Prevent path traversal in static-file & front-controller serving

cli/Valet/Drivers/Specific/ContaoValetDriver.php

@@ -11,15 +11,36 @@ class ContaoValetDriver extends ValetDriver
      */
     public function serves(string $sitePath, string $siteName, string $uri): bool
     {
-        return is_dir($sitePath.'/vendor/contao') && file_exists($sitePath.'/web/app.php');
+        $frontControllerDirectory = $this->frontControllerDirectory($sitePath);
+
+        return is_dir($sitePath.'/vendor/contao') && file_exists($sitePath.'/'.$frontControllerDirectory.'/index.php');
+    }
+
+    /**
+     * Determine the name of the directory where the front controller lives.
+     */
+    public function frontControllerDirectory(string $sitePath): string
+    {
+        $dirs = ['web', 'public'];
+
+        foreach ($dirs as $dir) {
+            if (is_dir($sitePath.'/'.$dir)) {
+                return $dir;
+            }
+        }
+
+        // Give up, and just return the default
+        return 'public';
     }
 
     /**
      * Determine if the incoming request is for a static file.
      */
     public function isStaticFile(string $sitePath, string $siteName, string $uri)
     {
-        if ($this->isActualFile($staticFilePath = $sitePath.'/web'.$uri)) {
+        $frontControllerDirectory = $this->frontControllerDirectory($sitePath);
+
+        if ($this->isActualFile($staticFilePath = $sitePath.'/'.$frontControllerDirectory.$uri)) {
             return $staticFilePath;
         }
 
@@ -31,17 +52,22 @@ public function isStaticFile(string $sitePath, string $siteName, string $uri)
      */
     public function frontControllerPath(string $sitePath, string $siteName, string $uri): ?string
     {
-        if ($uri === '/install.php') {
-            return $sitePath.'/web/install.php';
+        $frontControllerDirectory = $this->frontControllerDirectory($sitePath);
+
+        if (strncmp($uri, '/contao-manager.phar.php', 24) === 0) {
+            $_SERVER['SCRIPT_NAME'] = '/contao-manager.phar.php';
+            $_SERVER['SCRIPT_FILENAME'] = $sitePath.'/contao-manager.phar.php';
+
+            return $sitePath.'/'.$frontControllerDirectory.'/contao-manager.phar.php';
         }
 
-        if (strncmp($uri, '/app_dev.php', 12) === 0) {
-            $_SERVER['SCRIPT_NAME'] = '/app_dev.php';
-            $_SERVER['SCRIPT_FILENAME'] = $sitePath.'/app_dev.php';
+        if (strncmp($uri, '/preview.php', 12) === 0) {
+            $_SERVER['SCRIPT_NAME'] = '/preview.php';
+            $_SERVER['SCRIPT_FILENAME'] = $sitePath.'/preview.php';
 
-            return $sitePath.'/web/app_dev.php';
+            return $sitePath.'/'.$frontControllerDirectory.'/preview.php';
         }
 
-        return $sitePath.'/web/app.php';
+        return $sitePath.'/'.$frontControllerDirectory.'/index.php';
     }
 }

cli/Valet/Drivers/Specific/NetteValetDriver.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace Valet\Drivers\Specific;
+
+use Valet\Drivers\ValetDriver;
+
+class NetteValetDriver extends ValetDriver
+{
+    /**
+     * Determine if the driver serves the request.
+     */
+    public function serves(string $sitePath, string $siteName, string $uri): bool
+    {
+        return file_exists($sitePath.'/www/index.php')
+            && file_exists($sitePath.'/www/.htaccess')
+            && file_exists($sitePath.'/config/common.neon')
+            && file_exists($sitePath.'/config/services.neon');
+    }
+
+    /**
+     * Determine if the incoming request is for a static file.
+     */
+    public function isStaticFile(string $sitePath, string $siteName, string $uri)/* : string|false */
+    {
+        if ($this->isActualFile($staticFilePath = $sitePath.'/www/'.$uri)) {
+            return $staticFilePath;
+        }
+
+        return false;
+    }
+
+    /**
+     * Get the fully resolved path to the application's front controller.
+     */
+    public function frontControllerPath(string $sitePath, string $siteName, string $uri): ?string
+    {
+        $_SERVER['DOCUMENT_ROOT'] = $sitePath.'/www';
+        $_SERVER['SCRIPT_FILENAME'] = $sitePath.'/www/index.php';
+        $_SERVER['SCRIPT_NAME'] = '/index.php';
+        $_SERVER['PHP_SELF'] = '/index.php';
+
+        return $sitePath.'/www/index.php';
+    }
+}

cli/Valet/Server.php

@@ -30,6 +30,28 @@ public static function domainFromSiteName(string $siteName): string
         return array_slice(explode('.', $siteName), -1)[0];
     }
 
+    /**
+     * Determine whether a resolved path stays inside the given root directory.
+     *
+     * Guards against path traversal: both arguments are resolved with realpath()
+     * and the path must equal the root or sit beneath it. Returns false when
+     * either path cannot be resolved (e.g. the file does not exist).
+     */
+    public static function isWithin(string $path, string $root): bool
+    {
+        $realPath = realpath($path);
+        $realRoot = realpath($root);
+
+        if ($realPath === false || $realRoot === false) {
+            return false;
+        }
+
+        // Note: avoid str_starts_with(); this runs under the site's (possibly
+        // isolated, older) PHP version.
+        return $realPath === $realRoot
+            || strpos($realPath, $realRoot.DIRECTORY_SEPARATOR) === 0;
+    }
+
     /**
      * Show the Valet 404 "Not Found" page.
      */

composer.json

@@ -54,6 +54,7 @@
         "mockery/mockery": "^1.2.3",
         "phpunit/phpunit": "~5.5|^9.0",
         "phpstan/phpstan": "^1.4",
+        "phpstan/phpstan-mockery": "^1.1",
         "squizlabs/php_codesniffer": "^3.9",
         "friendsofphp/php-cs-fixer": "^3.3",
         "symfony/var-dumper": "^7.0",
@@ -63,7 +64,11 @@
         "post-install-cmd": [
         ],
         "post-update-cmd": [
-        ]
+        ],
+        "test": "phpunit",
+        "stan": "phpstan analyse --memory-limit=1G",
+        "cs": "php-cs-fixer fix --dry-run --diff",
+        "cs:fix": "php-cs-fixer fix"
     },
     "bin": [
         "valet"