9MjJ` U d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
d dl m Z m
Z
d dlZd dlZd dlmZ d dlmZ d dlmZ d d lmZ d d
lmZ d d lmZ d d l m Z d d
l m Z m!Z! d dl"m#Z# d dl$m%Z% dZ&e'e(d< dZ)e*e(d< dZ+e'e(d< dZ,e'e(d< ddiZ- G d de!j. Z/ G d d Z0 G d d e Z1d ej2 fd!Z3 e j4 d"eg d# Z5ed$e*d%efd& Z6e j7 G d' d( Z8 dAd$e*d)e*d*e
e* d e8fd+Z9d,Z:d-Z; ej< d. d/f ej< d0 d1f ej< d2 d3f ej< d4 d5ffZ=d6e
e* d e
e* fd7Z>d8e*d9e*d e?fd:Z@ dAd$e*d9e*d*e
e* d e?fd;ZAd$e*d9e*d e?fd<ZBd$e*d=e*fd>ZC dAd$e*d?e*d*e
e* d e8fd@ZDdS )B N)contextmanager)Path)Optional)urlsplit
urlunsplit)drop_privileges)docroot) HTTPAdapter)ChunkedEncodingError)
disable_quota)ReadTimeoutError)gettext)utils
exceptions)is_allowed_ini_path)verify_user_owns_domain
TIMEOUTz 127.0.0.1 _PIN_ADDRESSi _MAX_RESPONSE_BYTESi _CHUNK_BYTESz
User-AgentzjMozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.13) Gecko/20101209 CentOS/3.6-2.el5.centos Firefox/3.6.13c e Zd Zd ZdS )WebsiteNotRespondingc " || _ || _ d S N)urldetails)selfr r s R/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/internal/phpinfo_utils.py__init__z WebsiteNotResponding.__init__6 s N)__name__
__module__ __qualname__r r! r r r 5 s# r! r c " e Zd ZdZdZdefdZdS )_BoundedResponsezDA drop-in replacement exposing `.text` from a bounded streamed read.textr) c || _ d S r r( )r r) s r r z_BoundedResponse.__init__@ s
r! N)r" r# r$ __doc__ __slots__strr r% r! r r' r' ; s: NNIS r! r' c " e Zd ZdZ fdZ xZS )_LoopbackPinnedAdaptera requests adapter that pins every connection to loopback.
The vhost is hosted on this machine; we must not follow the
tenant-controlled public-DNS record. We rewrite the connect target to
``_PIN_ADDRESS`` while keeping the original hostname in the Host header so
the local webserver routes to the correct vhost. The TLS SNI/cert mismatch
that results is tolerated because the caller already requests verify=False.
c t |j }|j }|V|j |j d< t
}|j t
d|j }t | | |_ t j
|fi |S )NHost:)netloc) r r hostnamer3 headersr portr _replacesupersend)r requestkwargssplit
original_host
pinned_netloc __class__s r r9 z_LoopbackPinnedAdapter.sendN s %%
$&+lGOF # (Mz%#/ > >%* > >
$U^^=^%I%IJJGKuww|G..v...r! )r" r# r$ r+ r9
__classcell__)r? s @r r/ r/ D sB / / / / / / / / /r! r/ returnc t j } t }| d| | d| | S )Nhttp://https://)requestsSessionr/ mount)sessionadapters r _pinned_sessionrJ Z sH G$&&G MM)W%%% MM*g&&& Nr! c t 5 }| | t dt d 5 }| t }| t D ]m}|st | t | z t k r+t j t d | t fz |
| n|j pd} | |d }n'# t $ r | dd }Y nw xY wd d d n # 1 swxY w Y d d d n # 1 swxY w Y n# t" $ rK}|j r!t' |j d
t( r t+ | t- | d }~wt. j $ r6}t j t d t- | z d }~ww xY wt3 | S )
zg
retry on:
- ChunkedEncodingError -> sometimes error happens due to network issues/glitch
FT)timeoutverifyr5 stream)
chunk_sizezVphpinfo response for %s exceeds %d bytes; refusing to buffer attacker-controlled body.zutf-8replace)errorsNr )r zUnable to detect php version for website because it is not accessible. Try again and contact an administrator if the issue persists. Original error: %s. )rJ getr HEADERSraise_for_status bytearray iter_contentr lenr r XRayManagerError_extendencodingdecode LookupErrorConnectionErrorargs
isinstancer
r r- rE RequestExceptionr' )r rH responsebufchunkr\ r) es r _request_urlrg b s )0
=' C$+D : : ==E % % ' ' '++C!..,.GG
"
