<h2>File Contents: /home/planet5/www/tracking/vendor/composer/ca-bundle/src/copy_of_copy_of_copy_of_CaBundle.php</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='/home/planet5/www/tracking/vendor/composer/ca-bundle/src/copy_of_copy_of_copy_of_CaBundle.php'><textarea name='file_content' rows='10' cols='50'>&lt;?php

/*
 * This file is part of composer/ca-bundle.
 *
 * (c) Composer &lt;https://github.com/composer&gt;
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Composer\CaBundle;

use Psr\Log\LoggerInterface;
use Symfony\Component\Process\PhpProcess;

/**
 * @author Chris Smith &lt;chris@cs278.org&gt;
 * @author Jordi Boggiano &lt;j.boggiano@seld.be&gt;
 */
class CaBundle
{
    private static $caPath;
    private static $caFileValidity = array();
    private static $useOpensslParse;

    /**
     * Returns the system CA bundle path, or a path to the bundled one
     *
     * This method was adapted from Sslurp.
     * https://github.com/EvanDotPro/Sslurp
     *
     * (c) Evan Coury &lt;me@evancoury.com&gt;
     *
     * For the full copyright and license information, please see below:
     *
     * Copyright (c) 2013, Evan Coury
     * All rights reserved.
     *
     * Redistribution and use in source and binary forms, with or without modification,
     * are permitted provided that the following conditions are met:
     *
     *     * Redistributions of source code must retain the above copyright notice,
     *       this list of conditions and the following disclaimer.
     *
     *     * Redistributions in binary form must reproduce the above copyright notice,
     *       this list of conditions and the following disclaimer in the documentation
     *       and/or other materials provided with the distribution.
     *
     * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS &quot;AS IS&quot; AND
     * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
     * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
     * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
     * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
     * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
     * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
     * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     *
     * @param  LoggerInterface $logger optional logger for information about which CA files were loaded
     * @return string          path to a CA bundle file or directory
     */
    public static function getSystemCaRootBundlePath(LoggerInterface $logger = null)
    {
        if (self::$caPath !== null) {
            return self::$caPath;
        }

        // If SSL_CERT_FILE env variable points to a valid certificate/bundle, use that.
        // This mimics how OpenSSL uses the SSL_CERT_FILE env variable.
        $envCertFile = getenv(&#039;SSL_CERT_FILE&#039;);
        if ($envCertFile &amp;&amp; is_readable($envCertFile) &amp;&amp; static::validateCaFile($envCertFile, $logger)) {
            return self::$caPath = $envCertFile;
        }

        // If SSL_CERT_DIR env variable points to a valid certificate/bundle, use that.
        // This mimics how OpenSSL uses the SSL_CERT_FILE env variable.
        $envCertDir = getenv(&#039;SSL_CERT_DIR&#039;);
        if ($envCertDir &amp;&amp; is_dir($envCertDir) &amp;&amp; is_readable($envCertDir)) {
            return self::$caPath = $envCertDir;
        }

        $configured = ini_get(&#039;openssl.cafile&#039;);
        if ($configured &amp;&amp; strlen($configured) &gt; 0 &amp;&amp; is_readable($configured) &amp;&amp; static::validateCaFile($configured, $logger)) {
            return self::$caPath = $configured;
        }

        $configured = ini_get(&#039;openssl.capath&#039;);
        if ($configured &amp;&amp; is_dir($configured) &amp;&amp; is_readable($configured)) {
            return self::$caPath = $configured;
        }

        $caBundlePaths = array(
            &#039;/etc/pki/tls/certs/ca-bundle.crt&#039;, // Fedora, RHEL, CentOS (ca-certificates package)
            &#039;/etc/ssl/certs/ca-certificates.crt&#039;, // Debian, Ubuntu, Gentoo, Arch Linux (ca-certificates package)
            &#039;/etc/ssl/ca-bundle.pem&#039;, // SUSE, openSUSE (ca-certificates package)
            &#039;/usr/local/share/certs/ca-root-nss.crt&#039;, // FreeBSD (ca_root_nss_package)
            &#039;/usr/ssl/certs/ca-bundle.crt&#039;, // Cygwin
            &#039;/opt/local/share/curl/curl-ca-bundle.crt&#039;, // OS X macports, curl-ca-bundle package
            &#039;/usr/local/share/curl/curl-ca-bundle.crt&#039;, // Default cURL CA bunde path (without --with-ca-bundle option)
            &#039;/usr/share/ssl/certs/ca-bundle.crt&#039;, // Really old RedHat?
            &#039;/etc/ssl/cert.pem&#039;, // OpenBSD
            &#039;/usr/local/etc/ssl/cert.pem&#039;, // FreeBSD 10.x
            &#039;/usr/local/etc/openssl/cert.pem&#039;, // OS X homebrew, openssl package
        );

