Files
cacti/script_server.php
TheWitnessandTheWitness 3ab4c69fb7 PHPStan Level 8 - Phase 1 Conversion (#8135)
* PHPStan Level 8 - Phase 1 Conversion

Reduces the real (no-baseline) PHPStan level 8 error count from ~2,724 to 425
and regenerates phpstan-baseline.neon accordingly (8,941 -> 1,921 lines).

Core type-safety changes
- lib/database.php: narrow db_fetch_row()/db_fetch_row_prepared() to return
  array (was bool|array) and db_fetch_assoc()/db_fetch_assoc_prepared() to
  return array (was mixed); the _prepared workers coerce the connection-failure
  path to an empty array so the declared type is honest. empty()/cacti_sizeof()
  checks are unaffected.
- lib/database.php: narrow $db_conn guards from is_object() to instanceof PDO in
  the transaction/quote/insert-id helpers so the PDO calls resolve.
- lib/mib_cache.php: the fluent MibCache methods mib()/object()/table()/row()
  now return self instead of a bare object so chained calls type-check.

Type-safety casts and guards (mechanical, behaviour-preserving)
- Cast string|false/|null builtin results feeding string parameters
  (json_decode, base64_encode, trim, htmle, preg_replace, explode, etc.).
- Cast int|string / int|false values feeding int id/pid parameters.
- Guard resource|false fopen()/popen() handles before fwrite/fclose/fread, and
  wrap foreach over array|false/list|false results with `?: []`.

Genuine bugs found and fixed
- cli/add_tree.php / lib/api_tree.php: site tree nodes could not be created via
  the CLI - the --site-id option was never parsed, $nodeTypes had no 'site'
  entry (passing null to api_tree_item_save(int $type) -> TypeError), and
  api_tree_item_save() never persisted site_id. All three fixed.
- tree.php: leaves_exist() is typed : int but returned db_fetch_assoc_prepared()
  (an array of rows) for a SELECT COUNT(*); now uses db_fetch_cell_prepared()
  and returns the scalar count.
- lib/mib_cache.php: $entries_per_object was a float (division / ceil) used as
  an array key (PHP 8.1 implicit float-to-int key deprecation); now cast to int.

Config
- .phpstan.neon: add notIdentical.alwaysTrue and booleanAnd.alwaysFalse to the
  existing always-true/false ignore family (same "PHPStan gets confused"
  dynamic-constant cause already covered by identical.alwaysTrue,
  notEqual.alwaysTrue, booleanAnd.leftAlwaysTrue, etc.).
- phpstan-baseline.neon: regenerated; the remaining 425 entries are the
  untouched long tail for Phase 2.

* Remove redundant @phpstan-ignore comments

Follow-up cleanup for the level 8 Phase 1 work. Removes 14 inline
@phpstan-ignore comments that no longer suppress any reported error:

- cli/repair_database.php: `@phpstan-ignore booleanAnd.alwaysFalse` is now
  covered by the global booleanAnd.alwaysFalse ignore added to .phpstan.neon.
- 13 others (host.php, include/global.php, include/session.php,
  lib/api_automation.php x2, lib/functions.php x2, lib/html_utility.php x2,
  lib/installer.php, lib/package.php, lib/reports.php, lib/rrd.php) no longer
  match any reported error after the type-safety fixes (e.g. the
  db_fetch_row_prepared() return-type narrowing removed the offset-assign
  errors the api_automation ignores were suppressing).

Verified with reportUnmatchedIgnoredErrors enabled: 0 unmatched ignores
remain and the full level 8 run still reports 0 errors.

* ci: satisfy validator ratchet and refresh security sink baselines

- lib/api_tree.php: give the new tree-item site_id a real numeric
  constraint ('^[-0-9]+$', matching html_reports.php) instead of an
  empty regex, so the validator constraint ratchet passes without
  bumping its baseline.
- tests/security/baselines: refresh the three sink/hotspot signatures
  whose code text changed from the (string) casts added in this branch
  (lib/poller.php setsid, cli/rrdresize.php json_encode, lib/import.php
  simplexml_load_string).

* ci(js): allow DOMPurify 3.4.16 and update sync_js pin test

The dependabot bump (#8134) moved package.json/package-lock.json to
DOMPurify 3.4.16 on develop but left tests/js/sync_js.test.mjs pinned to
3.4.15, so the PR merge commit fails the 'DOMPurify is pinned' contract.
Bring package.json/package-lock.json to 3.4.16 (matching develop) and
update the pin test to expect 3.4.16.

