| 1 |
efrain |
1 |
<?php
|
|
|
2 |
|
|
|
3 |
namespace Aws\EndpointV2\Ruleset;
|
|
|
4 |
|
|
|
5 |
use Aws\Exception\UnresolvedEndpointException;
|
|
|
6 |
|
|
|
7 |
/**
|
|
|
8 |
* Provides functions and actions to be performed for endpoint evaluation.
|
|
|
9 |
* This is an internal only class and is not subject to backwards-compatibility guarantees.
|
|
|
10 |
*
|
|
|
11 |
* @internal
|
|
|
12 |
*/
|
|
|
13 |
class RulesetStandardLibrary
|
|
|
14 |
{
|
|
|
15 |
const IPV4_RE = '/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/';
|
|
|
16 |
const IPV6_RE = '/([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|
|
|
|
17 |
. ([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]
|
|
|
18 |
. {1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:)
|
|
|
19 |
. {1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|
|
|
|
20 |
. [0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:
|
|
|
21 |
. (:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|
|
|
|
22 |
. 1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]
|
|
|
23 |
. {1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]
|
|
|
24 |
. |1{0,1}[0-9]){0,1}[0-9])/';
|
|
|
25 |
const TEMPLATE_ESCAPE_RE = '/{\{\s*(.*?)\s*\}\}/';
|
|
|
26 |
const TEMPLATE_SEARCH_RE = '/\{[a-zA-Z#]+\}/';
|
|
|
27 |
const TEMPLATE_PARSE_RE = '#\{((?>[^\{\}]+)|(?R))*\}#x';
|
|
|
28 |
const HOST_LABEL_RE = '/^(?!-)[a-zA-Z\d-]{1,63}(?<!-)$/';
|
|
|
29 |
|
|
|
30 |
private $partitions;
|
|
|
31 |
|
|
|
32 |
public function __construct($partitions)
|
|
|
33 |
{
|
|
|
34 |
$this->partitions = $partitions;
|
|
|
35 |
}
|
|
|
36 |
|
|
|
37 |
/**
|
|
|
38 |
* Determines if a value is set.
|
|
|
39 |
*
|
|
|
40 |
* @return boolean
|
|
|
41 |
*/
|
|
|
42 |
public function is_set($value)
|
|
|
43 |
{
|
|
|
44 |
return isset($value);
|
|
|
45 |
}
|
|
|
46 |
|
|
|
47 |
/**
|
|
|
48 |
* Function implementation of logical operator `not`
|
|
|
49 |
*
|
|
|
50 |
* @return boolean
|
|
|
51 |
*/
|
|
|
52 |
public function not($value)
|
|
|
53 |
{
|
|
|
54 |
return !$value;
|
|
|
55 |
}
|
|
|
56 |
|
|
|
57 |
/**
|
|
|
58 |
* Find an attribute within a value given a path string.
|
|
|
59 |
*
|
|
|
60 |
* @return mixed
|
|
|
61 |
*/
|
|
|
62 |
public function getAttr($from, $path)
|
|
|
63 |
{
|
|
|
64 |
$parts = explode('.', $path);
|
|
|
65 |
foreach ($parts as $part) {
|
|
|
66 |
$sliceIdx = strpos($part, '[');
|
|
|
67 |
if ($sliceIdx !== false) {
|
|
|
68 |
if (substr($part, -1) !== ']') {
|
|
|
69 |
return null;
|
|
|
70 |
}
|
|
|
71 |
$slice = intval(substr($part, $sliceIdx + 1, strlen($part) - 1));
|
|
|
72 |
$from = isset($from[substr($part,0, $sliceIdx)][$slice])
|
|
|
73 |
? $from[substr($part,0, $sliceIdx)][$slice]
|
|
|
74 |
: null;
|
|
|
75 |
} else {
|
|
|
76 |
$from = $from[$part];
|
|
|
77 |
}
|
|
|
78 |
}
|
|
|
79 |
return $from;
|
|
|
80 |
}
|
|
|
81 |
|
|
|
82 |
/**
|
|
|
83 |
* Computes a substring given the start index and end index. If `reverse` is
|
|
|
84 |
* true, slice the string from the end instead.