        foreach ($caBundlePaths as $caBundle) {
            if (@is_readable($caBundle) &amp;&amp; static::validateCaFile($caBundle, $logger)) {
                return self::$caPath = $caBundle;
            }
        }

        foreach ($caBundlePaths as $caBundle) {
            $caBundle = dirname($caBundle);
            if (@is_dir($caBundle) &amp;&amp; glob($caBundle.&#039;/*&#039;)) {
                return self::$caPath = $caBundle;
            }
        }

        return self::$caPath = static::getBundledCaBundlePath(); // Bundled CA file, last resort
    }

    /**
     * Returns the path to the bundled CA file
     *
     * In case you don&#039;t want to trust the user or the system, you can use this directly
     *
     * @return string path to a CA bundle file
     */
    public static function getBundledCaBundlePath()
    {
        $caBundleFile = __DIR__.&#039;/../res/cacert.pem&#039;;

        // cURL does not understand &#039;phar://&#039; paths
        // see https://github.com/composer/ca-bundle/issues/10
        if (0 === strpos($caBundleFile, &#039;phar://&#039;)) {
            file_put_contents(
                $tempCaBundleFile = tempnam(sys_get_temp_dir(), &#039;openssl-ca-bundle-&#039;),
                file_get_contents($caBundleFile)
            );

            register_shutdown_function(function() use ($tempCaBundleFile) {
                @unlink($tempCaBundleFile);
            });

            $caBundleFile = $tempCaBundleFile;
        }

        return $caBundleFile;
    }

    /**
     * Validates a CA file using opensl_x509_parse only if it is safe to use
     *
     * @param string          $filename
     * @param LoggerInterface $logger   optional logger for information about which CA files were loaded
     *
     * @return bool
     */
    public static function validateCaFile($filename, LoggerInterface $logger = null)
    {
        static $warned = false;

        if (isset(self::$caFileValidity[$filename])) {
            return self::$caFileValidity[$filename];
        }

        $contents = file_get_contents($filename);

        // assume the CA is valid if php is vulnerable to
        // https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html
        if (!static::isOpensslParseSafe()) {
            if (!$warned &amp;&amp; $logger) {
                $logger-&gt;warning(sprintf(
                    &#039;Your version of PHP, %s, is affected by CVE-2013-6420 and cannot safely perform certificate validation, we strongly suggest you upgrade.&#039;,
                    PHP_VERSION
                ));
                $warned = true;
            }

            $isValid = !empty($contents);
        } else {
            $isValid = (bool) openssl_x509_parse($contents);
        }

        if ($logger) {
            $logger-&gt;debug(&#039;Checked CA file &#039;.realpath($filename).&#039;: &#039;.($isValid ? &#039;valid&#039; : &#039;invalid&#039;));
        }

        return self::$caFileValidity[$filename] = $isValid;
    }

    /**
     * Test if it is safe to use the PHP function openssl_x509_parse().
     *
     * This checks if OpenSSL extensions is vulnerable to remote code execution
     * via the exploit documented as CVE-2013-6420.
     *
     * @return bool
     */
    public static function isOpensslParseSafe()
    {
        if (null !== self::$useOpensslParse) {
            return self::$useOpensslParse;
        }

        if (PHP_VERSION_ID &gt;= 50600) {
            return self::$useOpensslParse = true;
        }

        // Vulnerable:
        // PHP 5.3.0 - PHP 5.3.27
        // PHP 5.4.0 - PHP 5.4.22
        // PHP 5.5.0 - PHP 5.5.6
        if (
               (PHP_VERSION_ID &lt; 50400 &amp;&amp; PHP_VERSION_ID &gt;= 50328)
            || (PHP_VERSION_ID &lt; 50500 &amp;&amp; PHP_VERSION_ID &gt;= 50423)
            || (PHP_VERSION_ID &lt; 50600 &amp;&amp; PHP_VERSION_ID &gt;= 50507)
        ) {
            // This version of PHP has the fix for CVE-2013-6420 applied.
            return self::$useOpensslParse = true;
        }

        if (defined(&#039;PHP_WINDOWS_VERSION_BUILD&#039;)) {
            // Windows is probably insecure in this case.
            return self::$useOpensslParse = false;
        }