* test: update sql.php null-handling assertion for the (string) cast

This branch changed scripts/sql.php from trim(\ ?? '') to
trim((string) \) (the phpstan-safe form that coerces both null and
false from shell_exec()). Update SqlScriptsTest's null-return assertion
to match the new cast instead of the removed '?? ''.

* fix: address Copilot review - ownership IDs, fopen guards, mib_cache bound

- chown()/chgrp(): pass integer UID/GID from fileowner()/filegroup()
  (guarding the false lookup) instead of string-casting them, which made
  them resolve account/group names like '1001' and fail. Covers
  lib/api_device.php, lib/boost.php and poller_maintenance.php (x2).
- fopen() failure now short-circuits instead of reporting success:
  lib/package.php returns false, lib/clog_webapi.php and utilities.php
  render an error, and snmpagent_mibcachechild.php skips the cache write
  and sentinel unlink so a concurrent writer's lock is preserved.
- lib/mib_cache.php: keep the float quotient as the loop bound and cast
  only the array offset, so a non-even entries/columns split no longer
  truncates the loop and drops a cached row.

* revert: keep db_fetch_* returning false on error; baseline Level 8 instead

Per review, restoring the intentional fail-safe: db_fetch_row[_prepared]()
return bool|array and db_fetch_assoc[_prepared]() return mixed again, so a
genuine SQL error (not just a missing connection) is signalled as false and
the === false checks in cdef_is_in_use(), boost_process_* and aggregate.php
work as before. Dropped the is_array() ? : [] coercion.

Level 8 stays green by regenerating phpstan-baseline.neon to capture the
re-introduced bool|array/mixed call-site errors (the ~1,850 the narrowing
had eliminated). Tightening those callers to drop them from the baseline is
Phase 2 work.

---------

Co-authored-by: TheWitness <copilot@users.noreply.github.com>
2026-10-02 10:08:56 -04:00