|
|
|
85 |
*
|
|
|
86 |
* @return mixed
|
|
|
87 |
*/
|
|
|
88 |
public function substring($input, $start, $stop, $reverse)
|
|
|
89 |
{
|
|
|
90 |
if (!is_string($input)) {
|
|
|
91 |
throw new UnresolvedEndpointException(
|
|
|
92 |
'Input passed to `substring` must be `string`.'
|
|
|
93 |
);
|
|
|
94 |
}
|
|
|
95 |
|
|
|
96 |
if (preg_match('/[^\x00-\x7F]/', $input)) {
|
|
|
97 |
return null;
|
|
|
98 |
}
|
|
|
99 |
if ($start >= $stop or strlen($input) < $stop) {
|
|
|
100 |
return null;
|
|
|
101 |
}
|
|
|
102 |
if (!$reverse) {
|
|
|
103 |
return substr($input, $start, $stop - $start);
|
|
|
104 |
} else {
|
|
|
105 |
$offset = strlen($input) - $stop;
|
|
|
106 |
$length = $stop - $start;
|
|
|
107 |
return substr($input, $offset, $length);
|
|
|
108 |
}
|
|
|
109 |
}
|
|
|
110 |
|
|
|
111 |
/**
|
|
|
112 |
* Evaluates two strings for equality.
|
|
|
113 |
*
|
|
|
114 |
* @return boolean
|
|
|
115 |
*/
|
|
|
116 |
public function stringEquals($string1, $string2)
|
|
|
117 |
{
|
|
|
118 |
if (!is_string($string1) || !is_string($string2)) {
|
|
|
119 |
throw new UnresolvedEndpointException(
|
|
|
120 |
'Values passed to StringEquals must be `string`.'
|
|
|
121 |
);
|
|
|
122 |
}
|
|
|
123 |
return $string1 === $string2;
|
|
|
124 |
}
|
|
|
125 |
|
|
|
126 |
/**
|
|
|
127 |
* Evaluates two booleans for equality.
|
|
|
128 |
*
|
|
|
129 |
* @return boolean
|
|
|
130 |
*/
|
|
|
131 |
public function booleanEquals($boolean1, $boolean2)
|
|
|
132 |
{
|
|
|
133 |
return
|
|
|
134 |
filter_var($boolean1, FILTER_VALIDATE_BOOLEAN)
|
|
|
135 |
=== filter_var($boolean2, FILTER_VALIDATE_BOOLEAN);
|
|
|
136 |
}
|
|
|
137 |
|
|
|
138 |
/**
|
|
|
139 |
* Percent-encodes an input string.
|
|
|
140 |
*
|
|
|
141 |
* @return mixed
|
|
|
142 |
*/
|
|
|
143 |
public function uriEncode($input)
|
|
|
144 |
{
|
|
|
145 |
if (is_null($input)) {
|
|
|
146 |
return null;
|
|
|
147 |
}
|
|
|
148 |
return str_replace('%7E', '~', rawurlencode($input));
|
|
|
149 |
}
|
|
|
150 |
|
|
|
151 |
/**
|
|
|
152 |
* Parses URL string into components.
|
|
|
153 |
*
|
|
|
154 |
* @return mixed
|
|
|
155 |
*/
|
|
|
156 |
public function parseUrl($url)
|
|
|
157 |
{
|
|
|
158 |
$parsed = parse_url($url);
|
|
|
159 |
|
|
|
160 |
if ($parsed === false || !empty($parsed['query'])) {
|
|
|
161 |
return null;
|
|
|
162 |
} elseif (!isset($parsed['scheme'])) {
|
|
|
163 |
return null;
|
|
|
164 |
}
|
|
|
165 |
|
|
|
166 |
if ($parsed['scheme'] !== 'http'
|
|
|
167 |
&& $parsed['scheme'] !== 'https'
|
|
|
168 |
) {
|
|
|
169 |
return null;
|
|
|
170 |
}
|
|
|
171 |
|
|
|
172 |
$urlInfo = [];
|
|
|
173 |
$urlInfo['scheme'] = $parsed['scheme'];
|
|
|
174 |
$urlInfo['authority'] = isset($parsed['host']) ? $parsed['host'] : '';
|
|
|
175 |
if (isset($parsed['port'])) {
|
|
|
176 |
$urlInfo['authority'] = $urlInfo['authority'] . ":" . $parsed['port'];
|
|
|
177 |
}
|
|
|
178 |
$urlInfo['path'] = isset($parsed['path']) ? $parsed['path'] : '';
|
|
|
179 |
$urlInfo['normalizedPath'] = !empty($parsed['path'])
|
|
|
180 |
? rtrim($urlInfo['path'] ?: '', '/' . "/") . '/'
|
|
|
181 |
: '/';
|
|
|
182 |
$urlInfo['isIp'] = !isset($parsed['host']) ?
