      - name: Set up PHP 8.3
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           coverage: none
-          php-version: "8.1"
+          php-version: "8.3"
 
-      - name: Set up PHP 8.2
-        uses: shivammathur/setup-php@c5fc0d8281aba02c7fda07d3a70cc5371548067d # 2.25.2
+      - name: Set up PHP 8.4
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           coverage: none
-          php-version: "8.2"
+          php-version: "8.4"
           tools: phpunit:9
         env:
           fail-fast: 'true'
@@ -99,7 +99,7 @@ jobs:
         env:
           GH_TESTS_TOKEN: ${{ secrets.GH_TESTS_TOKEN }}
         run: |
-          sed "s:/home/phpunit/:${HOME}/:; s:phpcs-php-path=.*:phpcs-php-path=/usr/bin/php7.4:g; s:svg-php-path=.*:svg-php-path=/usr/bin/php8.1:g; s:github-repo-url=.*:github-repo-url=${HOME}/vip-go-ci-tools/vip-go-ci-testing:g;" tests/config.ini.dist > tests/config.ini
+          sed "s:/home/phpunit/:${HOME}/:; s:phpcs-php-path=.*:phpcs-php-path=/usr/bin/php7.4:g; s:lint-php2-path=.*:lint-php2-path=/usr/bin/php8.2:g; s:lint-php2-version=.*:lint-php2-version=8.2:g; s:svg-php-path=.*:svg-php-path=/usr/bin/php8.2:g; s:github-repo-url=.*:github-repo-url=${HOME}/vip-go-ci-tools/vip-go-ci-testing:g;" tests/config.ini.dist > tests/config.ini
           rm -f tests/config.ini.dist
           echo '[git-secrets]' > tests/config-secrets.ini
           echo "github-token=$GH_TESTS_TOKEN" >> tests/config-secrets.ini
@@ -125,9 +125,9 @@ jobs:
       fail-fast: false
       matrix:
         php:
-          - '8.0'
-          - '8.1'
           - '8.2'
+          - '8.3'
+          - '8.4'
     steps:
       - name: Check out the source code
         uses: actions/checkout@v3
@@ -138,7 +138,7 @@ jobs:
         run: git fetch origin latest && git pull
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@c5fc0d8281aba02c7fda07d3a70cc5371548067d # 2.25.2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           coverage: none
           php-version: "${{ matrix.php }}"
@@ -163,7 +163,7 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@c5fc0d8281aba02c7fda07d3a70cc5371548067d # 2.25.2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           coverage: none
           php-version: 8.2

README.md

@@ -58,7 +58,7 @@ If you have a feature request, please read the [file on contributing](CONTRIBUTI
 
 ### System requirements
 
-* `vip-go-ci` requires PHP 8.0, PHP 8.1 or PHP 8.2. PHP 8.2 is recommended.
+* `vip-go-ci` requires PHP 8.2 or later. PHP 8.2, PHP 8.3, and PHP 8.4 are currently tested.
   * Required PHP add-ons include: `curl` and `xml`. Also, PCNTL should be enabled.
   * The PHP-based utlities — PHPCS, SVG scanner and PHP Lint — can be run using different PHP versions than `vip-go-ci` itself. See individual sections below on this. 
     * These utilities have their own requirements.
@@ -122,11 +122,11 @@ While running, `vip-go-ci` will output log of its actions. Here is an example --
         "autoapprove-filetypes": [ "css", "txt", "pdf ],
         "lint-php-versions": [
             "7.4",
-            "8.1"
+            "8.2"
         ],
         "lint-php-version-paths": {
             "7.4": "\/usr\/bin\/php7.4",
-            "8.1": "\/usr\/bin\/php8.1"
+            "8.2": "\/usr\/bin\/php8.2"
         },
         "debug-level": 0,
         "dry-run": false
@@ -339,7 +339,7 @@ By default, `vip-go-ci` will PHP lint any files modified by the current pull req
 
 `vip-go-ci` can lint PHP files using one or more PHP versions during the same run. These must be specified using the `--lint-php-version-paths` and `--lint-php-versions` options. 
 
-The `--lint-php-version-paths` option should specify all PHP versions that may be used and a PHP interpreter path. For example: `--lint-php-version-paths=7.4:/usr/bin/php7.4,8.1:/usr/bin/php8.1`. `--lint-php-versions` should specify the PHP versions to lint with during the run: `--lint-php-versions=7.4`.
+The `--lint-php-version-paths` option should specify all PHP versions that may be used and a PHP interpreter path. For example: `--lint-php-version-paths=7.4:/usr/bin/php7.4,8.2:/usr/bin/php8.2`. `--lint-php-versions` should specify the PHP versions to lint with during the run: `--lint-php-versions=7.4`.
 
 The following PHP linting related options can be configured via repository config-file or normal options:
 
@@ -718,4 +718,3 @@ Documentation on what steps to follow when releasing a new version of `vip-go-ci
 
 For information on how to update `tools-init.sh`, see the [TOOLS-UPDATE.md](TOOLS-UPDATE.md) file.
 