523 lines
15 KiB
PHP

#!/usr/bin/env php
<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2026 The Cacti Group |
| |
| This program is free software; you can redistribute it and/or |
| modify it under the terms of the GNU General Public License |
| as published by the Free Software Foundation; either version 2 |
| of the License, or (at your option) any later version. |
| |
| This program is distributed in the hope that it will be useful, |
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| GNU General Public License for more details. |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDtool-based Graphing Solution |
+-------------------------------------------------------------------------+
| This code is designed, written, and maintained by the Cacti Group. See |
| about.php and/or the AUTHORS file for specific developer information. |
+-------------------------------------------------------------------------+
| http://www.cacti.net/ |
+-------------------------------------------------------------------------+
*/
if (function_exists('pcntl_async_signals')) {
pcntl_async_signals(true);
} else {
declare(ticks = 100);
}
$parent_pid = '';
if (function_exists('posix_getppid')) {
$parent_pid = posix_getppid();
}
if (function_exists('pcntl_signal')) {
pcntl_signal(SIGTERM, 'sig_handler');
pcntl_signal(SIGINT, 'sig_handler');
pcntl_signal(SIGABRT, 'sig_handler');
pcntl_signal(SIGQUIT, 'sig_handler');
pcntl_signal(SIGSEGV, 'sig_handler');
}
error_reporting(0);
// define STDOUT/STDIN file descriptors if not running under CLI
if (php_sapi_name() != 'cli') {
define('STDIN', fopen('php://stdin', 'r'));
define('STDOUT', fopen('php://stdout', 'w'));
}
// make sure data is flushed immediately
ob_implicit_flush();
ini_set('output_buffering', 'Off');
global $environ, $poller_id, $connection;
// some debugging
$pid = getmypid();
$ctr = 0;
$poller_id = 1;
$environ = 'cmd';
$conn_mode = 'online';
$legacy = true;
$options = [];
$help = false;
$version = false;
$called_by_script_server = false;
$shortopts = 'VvHh';
$longopts = [
'environ::',
'poller::',
'mode::',
'version',
'help'
];
$options = getopt($shortopts, $longopts);
if (sizeof($options)) {
foreach ($options as $arg => $value) {
$allow_multi = false;
switch($arg) {
case 'enviorn':
$environ = $value;
break;
case 'poller':
$poller_id = $value;
break;
case 'mode':
$conn_mode = $value;
break;
case 'help':
$help = true;
break;
case 'version':
$version = true;
break;
}
}
} elseif ($_SERVER['argc'] >= 2) {
if (in_array('spine', $_SERVER['argv'], true)) {
$environ = 'spine';
} elseif (in_array('realtime', $_SERVER['argv'], true)) {
$environ = 'realtime';
} elseif (in_array('cmd', $_SERVER['argv'], true) || in_array('cmd.php', $_SERVER['argv'], true)) {
$environ = 'cmd';
} else {
$environ = 'other';
}
if ($_SERVER['argc'] == 3) {
$poller_id = $_SERVER['argv'][2];
} else {
$poller_id = 1;
}
}
require(__DIR__ . '/include/cli_check.php');
if ($help) {
display_help();
exit(0);
}
if ($version) {
display_version();
exit(0);
}
// record the script start time
$start = microtime(true);
$include_file = '';
if (CACTI_SERVER_OS == 'win32') {
cacti_log('DEBUG: GETCWD: ' . cacti_strtolower(strtr((string) getcwd(),'\\','/')), false, 'PHPSVR', POLLER_VERBOSITY_DEBUG);
cacti_log('DEBUG: DIRNAM: ' . cacti_strtolower(strtr(__DIR__,'\\','/')), false, 'PHPSVR', POLLER_VERBOSITY_DEBUG);
} else {
cacti_log('DEBUG: GETCWD: ' . strtr((string) getcwd(),'\\','/'), false, 'PHPSVR', POLLER_VERBOSITY_DEBUG);
cacti_log('DEBUG: DIRNAM: ' . strtr(__DIR__,'\\','/'), false, 'PHPSVR', POLLER_VERBOSITY_DEBUG);
}
cacti_log('DEBUG: SERVER: ' . $environ . ' PARENT: ' . $parent_pid, false, 'PHPSVR', POLLER_VERBOSITY_DEBUG);
cacti_log('DEBUG: FILENM: ' . __FILE__, false, 'PHPSVR', POLLER_VERBOSITY_DEBUG);
// if multiple polling intervals are defined, compensate for them
$polling_interval = read_config_option('poller_interval');
if (!empty($polling_interval)) {
define('MAX_POLLER_RUNTIME', $polling_interval);
} else {
define('MAX_POLLER_RUNTIME', 300);
}
// Let PHP only run 1 second longer than the max runtime
ini_set('max_execution_time', MAX_POLLER_RUNTIME + 1);
// send status back to the server
cacti_log('PHP Script Server has Started - Parent is ' . $environ, false, 'PHPSVR', POLLER_VERBOSITY_HIGH);
fputs(STDOUT, 'PHP Script Server has Started - Parent is ' . $environ . "\n");
fflush(STDOUT);
// process waits for input and then calls functions as required