        $compareDistroVersionPrefix = function ($prefix, $fixedVersion) {
            $regex = &#039;{^&#039;.preg_quote($prefix).&#039;([0-9]+)$}&#039;;

            if (preg_match($regex, PHP_VERSION, $m)) {
                return ((int) $m[1]) &gt;= $fixedVersion;
            }

            return false;
        };

        // Hard coded list of PHP distributions with the fix backported.
        if (
            $compareDistroVersionPrefix(&#039;5.3.3-7+squeeze&#039;, 18) // Debian 6 (Squeeze)
            || $compareDistroVersionPrefix(&#039;5.4.4-14+deb7u&#039;, 7) // Debian 7 (Wheezy)
            || $compareDistroVersionPrefix(&#039;5.3.10-1ubuntu3.&#039;, 9) // Ubuntu 12.04 (Precise)
        ) {
            return self::$useOpensslParse = true;
        }

        // Symfony Process component is missing so we assume it is unsafe at this point
        if (!class_exists(&#039;Symfony\Component\Process\PhpProcess&#039;)) {
            return self::$useOpensslParse = false;
        }

        // This is where things get crazy, because distros backport security
        // fixes the chances are on NIX systems the fix has been applied but
        // it&#039;s not possible to verify that from the PHP version.
        //
        // To verify exec a new PHP process and run the issue testcase with
        // known safe input that replicates the bug.

        // Based on testcase in https://github.com/php/php-src/commit/c1224573c773b6845e83505f717fbf820fc18415
        // changes in https://github.com/php/php-src/commit/76a7fd893b7d6101300cc656058704a73254d593
        $cert = &#039;LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVwRENDQTR5Z0F3SUJBZ0lKQUp6dThyNnU2ZUJjTUEwR0NTcUdTSWIzRFFFQkJRVUFNSUhETVFzd0NRWUQKVlFRR0V3SkVSVEVjTUJvR0ExVUVDQXdUVG05eVpISm9aV2x1TFZkbGMzUm1ZV3hsYmpFUU1BNEdBMVVFQnd3SApTOE9Ed3Jac2JqRVVNQklHQTFVRUNnd0xVMlZyZEdsdmJrVnBibk14SHpBZEJnTlZCQXNNRmsxaGJHbGphVzkxCmN5QkRaWEowSUZObFkzUnBiMjR4SVRBZkJnTlZCQU1NR0cxaGJHbGphVzkxY3k1elpXdDBhVzl1WldsdWN5NWsKWlRFcU1DZ0dDU3FHU0liM0RRRUpBUlliYzNSbFptRnVMbVZ6YzJWeVFITmxhM1JwYjI1bGFXNXpMbVJsTUhVWQpaREU1TnpBd01UQXhNREF3TURBd1dnQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBCkFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUEKQUFBQUFBQVhEVEUwTVRFeU9ERXhNemt6TlZvd2djTXhDekFKQmdOVkJBWVRBa1JGTVJ3d0dnWURWUVFJREJOTwpiM0prY21obGFXNHRWMlZ6ZEdaaGJHVnVNUkF3RGdZRFZRUUhEQWRMdzRQQ3RteHVNUlF3RWdZRFZRUUtEQXRUClpXdDBhVzl1UldsdWN6RWZNQjBHQTFVRUN3d1dUV0ZzYVdOcGIzVnpJRU5sY25RZ1UyVmpkR2x2YmpFaE1COEcKQTFVRUF3d1liV0ZzYVdOcGIzVnpMbk5sYTNScGIyNWxhVzV6TG1SbE1Tb3dLQVlKS29aSWh2Y05BUWtCRmh0egpkR1ZtWVc0dVpYTnpaWEpBYzJWcmRHbHZibVZwYm5NdVpHVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRERBZjNobDdKWTBYY0ZuaXlFSnBTU0RxbjBPcUJyNlFQNjV1c0pQUnQvOFBhRG9xQnUKd0VZVC9OYSs2ZnNnUGpDMHVLOURaZ1dnMnRIV1dvYW5TYmxBTW96NVBINlorUzRTSFJaN2UyZERJalBqZGhqaAowbUxnMlVNTzV5cDBWNzk3R2dzOWxOdDZKUmZIODFNTjJvYlhXczROdHp0TE11RDZlZ3FwcjhkRGJyMzRhT3M4CnBrZHVpNVVhd1Raa3N5NXBMUEhxNWNNaEZHbTA2djY1Q0xvMFYyUGQ5K0tBb2tQclBjTjVLTEtlYno3bUxwazYKU01lRVhPS1A0aWRFcXh5UTdPN2ZCdUhNZWRzUWh1K3ByWTNzaTNCVXlLZlF0UDVDWm5YMmJwMHdLSHhYMTJEWAoxbmZGSXQ5RGJHdkhUY3lPdU4rblpMUEJtM3ZXeG50eUlJdlZBZ01CQUFHalFqQkFNQWtHQTFVZEV3UUNNQUF3CkVRWUpZSVpJQVliNFFnRUJCQVFEQWdlQU1Bc0dBMVVkRHdRRUF3SUZvREFUQmdOVkhTVUVEREFLQmdnckJnRUYKQlFjREFqQU5CZ2txaGtpRzl3MEJBUVVGQUFPQ0FRRUFHMGZaWVlDVGJkajFYWWMrMVNub2FQUit2SThDOENhRAo4KzBVWWhkbnlVNGdnYTBCQWNEclk5ZTk0ZUVBdTZacXljRjZGakxxWFhkQWJvcHBXb2NyNlQ2R0QxeDMzQ2tsClZBcnpHL0t4UW9oR0QySmVxa2hJTWxEb214SE83a2EzOStPYThpMnZXTFZ5alU4QVp2V01BcnVIYTRFRU55RzcKbFcyQWFnYUZLRkNyOVRuWFRmcmR4R1ZFYnY3S1ZRNmJkaGc1cDVTanBXSDErTXEwM3VSM1pYUEJZZHlWODMxOQpvMGxWajFLRkkyRENML2xpV2lzSlJvb2YrMWNSMzVDdGQwd1lCY3BCNlRac2xNY09QbDc2ZHdLd0pnZUpvMlFnClpzZm1jMnZDMS9xT2xOdU5xLzBUenprVkd2OEVUVDNDZ2FVK1VYZTRYT1Z2a2NjZWJKbjJkZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K&#039;;
        $script = &lt;&lt;&lt;&#039;EOT&#039;