-

defines.php

@@ -17,7 +17,7 @@
  * Define minimum version requirements.
  */
 define( 'VIPGOCI_GIT_VERSION_MINIMUM', '2.10' );
-define( 'VIPGOCI_PHP_VERSION_MINIMUM', '8.0.0' );
+define( 'VIPGOCI_PHP_VERSION_MINIMUM', '8.2.0' );
 
 /*
  * Client-ID for HTTP requests.
@@ -360,4 +360,3 @@
 		),
 	)
 );
-

git-repo.php

@@ -425,6 +425,7 @@ function vipgoci_gitrepo_fetch_tree(
  * @param string $commit_id      Current commit-ID.
  * @param string $file_name      File name whose content to fetch.
  * @param string $local_git_repo Path to local git repository.
+ * @param bool   $reject_symlink Whether symbolic links should return false.
  *
  * @return false|string String with file contents on success, false on failure.
  */
@@ -434,7 +435,8 @@ function vipgoci_gitrepo_fetch_committed_file(
 	string $github_token,
 	string $commit_id,
 	string $file_name,
-	string $local_git_repo
+	string $local_git_repo,
+	bool $reject_symlink = false
 ) :false|string {
 	vipgoci_gitrepo_ok(
 		$commit_id,
@@ -449,6 +451,7 @@ function vipgoci_gitrepo_fetch_committed_file(
 			'commit_id'      => $commit_id,
 			'filename'       => $file_name,
 			'local_git_repo' => $local_git_repo,
+			'reject_symlink' => $reject_symlink,
 		)
 	);
 
@@ -457,8 +460,28 @@ function vipgoci_gitrepo_fetch_committed_file(
 	 */
 	vipgoci_runtime_measure( VIPGOCI_RUNTIME_START, 'git_repo_fetch_file' );
 
+	$file_path = $local_git_repo . '/' . $file_name;
+
+	if (
+		( true === $reject_symlink ) &&
+		( is_link( $file_path ) )
+	) {
+		vipgoci_runtime_measure( VIPGOCI_RUNTIME_STOP, 'git_repo_fetch_file' );
+
+		vipgoci_log(
+			'Not fetching committed file because it is a symbolic link',
+			array(
+				'commit_id' => $commit_id,
+				'filename'  => $file_name,
+				'file_path' => $file_path,
+			)
+		);
+
+		return false;
+	}
+
 	$file_contents_tmp = @file_get_contents( // phpcs:ignore WordPress.PHP.NoSilencedErrors
-		$local_git_repo . '/' . $file_name
+		$file_path
 	);
 
 	vipgoci_runtime_measure( VIPGOCI_RUNTIME_STOP, 'git_repo_fetch_file' );

github-misc.php

@@ -351,7 +351,7 @@ function vipgoci_github_files_affected_by_commit(
 	bool $renamed_files_also = false,
 	bool $removed_files_also = true,
 	bool $permission_changes_also = false,
-	array $filter = null,
+	null|array $filter = null,
 	bool $always_define_pr_number = true
 ) :array {
 	vipgoci_log(

main.php

@@ -77,7 +77,7 @@ function vipgoci_help_print() :void {
 		"\t" . '--lint=BOOL                    Whether to do PHP linting. Default is true.' . PHP_EOL .
 		"\t" . '--lint-php-version-paths=ARRAY Array of paths to different PHP interpreter versions, comma' . PHP_EOL .
 		"\t" . '                               separated. Version and path separated by colon. Used for linting.' . PHP_EOL .
-		"\t" . '                               E.g.: --lint-php-version-paths=7.4:/usr/bin/php7.4,8.1:/usr/bin/php8.1' . PHP_EOL .
+		"\t" . '                               E.g.: --lint-php-version-paths=7.4:/usr/bin/php7.4,8.2:/usr/bin/php8.2' . PHP_EOL .
 		"\t" . '--lint-php-versions=ARRAY      Array of PHP versions to lint with during run. Comma separated values.' . PHP_EOL .
 		"\t" . '--lint-modified-files-only=BOOL   Whether to limit lint scan to run against only modified or new' . PHP_EOL .
 		"\t" . '                               files in the PR to be scanned. Default is true. It can be ' . PHP_EOL .
@@ -3460,4 +3460,3 @@ function vipgoci_shutdown_function(
 		'Final exit'
 	);
 }
-

options.php

@@ -63,12 +63,13 @@ function vipgoci_options_read_repo_file(
 		$options['token'],
 		$options['commit'],
 		$repo_options_file_name,
-		$options['local-git-repo']
+		$options['local-git-repo'],
+		true
 	);
 
 	if ( false === $repo_options_file_contents ) {
 		vipgoci_log(
-			'No options found in repository settings-file, nothing further to do',
+			'Repository settings-file is unavailable, unreadable, or rejected, nothing further to do',
 			array(
 				'filename' => $repo_options_file_name,
 			)
@@ -323,14 +324,15 @@ function vipgoci_options_read_repo_skip_files(
 				$options['token'],
 				$options['commit'],
 				$type_options_file_name,
-				$options['local-git-repo']
+				$options['local-git-repo'],
+				true
 			);
 
