From fd77347542808933c6b6f119261ccc6665fc6dc7 Mon Sep 17 00:00:00 2001 From: Joel Male Date: Wed, 27 May 2026 21:49:08 +1000 Subject: [PATCH] fix: validate class name input and check file write in Make commands Add path traversal protection via PHP class name regex validation to all four Make* commands, check file_put_contents() return value for write failures, and remove the unnecessary \$defer = false property from CartServiceProvider. --- src/CartServiceProvider.php | 2 -- src/Commands/MakeCouponCommand.php | 15 ++++++++++++++- src/Commands/MakeDriverCommand.php | 15 ++++++++++++++- src/Commands/MakeShippingCommand.php | 15 ++++++++++++++- src/Commands/MakeTaxCommand.php | 15 ++++++++++++++- 5 files changed, 56 insertions(+), 6 deletions(-) diff --git a/src/CartServiceProvider.php b/src/CartServiceProvider.php index 724624f..2aeb010 100644 --- a/src/CartServiceProvider.php +++ b/src/CartServiceProvider.php @@ -14,8 +14,6 @@ class CartServiceProvider extends ServiceProvider { - protected $defer = false; - public function boot(): void { if ($this->app->runningInConsole()) { diff --git a/src/Commands/MakeCouponCommand.php b/src/Commands/MakeCouponCommand.php index d176fa5..b29305a 100644 --- a/src/Commands/MakeCouponCommand.php +++ b/src/Commands/MakeCouponCommand.php @@ -15,11 +15,19 @@ class MakeCouponCommand extends Command public function handle(): int { $name = $this->argument('name'); + + if (! preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', $name)) { + $this->error("Invalid class name: [{$name}]. Must be a valid PHP class name."); + + return self::FAILURE; + } + $directory = app_path('Cart/Coupons'); $path = "{$directory}/{$name}.php"; if (file_exists($path)) { $this->error("Coupon already exists: app/Cart/Coupons/{$name}.php"); + return self::FAILURE; } @@ -27,7 +35,12 @@ public function handle(): int mkdir($directory, 0755, true); } - file_put_contents($path, static::stub($name)); + if (file_put_contents($path, static::stub($name)) === false) { + $this->error("Failed to write file: {$path}"); + + return self::FAILURE; + } + $this->info("Coupon created: app/Cart/Coupons/{$name}.php"); return self::SUCCESS; diff --git a/src/Commands/MakeDriverCommand.php b/src/Commands/MakeDriverCommand.php index e4a1b71..415ce78 100644 --- a/src/Commands/MakeDriverCommand.php +++ b/src/Commands/MakeDriverCommand.php @@ -15,11 +15,19 @@ class MakeDriverCommand extends Command public function handle(): int { $name = $this->argument('name'); + + if (! preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', $name)) { + $this->error("Invalid class name: [{$name}]. Must be a valid PHP class name."); + + return self::FAILURE; + } + $directory = app_path('Cart/Drivers'); $path = "{$directory}/{$name}.php"; if (file_exists($path)) { $this->error("Driver already exists: app/Cart/Drivers/{$name}.php"); + return self::FAILURE; } @@ -27,7 +35,12 @@ public function handle(): int mkdir($directory, 0755, true); } - file_put_contents($path, static::stub($name)); + if (file_put_contents($path, static::stub($name)) === false) { + $this->error("Failed to write file: {$path}"); + + return self::FAILURE; + } + $this->info("Driver created: app/Cart/Drivers/{$name}.php"); $this->line(" Register it in config/cart.php under drivers."); diff --git a/src/Commands/MakeShippingCommand.php b/src/Commands/MakeShippingCommand.php index 61aa669..ebe36c9 100644 --- a/src/Commands/MakeShippingCommand.php +++ b/src/Commands/MakeShippingCommand.php @@ -15,11 +15,19 @@ class MakeShippingCommand extends Command public function handle(): int { $name = $this->argument('name'); + + if (! preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', $name)) { + $this->error("Invalid class name: [{$name}]. Must be a valid PHP class name."); + + return self::FAILURE; + } + $directory = app_path('Cart/Shipping'); $path = "{$directory}/{$name}.php"; if (file_exists($path)) { $this->error("Shipping rate already exists: app/Cart/Shipping/{$name}.php"); + return self::FAILURE; } @@ -27,7 +35,12 @@ public function handle(): int mkdir($directory, 0755, true); } - file_put_contents($path, static::stub($name)); + if (file_put_contents($path, static::stub($name)) === false) { + $this->error("Failed to write file: {$path}"); + + return self::FAILURE; + } + $this->info("Shipping rate created: app/Cart/Shipping/{$name}.php"); return self::SUCCESS; diff --git a/src/Commands/MakeTaxCommand.php b/src/Commands/MakeTaxCommand.php index 8295443..576d70e 100644 --- a/src/Commands/MakeTaxCommand.php +++ b/src/Commands/MakeTaxCommand.php @@ -15,11 +15,19 @@ class MakeTaxCommand extends Command public function handle(): int { $name = $this->argument('name'); + + if (! preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', $name)) { + $this->error("Invalid class name: [{$name}]. Must be a valid PHP class name."); + + return self::FAILURE; + } + $directory = app_path('Cart/Tax'); $path = "{$directory}/{$name}.php"; if (file_exists($path)) { $this->error("Tax rule already exists: app/Cart/Tax/{$name}.php"); + return self::FAILURE; } @@ -27,7 +35,12 @@ public function handle(): int mkdir($directory, 0755, true); } - file_put_contents($path, static::stub($name)); + if (file_put_contents($path, static::stub($name)) === false) { + $this->error("Failed to write file: {$path}"); + + return self::FAILURE; + } + $this->info("Tax rule created: app/Cart/Tax/{$name}.php"); return self::SUCCESS;