|
|
|
183 |
'false' : $this->isValidIp($parsed['host']);
|
|
|
184 |
|
|
|
185 |
return $urlInfo;
|
|
|
186 |
}
|
|
|
187 |
|
|
|
188 |
/**
|
|
|
189 |
* Evaluates whether a value is a valid host label per
|
|
|
190 |
* RFC 1123. If allow_subdomains is true, split on `.` and validate
|
|
|
191 |
* each subdomain separately.
|
|
|
192 |
*
|
|
|
193 |
* @return boolean
|
|
|
194 |
*/
|
|
|
195 |
public function isValidHostLabel($hostLabel, $allowSubDomains)
|
|
|
196 |
{
|
|
|
197 |
if (!isset($hostLabel)
|
|
|
198 |
|| (!$allowSubDomains && strpos($hostLabel, '.') != false)
|
|
|
199 |
) {
|
|
|
200 |
return false;
|
|
|
201 |
}
|
|
|
202 |
|
|
|
203 |
if ($allowSubDomains) {
|
|
|
204 |
foreach (explode('.', $hostLabel) as $subdomain) {
|
|
|
205 |
if (!$this->validateHostLabel($subdomain)) {
|
|
|
206 |
return false;
|
|
|
207 |
}
|
|
|
208 |
}
|
|
|
209 |
return true;
|
|
|
210 |
} else {
|
|
|
211 |
return $this->validateHostLabel($hostLabel);
|
|
|
212 |
}
|
|
|
213 |
}
|
|
|
214 |
|
|
|
215 |
/**
|
|
|
216 |
* Parse and validate string for ARN components.
|
|
|
217 |
*
|
|
|
218 |
* @return array|null
|
|
|
219 |
*/
|
|
|
220 |
public function parseArn($arnString)
|
|
|
221 |
{
|
|
|
222 |
if (is_null($arnString)
|
|
|
223 |
|| substr( $arnString, 0, 3 ) !== "arn"
|
|
|
224 |
) {
|
|
|
225 |
return null;
|
|
|
226 |
}
|
|
|
227 |
|
|
|
228 |
$arn = [];
|
|
|
229 |
$parts = explode(':', $arnString, 6);
|
|
|
230 |
if (sizeof($parts) < 6) {
|
|
|
231 |
return null;
|
|
|
232 |
}
|
|
|
233 |
|
|
|
234 |
$arn['partition'] = isset($parts[1]) ? $parts[1] : null;
|
|
|
235 |
$arn['service'] = isset($parts[2]) ? $parts[2] : null;
|
|
|
236 |
$arn['region'] = isset($parts[3]) ? $parts[3] : null;
|
|
|
237 |
$arn['accountId'] = isset($parts[4]) ? $parts[4] : null;
|
|
|
238 |
$arn['resourceId'] = isset($parts[5]) ? $parts[5] : null;
|
|
|
239 |
|
|
|
240 |
if (empty($arn['partition'])
|
|
|
241 |
|| empty($arn['service'])
|
|
|
242 |
|| empty($arn['resourceId'])
|
|
|
243 |
) {
|
|
|
244 |
return null;
|
|
|
245 |
}
|
|
|
246 |
$resource = $arn['resourceId'];
|
|
|
247 |
$arn['resourceId'] = preg_split("/[:\/]/", $resource);
|
|
|
248 |
|
|
|
249 |
return $arn;
|
|
|
250 |
}
|
|
|
251 |
|
|
|
252 |
/**
|
|
|
253 |
* Matches a region string to an AWS partition.
|
|
|
254 |
*
|
|
|
255 |
* @return mixed
|
|
|
256 |
*/
|
|
|
257 |
public function partition($region)
|
|
|
258 |
{
|
|
|
259 |
if (!is_string($region)) {
|
|
|
260 |
throw new UnresolvedEndpointException(
|
|
|
261 |
'Value passed to `partition` must be `string`.'