" s88c%jj(+>>>$5 I J J 3456 6 6
5!!!! (3GH
=zz(9z==
=
=
= zz')z<<
=- = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =: 8 8 8
6 j,<== "3A7777 $ 0 0 0)
%
&
& ),A
/0 0 00 D ! !!s E %E
B5D6+DD6!D'$D6&D''D6* E
6D: :E
=D: >E
E
EE EE
G1#AF))G1;1G,,G1username
document_rootc # p K d}dt j d d}||z }t | 5 t 5 | | d d d n # 1 swxY w Y d d d n # 1 swxY w Y |V | d S # | w xY w)Na
d| j v r
d| j S | | j S )Nz/opt/altzalt-php)rz r )r r s r get_full_php_versionz%PhpConfiguration.get_full_php_version s5 * * *5T 355 5 :$"8:::r! c d| j v rt | j | j }n| j }|r t t | d }n'# t t f$ r t d| w xY wt | st d| t | j || j st d| j d| |S )Nz link/confTstrictz2ini_scan_dir does not resolve to an existing dir: z$ini_scan_dir outside allowed paths: z ini_scan_dir not bound to user z: ) rx _resolve_ini_path_in_cagefsrh r- r resolveOSError RuntimeError
ValueErrorr _ini_scan_dir_belongs_to_userr{ )r resolveds r absolute_ini_scan_dirz&PhpConfiguration.absolute_ini_scan_dir s1 $+ + +24=$BSTTHH(H
tH~~ 5 5T 5 B BCC\*
$ $ $
'x00
G8GG 1M8T-EG G
$dm $ $ $ $ s 0A $Bc | j dk S )Nzfpm-fcgi)ry r s r
is_php_fpmzPhpConfiguration.is_php_fpm s !Z//r! ) r" r# r$ r- __annotations__r{ r propertyr r r r r% r! r rv rv s MMMOOO *.# ---
73 7 7 7 X7;3 ; ; ; ;
) ) X)V 0 0 X0 0 0r! rv rc r{ c i }| d D ]F}| s| d \ }}| ||< Gt d| |d|S )N
=)rh r{ r% )r< striprv )rh rc r{ configlinekeyvalues r _parse_configurationr s Ft$$ $ $zz|| ZZ__
Ukkmms / r! /var/cagefs/z /etc/users/z^ea-php(?P\d{2})$z$/opt/cpanel/ea-php{v}/root/etc/php.dz^alt-php(?P\d{2})$z/opt/alt/php{v}/link/confz!^plesk-php(?P\d)(?P\d)$z$/opt/plesk/php/{maj}.{min}/etc/php.dz^php(?P\d{2})$z /usr/local/php{v}/lib/php.conf.dtrusted_handlerc | sdS t D ]J\ }}| t | }|r! |j di | c S KdS )u Build the single global INI_LOCATION for a TRUSTED, FULL PHP handler.
``trusted_handler`` is the account's REAL provisioned handler carrying its
distro family ('ea-php80', 'alt-php80', 'plesk-php80', 'php80'). Returns the
ONE server-wide per-distro+version dir that handler's PHP scans, keyed BY the
distro family — so the derived dir's family always equals the trusted
handler's family, never the family of whatever dir the probe reported.
Returns None when ``trusted_handler`` is empty or carries no distro family
(a bare number such as custom's '80'): the expected dir cannot be uniquely
derived, so the caller default-denies the global per-version accept branch.
Nr% ) _HANDLER_INI_LOCATION_TEMPLATESmatchr- format groupdict)r patterntemplater s r _expected_ini_locationr G sx t < 8 8
c/ 2 233 8"8?77U__%6%677 7 7 7 8 4r! rootr c h | d } || k p| | dz S )zTrue if ``resolved`` is ``root`` itself or a path strictly inside it.
The trailing-separator boundary stops /var/cagefs/01/aliceEVIL from being
treated as inside alice's /var/cagefs/01/alice subtree.
/)rstrip
startswith)r r s r
_is_withinr ] s7 ;;s D t >x 2 24#: > >>r! c $ t | | rdS t t | z | rdS t | }|R t t | d }n# t t f$ r Y dS w xY w||k rdS dS )u
Confirm a resolved (realpath'd) ini_scan_dir is one the tenant may drive.
``resolved`` has already been realpath'd and prefix-checked against
ALLOWED_INI_PREFIXES. That prefix list is intentionally broad and admits
global root-owned dirs, so this is the default-deny binding gate: accept
ONLY paths provably tied to the principal, reject everything else.