 		if ( empty(
 			$type_options_file_contents
 		) ) {
 			vipgoci_log(
-				'No folders skippable found in repository for ' . $scan_type . ', so skipping',
+				'Repository skip-folders file for ' . $scan_type . ' is missing, empty, unreadable, or rejected, so skipping',
 				array(
 					'type_options_file_name' => $type_options_file_name,
 				)

tests/config.ini.dist

@@ -48,8 +48,8 @@ commit-test-lint-scan-commit-3=dd60c66a7c1e27fc78c400f0c5160c9a80c4bd49
 commit-test-lint-scan-commit-4=84985c25706e83dada8c40061e6f1496cfe3c522
 lint-php1-path=/usr/bin/php7.4
 lint-php1-version=7.4
-lint-php2-path=/usr/bin/php8.1
-lint-php2-version=8.1
+lint-php2-path=/usr/bin/php8.2
+lint-php2-version=8.2
 
 ; For WPScan API tests. Plugin/theme known to API.
 [wpscan-api-scan]
@@ -167,4 +167,3 @@ commit-test-options-read-repo-file-with-file-5=9a13bbec0cc2c7557539076f0125cc396
 [results]
 pr-number-1=57
 commit-test-results-remove-existing-1=34ec039ca344336ad93abfbca2e9c313c11e28dd
-

tests/integration/GitRepoRepoFetchCommittedFileTest.php

@@ -125,4 +125,88 @@ public function testRepoFetchTree1() {
 			$ret
 		);
 	}
+
+	/**
+	 * @covers ::vipgoci_gitrepo_fetch_committed_file
+	 */
+	public function testRepoFetchTreeRejectSymlink() {
+		$options_test = vipgoci_unittests_options_test(
+			$this->options,
+			array( 'github-token', 'token' ),
+			$this
+		);
+
+		if ( -1 === $options_test ) {
+			return;
+		}
+
+		$this->options['commit'] =
+			$this->options['commit-test-repo-fetch-committed-file-1'];
+
+		vipgoci_unittests_output_suppress();
+
+		$this->options['local-git-repo'] =
+			vipgoci_unittests_setup_git_repo(
+				$this->options
+			);
+
+		if ( false === $this->options['local-git-repo'] ) {
+			$this->markTestSkipped(
+				'Could not set up git repository: ' .
+					vipgoci_unittests_output_get()
+			);
+		}
+
+		if ( empty( $this->options['github-token'] ) ) {
+			$this->options['github-token'] = '';
+		}
+
+		$this->options['token'] =
+			$this->options['github-token'];
+
+		$symlinked_file_name = 'symlinked-file.txt';
+		$symlinked_file_path =
+			$this->options['local-git-repo'] . '/' . $symlinked_file_name;
+
+		if ( false === symlink(
+			'file-1.txt',
+			$symlinked_file_path
+		) ) {
+			vipgoci_unittests_output_unsuppress();
+
+			$this->markTestSkipped(
+				'Could not create symlink for test'
+			);
+		}
+
+		$ret_without_reject_symlink = vipgoci_gitrepo_fetch_committed_file(
+			$this->options['repo-owner'],
+			$this->options['repo-name'],
+			$this->options['github-token'],
+			$this->options['commit-test-repo-fetch-committed-file-1'],
+			$symlinked_file_name,
+			$this->options['local-git-repo']
+		);
+
+		$ret_with_reject_symlink = vipgoci_gitrepo_fetch_committed_file(
+			$this->options['repo-owner'],
+			$this->options['repo-name'],
+			$this->options['github-token'],
+			$this->options['commit-test-repo-fetch-committed-file-1'],
+			$symlinked_file_name,
+			$this->options['local-git-repo'],
+			true
+		);
+
+		vipgoci_unittests_output_unsuppress();
+
+		$this->assertSame(
+			'Test file contents. Some text.' . PHP_EOL,
+			$ret_without_reject_symlink
+		);
+
+		$this->assertFalse(
+			$ret_with_reject_symlink
+		);
+	}
 }

tests/integration/helper/LintScanMultipleFiles.php

@@ -16,14 +16,16 @@
  * @param string $commit         Commit-ID.
  * @param string $filename       Name of file.
  * @param string $local_git_repo Local git repository.
+ * @param bool   $reject_symlink Whether symbolic links should return false.
  */
 function vipgoci_gitrepo_fetch_committed_file(
 	string $repo_owner,
 	string $repo_name,
 	string $token,
 	string $commit,
 	string $filename,
-	string $local_git_repo
+	string $local_git_repo,
+	bool $reject_symlink = false
 ) :string {
 	return 'data';
 }
@@ -48,4 +50,3 @@ function vipgoci_report_submit_scanning_files_failed(
 ) :void {
 }
 
-