|
|
|
262 |
);
|
|
|
263 |
}
|
|
|
264 |
|
|
|
265 |
$partitions = $this->partitions;
|
|
|
266 |
foreach ($partitions['partitions'] as $partition) {
|
|
|
267 |
if (array_key_exists($region, $partition['regions'])
|
|
|
268 |
|| preg_match("/{$partition['regionRegex']}/", $region)
|
|
|
269 |
) {
|
|
|
270 |
return $partition['outputs'];
|
|
|
271 |
}
|
|
|
272 |
}
|
|
|
273 |
//return `aws` partition if no match is found.
|
|
|
274 |
return $partitions['partitions'][0]['outputs'];
|
|
|
275 |
}
|
|
|
276 |
|
|
|
277 |
/**
|
|
|
278 |
* Evaluates whether a value is a valid bucket name for virtual host
|
|
|
279 |
* style bucket URLs.
|
|
|
280 |
*
|
|
|
281 |
* @return boolean
|
|
|
282 |
*/
|
|
|
283 |
public function isVirtualHostableS3Bucket($bucketName, $allowSubdomains)
|
|
|
284 |
{
|
|
|
285 |
if ((is_null($bucketName)
|
|
|
286 |
|| (strlen($bucketName) < 3 || strlen($bucketName) > 63))
|
|
|
287 |
|| preg_match(self::IPV4_RE, $bucketName)
|
|
|
288 |
|| strtolower($bucketName) !== $bucketName
|
|
|
289 |
) {
|
|
|
290 |
return false;
|
|
|
291 |
}
|
|
|
292 |
|
|
|
293 |
if ($allowSubdomains) {
|
|
|
294 |
$labels = explode('.', $bucketName);
|
|
|
295 |
$results = [];
|
|
|
296 |
forEach($labels as $label) {
|
|
|
297 |
$results[] = $this->isVirtualHostableS3Bucket($label, false);
|
|
|
298 |
}
|
|
|
299 |
return !in_array(false, $results);
|
|
|
300 |
}
|
|
|
301 |
return $this->isValidHostLabel($bucketName, false);
|
|
|
302 |
}
|
|
|
303 |
|
|
|
304 |
public function callFunction($funcCondition, &$inputParameters)
|
|
|
305 |
{
|
|
|
306 |
$funcArgs = [];
|
|
|
307 |
|
|
|
308 |
forEach($funcCondition['argv'] as $arg) {
|
|
|
309 |
$funcArgs[] = $this->resolveValue($arg, $inputParameters);
|
|
|
310 |
}
|
|
|
311 |
|
|
|
312 |
$funcName = str_replace('aws.', '', $funcCondition['fn']);
|
|
|
313 |
if ($funcName === 'isSet') {
|
|
|
314 |
$funcName = 'is_set';
|
|
|
315 |
}
|
|
|
316 |
|
|
|
317 |
$result = call_user_func_array(
|
|
|
318 |
[RulesetStandardLibrary::class, $funcName],
|
|
|
319 |
$funcArgs
|
|
|
320 |
);
|
|
|
321 |
|
|
|
322 |
if (isset($funcCondition['assign'])) {
|
|
|
323 |
$assign = $funcCondition['assign'];
|
|
|
324 |
if (isset($inputParameters[$assign])){
|
|
|
325 |
throw new UnresolvedEndpointException(
|
|
|
326 |
"Assignment `{$assign}` already exists in input parameters" .
|
|
|
327 |
" or has already been assigned by an endpoint rule and cannot be overwritten."
|
|
|
328 |
);
|
|
|
329 |
}
|
|
|
330 |
$inputParameters[$assign] = $result;
|
|
|
331 |
}
|
|
|
332 |
return $result;
|
|
|
333 |
}
|
|
|
334 |
|
|
|
335 |
public function resolveValue($value, $inputParameters)
|
|
|
336 |
{
|
|
|
337 |
//Given a value, check if it's a function, reference or template.