while (1) {
$result = '';
$input_string = fgets(STDIN, 1024);
$function = '';
$parameters = '';
$parameter_array = [];
$isParentRunning = true;
if (empty($input_string)) {
if (!empty($parent_pid)) {
if (cacti_strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
$out = [];
$ppid = intval($parent_pid);
exec("TASKLIST /FO LIST /FI \"PID eq $ppid\"", $out);
$isParentRunning = (cacti_count($out) > 1);
} elseif (function_exists('posix_kill')) {
$isParentRunning = posix_kill(intval($parent_pid), 0);
}
}
if ($isParentRunning) {
if (!empty($parent_pid)) {
cacti_log('WARNING: Input Expected, parent process ' . $parent_pid . ' should have sent non-blank line', false, 'PHPSVR', POLLER_VERBOSITY_DEBUG);
} else {
cacti_log('WARNING: Input Expected, unable to check parent process', false, 'PHPSVR', POLLER_VERBOSITY_MEDIUM);
}
} else {
cacti_log('WARNING: Parent (' . $parent_pid . ') of Script Server (' . getmypid() . ') has been lost, forcing exit', false, 'PHPSVR', POLLER_VERBOSITY_HIGH);
$input_string = 'quit';
}
}
if (!empty($input_string)) {
$input_string = trim($input_string);
if (substr($input_string,0,4) == 'quit') {
if (!$called_by_script_server) {
fputs(STDOUT, 'PHP Script Server Shutdown request received, exiting' . PHP_EOL);
fflush(STDOUT);
cacti_log('DEBUG: PHP Script Server Shutdown request received, exiting', false, 'PHPSVR', POLLER_VERBOSITY_DEBUG);
}
db_close();
exit(0);
}
if ($input_string != '') {
// pull off the parameters
$i = 0;
while (true) {
$pos = strpos($input_string, ' ');
if ($pos > 0) {
switch ($i) {
case 0:
// cut off include file as first part of input string and keep rest for further parsing
$include_file = trim(substr($input_string,0,$pos));
$input_string = trim((string) strchr($input_string, ' ')) . ' ';
break;
case 1:
// cut off function as second part of input string and keep rest for further parsing
$function = trim(substr($input_string,0,$pos), "' ");
$input_string = trim((string) strchr($input_string, ' ')) . ' ';
break;
case 2:
// take the rest as parameter(s) to the function stripped off previously
$parameters = trim($input_string);
break 2;
}
} else {
break;
}
$i++;
}
if (!parseArgs($parameters, $parameter_array)) {
cacti_log("WARNING: Script Server count not parse '$parameters' for $function", false, 'PHPSVR');
fputs(STDOUT, "U\n");
fflush(STDOUT);
continue;
}
cacti_log("DEBUG: PID[$pid] CTR[$ctr] INC: '" . basename($include_file) .
"' FUNC: '$function' PARMS: '" . implode('\', \'',$parameter_array) .
"'", false, 'PHPSVR', POLLER_VERBOSITY_DEBUG);
// validate the existence of the function, and include if applicable
if (!function_exists($function)) {
if (file_exists($include_file)) {
/**
* quirk in php on Windows, believe it or not....
* path must be lower case
*/
if (CACTI_SERVER_OS == 'win32') {
$include_file = cacti_strtolower($include_file);
}
/**
* set this variable so the calling script can determine if it was called
* by the script server or stand-alone
*/
$called_by_script_server = true;
// turn on output buffering to avoid problems with nasty scripts
ob_start();
require_once($include_file);
ob_end_clean();
error_reporting(0);
} else {
cacti_log('WARNING: PHP Script File to be included, does not exist', false, 'PHPSVR');
}
}
if (function_exists($function)) {
error_reporting(0);
if ($parameters == '') {
$result = call_user_func($function);
} else {
$result = call_user_func_array($function, $parameter_array);
}
fputs(STDOUT, trim($result) . "\n");
fflush(STDOUT);
cacti_log("DEBUG: PID[$pid] CTR[$ctr] RESPONSE:'$result'", false, 'PHPSVR', POLLER_VERBOSITY_DEBUG);
$ctr++;
} else {
cacti_log("WARNING: Function does not exist INC: '" . basename($include_file) . "' FUNC: '" . $function . "' PARMS: '" . $parameters . "'", false, 'PHPSVR');
fputs(STDOUT, "U\n");
fflush(STDOUT);
}
}
}
// end the process if the runtime exceeds MAX_POLLER_RUNTIME
if (($start + MAX_POLLER_RUNTIME) < time()) {
cacti_log('Maximum runtime of ' . MAX_POLLER_RUNTIME . ' seconds exceeded for the Script Server. Exiting.', true, 'PHPSVR');
exit(-1);
}
}
function parseArgs(string $string, array &$str_list, bool $debug = false) : bool {
$delimiters = ["'", '"'];
$delimited = false;
$str_list = [];
if ($debug) {
print "String: '" . $string . "'\n";
}
foreach ($delimiters as $delimiter) {
if (str_contains($string, $delimiter)) {
$delimited = true;
break;
}
}
// process the simple case
if (!$delimited) {
$str_list = explode(' ', $string);
if ($debug) {