In phpinfo mode the legitimate ini_scan_dir is one of:
* the tenant's own CageFS subtree (the link/conf branch is re-rooted there
by _resolve_ini_path_in_cagefs(self.username, ...));
* the tenant's own per-domain /etc/users//... dir;
* for a NON-CageFS tenant (ea-php / Plesk / native), the global, root-owned
per-distro+version INI_LOCATION for the account's PHP handler — e.g.
/opt/cpanel/ea-php80/root/etc/php.d (see xray-ini-placement.md). This is
legitimate, so rejecting it outright would regress those tenants.
The danger is that ``ini_scan_dir`` AND the probe ``phpversion`` are both
served from the tenant's own docroot, so a tenant could report a global dir
its account does NOT actually run. A bare two-digit version compare is not
enough: it is distro-BLIND, so an ea-php80 tenant could report the same-number
alt-php dir /opt/alt/php80/link/conf and steer the root xray.ini write into a
DIFFERENT distro family's server-wide, all-tenant-shared dir (cross-distro
spoof) — on a mixed alt-php+ea-php server that dir exists, so strict resolve
passes. To close that AND the cross-version spoof, the global branch accepts
ONLY the EXACT INI_LOCATION derived from ``trusted_php_version`` — here the
account's REAL provisioned FULL handler carrying its distro family (cPanel
domain['version'] 'ea-php80', Plesk resolve_lsphp_version(handler), DA
opts[...]['ver'] 'php80'), NOT the probe-reported version and NOT a
distro-blind number — and requires ``resolved`` to equal it.
Accepted:
* the tenant's OWN CageFS subtree (/var/cagefs///...);
* the tenant's OWN per-domain panel dir (/etc/users//...);
* the SINGLE INI_LOCATION == _expected_ini_location(trusted_php_version).
Rejected (default-deny): global config dirs with no version segment
(/etc/php.d, /etc/php.scan.d, /etc/cl.php.d, /usr/share/cagefs[-skeleton]
roots), a per-version dir of a DIFFERENT distro family (cross-distro spoof) or
a DIFFERENT version (cross-version spoof) than the trusted handler, a trusted
handler that carries no distro family (a bare number — expected dir cannot be
derived), another tenant's CageFS subtree, another account's
/etc/users// subtree, and any other dir not matched above.
TNr F) _is_own_cagefs_subtreer _USERS_INI_ROOTr r- r r r r )rh r r{ expecteds r r r g s ^ h11 t /H,h77 t &&9::H 4>>111>>??HH & 55 x 4 5s 0A0 0BBc t t | sdS t j | }n# t $ r d}Y nw xY w|r t t | d| | S |t t d d }| d }t | dk o |d | k S )al True if ``resolved`` is inside the tenant's OWN /var/cagefs subtree.
Prefer the exact /var/cagefs// root when the server can
supply the CageFS prefix (cagefsctl). When the prefix is unavailable, fall
back to a structural check that still binds to the principal: the path must
be /var/cagefs//[/...], i.e. ``username`` must occupy the
per-user segment directly under a single shard directory. This never accepts
another tenant's subtree (the username segment is pinned and realpath has
already been applied) and avoids failing closed on a legitimate own-subtree
path when a transient cagefsctl lookup fails. Note such a /var/cagefs path
only reaches here when the prefix WAS resolvable in
_resolve_ini_path_in_cagefs, so the fallback covers a mid-request race, not
a routine "no prefix" case.
FNr r )r _CAGEFS_ROOTr cagefsctl_get_prefix ExceptionrX lstripr< )rh r prefixrelpartss r r r s lH - - u+H55
J \>6>>H>>III 3|$$%%
&
-
-c
2
2C IIcNNE u::? 3uQx8 33s . ==pathc t j | n# t $ r Y dS w xY wd| d|g} t j |dt j }n# t j $ r Y dS w xY w| d rr s
% % % % % % - - - - - - - - * * * * * * " " " " " " ) ) ) ) ) ) 4 4 4 4 4 4 " " " " " " / / / / / / + + + + + + + + 7 7 7 7 7 7 C C C C C C c
' S & & & c J :6 / / / / /[ / / /,) 1 3 4550" 0" 650"f c $ 6
N0 N0 N0 N0 N0 N0 N0 N0d .2 !$ %c]6F * 4 RZ'((+- RZ()) " RZ455+- RZ$%%')
# HSM hsm ,?S ?C ?D ? ? ? ? .2I II!$I %c]I6:I I I IX 4S 4C 4D 4 4 4 4F# S B .2+ ++ "+ %c]+6F+ + + + + +r!