Configuration.php

<?php

declare(strict_types=1);

namespace SimpleSAML;

use Exception;
use ParseError;
use SimpleSAML\{Error, Utils};
use SimpleSAML\Assert\Assert;
use SimpleSAML\SAML2\Constants as C;
use Symfony\Component\Filesystem\Filesystem;

use function array_key_exists;
use function array_keys;
use function dirname;
use function interface_exists;
use function is_array;
use function is_int;
use function is_null;
use function is_string;
use function ob_end_clean;
use function ob_get_length;
use function ob_start;
use function preg_match;
use function preg_replace;
use function rtrim;
use function substr;
use function var_export;

/**
 * Configuration of SimpleSAMLphp
 *
 * @package SimpleSAMLphp
 */
class Configuration implements Utils\ClearableState
{
    /**
     * The release version of this package
     */
    public const VERSION = 'dev-master';

    /**
     * A default value which means that the given option is required.
     *
     * @var string
     */
    public const REQUIRED_OPTION = '___REQUIRED_OPTION___';

    /**
     * The default security-headers to be sent on responses.
     */
    public const DEFAULT_SECURITY_HEADERS = [
        'Content-Security-Policy' =>
            "default-src 'none'; " .
            "frame-ancestors 'self'; " .
            "object-src 'none'; " .
            "script-src 'self'; " .
            "style-src 'self'; " .
            "font-src 'self'; " .
            "connect-src 'self'; " .
            "img-src 'self' data:; " .
            "base-uri 'none'",
        'Referrer-Policy' => 'origin-when-cross-origin',
    ];

    /**
     * Associative array with mappings from instance-names to configuration objects.
     *
     * @var array<string, \SimpleSAML\Configuration>
     */
    private static array $instance = [];

    /**
     * Configuration directories.
     *
     * This associative array contains the mappings from configuration sets to
     * configuration directories.
     *
     * @var array<string, string>
     */
    private static array $configDirs = [];

    /**
     * Cache of loaded configuration files.
     *
     * The index in the array is the full path to the file.
     *
     * @var array
     */
    private static array $loadedConfigs = [];

    /**
     * The configuration array.
     *
     * @var array
     */
    private array $configuration;

    /**
     * The location which will be given when an error occurs.
     *
     * @var string
     */
    private string $location;

    /**
     * The file this configuration was loaded from.
     *
     * @var string|null
     */
    private ?string $filename = null;

    /**
     * Initializes a configuration from the given array.
     *
     * @param array $config The configuration array.
     * @param string $location The location which will be given when an error occurs.
     */
    public function __construct(array $config, string $location)
    {
        $this->configuration = $config;
        $this->location = $location;
    }


    /**
     * Load the given configuration file.
     *
     * @param string $filename The full path of the configuration file.
     * @param bool $required Whether the file is required.
     *
     * @return \SimpleSAML\Configuration The configuration file. An exception will be thrown if the
     *                                   configuration file is missing.
     *
     * @throws \Exception If the configuration file is invalid or missing.
     */
    private static function loadFromFile(string $filename, bool $required): Configuration
    {
        if (array_key_exists($filename, self::$loadedConfigs)) {
            return self::$loadedConfigs[$filename];
        }

        $fileSystem = new Filesystem();
        if ($fileSystem->exists($filename)) {
            /** @psalm-var mixed $config */
            $config = 'UNINITIALIZED';

            // the file initializes a variable named '$config'
            ob_start();
            if (interface_exists('Throwable', false)) {
                try {
                    require($filename);
                } catch (ParseError $e) {
                    self::$loadedConfigs[$filename] = self::loadFromArray([], '[ARRAY]', 'simplesaml');
                    throw new Error\ConfigurationError($e->getMessage(), $filename, []);
                }
            } else {
                require($filename);
            }

            $spurious_output = ob_get_length() > 0;
            ob_end_clean();

            // check that $config exists
            if (!isset($config)) {
                throw new Error\ConfigurationError(
                    '$config is not defined in the configuration file.',
                    $filename
                );
            }

            // check that $config is initialized to an array
            if (!is_array($config)) {
                throw new Error\ConfigurationError(
                    '$config is not an array.',
                    $filename
                );
            }

            // check that $config is not empty
            if (empty($config)) {
                throw new Error\ConfigurationError(
                    '$config is empty.',
                    $filename
                );
            }
        } elseif ($required) {
            // file does not exist, but is required
            throw new Error\ConfigurationError('Missing configuration file', $filename);
        } else {
            // file does not exist, but is optional, so return an empty configuration object without saving it
            $cfg = new Configuration([], $filename);
            $cfg->filename = $filename;
            return $cfg;
        }

        $cfg = new Configuration($config, $filename);
        $cfg->filename = $filename;