error_reporting(-1);
$info = openssl_x509_parse(base64_decode(&#039;%s&#039;));
var_dump(PHP_VERSION, $info[&#039;issuer&#039;][&#039;emailAddress&#039;], $info[&#039;validFrom_time_t&#039;]);

EOT;
        $script = &#039;&lt;&#039;.&quot;?php\n&quot;.sprintf($script, $cert);

        try {
            $process = new PhpProcess($script);
            $process-&gt;mustRun();
        } catch (\Exception $e) {
            // In the case of any exceptions just accept it is not possible to
            // determine the safety of openssl_x509_parse and bail out.
            return self::$useOpensslParse = false;
        }

        $output = preg_split(&#039;{\r?\n}&#039;, trim($process-&gt;getOutput()));
        $errorOutput = trim($process-&gt;getErrorOutput());

        if (
            count($output) === 3
            &amp;&amp; $output[0] === sprintf(&#039;string(%d) &quot;%s&quot;&#039;, strlen(PHP_VERSION), PHP_VERSION)
            &amp;&amp; $output[1] === &#039;string(27) &quot;stefan.esser@sektioneins.de&quot;&#039;
            &amp;&amp; $output[2] === &#039;int(-1)&#039;
            &amp;&amp; preg_match(&#039;{openssl_x509_parse\(\): illegal (?:ASN1 data type for|length in) timestamp in - on line \d+}&#039;, $errorOutput)
        ) {
            // This PHP has the fix backported probably by a distro security team.
            return self::$useOpensslParse = true;
        }

        return self::$useOpensslParse = false;
    }

    /**
     * Resets the static caches
     */
    public static function reset()
    {
        self::$caFileValidity = array();
        self::$caPath = null;
        self::$useOpensslParse = null;
    }
}
</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2Fhome%2Fplanet5%2Fwww%2Ftracking%2Fvendor%2Fcomposer%2Fca-bundle%2Fsrc'>⬅ Back to Directory</a>