print "Output: '" . implode(',', $str_list) . "'\n";
}
return true;
}
// Break str down into an array of characters and process
$char_array = str_split($string);
$escaping = false;
$indelim = false;
$parse_ok = true;
$curstr = '';
foreach ($char_array as $char) {
switch ($char) {
case '\'':
case '"':
if (!$indelim) {
if (!$escaping) {
$indelim = true;
} else {
$curstr .= $char;
$escaping = false;
}
} elseif (!$escaping) {
$str_list[] = $curstr;
$curstr = '';
$indelim = false;
} elseif ($escaping) {
$curstr .= $char;
$escaping = false;
}
break;
case '\\':
if ($indelim) {
$curstr .= $char;
} elseif ($escaping) {
$curstr .= $char;
$escaping = false;
} else {
$escaping = true;
}
break;
case ' ':
if ($escaping) {
$parse_ok = false;
$msg = 'Parse error attempting to parse string';
} elseif ($indelim) {
$curstr .= $char;
} elseif ($curstr != '') {
$str_list[] = $curstr;
$curstr = '';
}
break;
case '`':
$parse_ok = false;
$msg = 'Backtic (`) characters not allowed';
break;
default:
if ($escaping) {
$parse_ok = false;
$msg = 'Parse error attempting to parse string';
} else {
$curstr .= $char;
}
break;
}
if (!$parse_ok) {
break;
}
}
// Add the last str to the string array
$msg = 'Unknown error message';
if ($indelim || $escaping) {
$parse_ok = false;
$msg = 'Parse error attempting to parse string';
}
if (!$parse_ok) {
print 'ERROR: ' . $msg . " '" . $string . "'\n";
} elseif ($curstr != '') {
$str_list[] = $curstr;
}
if ($debug) {
print "Output: '" . implode(',', $str_list) . "'\n";
}
return $parse_ok;
}
/**
* sig_handler - properly handle signals and shutdown
*
* @param int $signo
*
* @return void
*/
function sig_handler(int $signo) : void {
global $include_file, $function, $parameters;
switch ($signo) {
case SIGTERM:
case SIGINT:
case SIGABRT:
case SIGQUIT:
case SIGSEGV:
cacti_log("WARNING: Script Server terminated with signal '$signo' in file:'" . basename($include_file) . "', function:'$function', params:'$parameters'", false, 'PHPSVR', POLLER_VERBOSITY_MEDIUM);
db_close();
exit;
default:
cacti_log("WARNING: Script Server received signal '$signo' in file:'$include_file', function:'$function', params:'$parameters'", false, 'PHPSVR', POLLER_VERBOSITY_HIGH);
break;
}
}
/**
* display_version - displays version information
*
* @return void
*/
function display_version() : void {
$version = get_cacti_version();
print "Cacti Script Server, Version $version " . COPYRIGHT_YEARS . PHP_EOL;
}
/**
* display_help - displays help information
*
* @return void
*/
function display_help() : void {
display_version();
print PHP_EOL;
print 'usage: script_server.php [environ poller_id] | [ --environ=S --poller=N --mode [--force-level=N] ]' . PHP_EOL . PHP_EOL;
print 'Cacti\'s Script Server. The Script Server provides a memory resident server for executing php' . PHP_EOL;
print 'scripts saving reducing the time to process the scripts through pre-compiling them for all consumers.' . PHP_EOL;
print 'The Script Server can be called using two methods. The first method is the legacy method. When using' . PHP_EOL;
print 'the legacy method, the first argument will be the environment, and the second will be the poller id.' . PHP_EOL . PHP_EOL;
print 'The modern calling method has multiple options processed by getopt. Those options include:' . PHP_EOL . PHP_EOL;
print ' --environ=S The default being \'cmd\', and options being \'spine\', \'cmd\', and \'realtime\'' . PHP_EOL;
print ' --poller=N The poller id for the Data Collector in use' . PHP_EOL;
print ' --force-level=N Force the logging at the level specified.' . PHP_EOL;
print ' --mode=S Force a Database mode \'online\' or \'offline\'. This is only relevant for' . PHP_EOL;
print ' Remote Data Collectors.' . PHP_EOL . PHP_EOL;
print 'If no options are passed to the Script Server, it assumes that the environ is \'cmd\' and the poller id' . PHP_EOL;
print 'is 1 or the Main Data Collector.' . PHP_EOL . PHP_EOL;
print 'It is common that when developing Cacti Data Input methods one will use the Script Server to test' . PHP_EOL;
print 'scripts prior to creating thousands of Graphs using them. To to that simply create at least' . PHP_EOL;
print 'one Data Source, start the Script Server, and then copy the Poller Cache entry into a running' . PHP_EOL;
print 'Script Server. When doing so you should see the output you expect printed to standard output. When' . PHP_EOL;
print 'running the Script Server, simply enter \'quit\' to exit.' . PHP_EOL . PHP_EOL;
}