search

opnsense / plugins

OPNsense plugin collection
https://opnsense.org/
BSD 2-Clause "Simplified" License
818 stars 599 forks source link

Insecure array in in_array condition in os-nextcloud-backup plugin #3792

Open mixmint opened 5 months ago

mixmint commented 5 months ago

On line 268 of /usr/local/opnsense/mvc/app/library/OPNsense/Backup/Nextcloud.php there is a condition for in_array

if (in_array("/{$backupdir}/", $directories)) {

where it happens that "haystack" turns out to be null and then generates an error

PHP Fatal error: Uncaught TypeError: in_array(): Argument #2 ($haystack) must be of type array, null given in /usr/local/opnsense/mvc/app/library/OPNsense/Backup/Nextcloud.php:268

it (but also all instances of in_array) could be protected with a declaration (array) in two ways:

In the same condition as below if (in_array("/{$backupdir}/", (array) $directories)) {

The second way is to analyze why the reference to the listFiles method falls into the catch. Due to the fact that the condition is executed outside the try, it may happen that after catching an error in the listFiles method, the catch $directories variable will only contain null

OPNsense-bot commented 5 months ago

Thank you for creating an issue. Since the ticket doesn't seem to be using one of our templates, we're marking this issue as low priority until further notice.

For more information about the policies for this repository, please read https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md for further details.

The easiest option to gain traction is to close this ticket and open a new one using one of our templates.