|
|
|
338 |
//returns resolved value
|
|
|
339 |
if ($this->isFunc($value)) {
|
|
|
340 |
return $this->callFunction($value, $inputParameters);
|
|
|
341 |
} elseif ($this->isRef($value)) {
|
|
|
342 |
return isset($inputParameters[$value['ref']]) ? $inputParameters[$value['ref']] : null;
|
|
|
343 |
} elseif ($this->isTemplate($value)) {
|
|
|
344 |
return $this->resolveTemplateString($value, $inputParameters);
|
|
|
345 |
}
|
|
|
346 |
return $value;
|
|
|
347 |
}
|
|
|
348 |
|
|
|
349 |
public function isFunc($arg)
|
|
|
350 |
{
|
|
|
351 |
return is_array($arg) && isset($arg['fn']);
|
|
|
352 |
}
|
|
|
353 |
|
|
|
354 |
public function isRef($arg)
|
|
|
355 |
{
|
|
|
356 |
return is_array($arg) && isset($arg['ref']);
|
|
|
357 |
}
|
|
|
358 |
|
|
|
359 |
public function isTemplate($arg)
|
|
|
360 |
{
|
|
|
361 |
return is_string($arg) && !empty(preg_match(self::TEMPLATE_SEARCH_RE, $arg));
|
|
|
362 |
}
|
|
|
363 |
|
|
|
364 |
public function resolveTemplateString($value, $inputParameters)
|
|
|
365 |
{
|
|
|
366 |
return preg_replace_callback(
|
|
|
367 |
self::TEMPLATE_PARSE_RE,
|
|
|
368 |
function ($match) use ($inputParameters) {
|
|
|
369 |
if (preg_match(self::TEMPLATE_ESCAPE_RE, $match[0])) {
|
|
|
370 |
return $match[1];
|
|
|
371 |
}
|
|
|
372 |
|
|
|
373 |
$notFoundMessage = 'Resolved value was null. Please check rules and ' .
|
|
|
374 |
'input parameters and try again.';
|
|
|
375 |
|
|
|
376 |
$parts = explode("#", $match[1]);
|
|
|
377 |
if (count($parts) > 1) {
|
|
|
378 |
$resolvedValue = $inputParameters;
|
|
|
379 |
foreach($parts as $part) {
|
|
|
380 |
if (!isset($resolvedValue[$part])) {
|
|
|
381 |
throw new UnresolvedEndpointException($notFoundMessage);
|
|
|
382 |
}
|
|
|
383 |
$resolvedValue = $resolvedValue[$part];
|
|
|
384 |
}
|
|
|
385 |
return $resolvedValue;
|
|
|
386 |
} else {
|
|
|
387 |
if (!isset($inputParameters[$parts[0]])) {
|
|
|
388 |
throw new UnresolvedEndpointException($notFoundMessage);
|
|
|
389 |
}
|
|
|
390 |
return $inputParameters[$parts[0]];
|
|
|
391 |
}
|
|
|
392 |
},
|
|
|
393 |
$value
|
|
|
394 |
);
|
|
|
395 |
}
|
|
|
396 |
|
|
|
397 |
private function validateHostLabel ($hostLabel)
|
|
|
398 |
{
|
|
|
399 |
if (empty($hostLabel) || strlen($hostLabel) > 63) {
|
|
|
400 |
return false;
|
|
|
401 |
}
|
|
|
402 |
if (preg_match(self::HOST_LABEL_RE, $hostLabel)) {
|
|
|
403 |
return true;
|
|
|
404 |
}
|
|
|
405 |
return false;
|
|
|
406 |
}
|
|
|
407 |
|
|
|
408 |
private function isValidIp($hostName)
|
|
|
409 |
{
|
|
|
410 |
$isWrapped = strpos($hostName, '[') === 0
|
|
|
411 |
&& strrpos($hostName, ']') === strlen($hostName) - 1;
|
|
|
412 |
|
|
|
413 |
return preg_match(
|
|
|
414 |
self::IPV4_RE,
|
|
|
415 |
$hostName
|
|
|
416 |
)
|
|
|
417 |
//IPV6 enclosed in brackets
|
|
|
418 |
|| ($isWrapped && preg_match(
|
|
|
419 |
self::IPV6_RE,
|
|
|
420 |
$hostName
|
|
|
421 |
))
|
|
|
422 |
? 'true' : 'false';
|
|
|
423 |
}
|
|
|
424 |
}
|