Caterscam Corp.

Current Dir: /opt/app-version-detector/

[FILE] app-version-detector-wrapper.sh [ edit | delete | rename ]
[FILE] app-version-detector.phar [ edit | delete | rename ]

    <?php

if (in_array('phar', stream_get_wrappers()) && class_exists('Phar', 0)) {
    Phar::interceptFileFuncs();
    set_include_path('phar://' . __FILE__ . PATH_SEPARATOR . get_include_path());
    include 'phar://' . __FILE__ . '/' . Extract_Phar::START;
    return;
}

class Extract_Phar
{
    static $temp;
    static $origdir;
    const GZ = 0x1000;
    const BZ2 = 0x2000;
    const MASK = 0x3000;
    const START = 'bin/cli.php';
    const LEN = 6636;

    static function go($return = false)
    {
        $fp = fopen(__FILE__, 'rb');
        fseek($fp, self::LEN);
        $L = unpack('V', $a = fread($fp, 4));
        $m = '';

        do {
            $read = 8192;
            if ($L[1] - strlen($m) < 8192) {
                $read = $L[1] - strlen($m);
            }
            $last = fread($fp, $read);
            $m .= $last;
        } while (strlen($last) && strlen($m) < $L[1]);

        if (strlen($m) < $L[1]) {
            die('ERROR: manifest length read was "' .
                strlen($m) .'" should be "' .
                $L[1] . '"');
        }

        $info = self::_unpack($m);
        $f = $info['c'];

        if ($f & self::GZ) {
            if (!function_exists('gzinflate')) {
                die('Error: zlib extension is not enabled -' .
                    ' gzinflate() function needed for zlib-compressed .phars');
            }
        }

        if ($f & self::BZ2) {
            if (!function_exists('bzdecompress')) {
                die('Error: bzip2 extension is not enabled -' .
                    ' bzdecompress() function needed for bz2-compressed .phars');
            }
        }

        $temp = self::tmpdir();

        if (!$temp || !is_writable($temp)) {
            $sessionpath = session_save_path();
            if (strpos ($sessionpath, ";") !== false)
                $sessionpath = substr ($sessionpath, strpos ($sessionpath, ";")+1);
            if (!file_exists($sessionpath) || !is_dir($sessionpath)) {
                die('Could not locate temporary directory to extract phar');
            }
            $temp = $sessionpath;
        }

        // Create a private, unguessable extraction directory owned by the
        // current user. Using a fixed, world-writable /tmp/pharextract/<name>
        // path with an attacker-computable md5 marker as the sole reuse gate
        // allowed a local user to pre-plant the directory (cache poisoning of
        // bin/cli.php) or plant symlinks the extraction would write through.
        // A fresh random 0700 directory per run, verified to be a real
        // directory we own and not a symlink, closes that TOCTOU window.
        //
        // The parent ($base) is per-euid (e.g. /tmp/pharextract-0 for root)
        // and 0700 owned by the current user, so an unprivileged attacker
        // cannot rename or replace entries inside it after creation.
        //
        // posix_geteuid is required: without it $euid would silently collapse
        // to 0 for every caller AND isOwnedDir would skip the ownership
        // comparison, letting an attacker who pre-creates the base dir pass
        // the trust check trivially. There is no safe fallback — hard-fail.
        if (!function_exists('posix_geteuid')) {
            die('posix_geteuid is required for safe phar extraction (PHP built without --enable-posix?)');
        }
        $euid = posix_geteuid();
        $base = $temp . '/pharextract-' . $euid;
        @mkdir($base, 0700);
        if (!self::isOwnedDir($base)) {
            die('Refusing to use untrusted pharextract base directory');
        }

        $temp = self::makePrivateTempDir($base, basename(__FILE__, '.phar'));
        if ($temp === false) {
            die('Could not create a private temporary directory to extract phar');
        }

        self::$temp = $temp;
        self::$origdir = getcwd();

        foreach ($info['m'] as $path => $file) {
            // Defense in depth: even with a per-euid 0700 $base, re-verify
            // the extraction root is still our owned non-symlink directory
            // before every write so a parent-dir hijack between iterations
            // can't redirect the extraction.
            if (!self::isOwnedDir($temp)) {
                die('Extraction root was replaced — aborting');
            }
            self::assertSafePath($temp, $path);
            @mkdir(dirname($temp . '/' . $path), 0700, true);
            clearstatcache();

            if ($path[strlen($path) - 1] == '/') {
                @mkdir($temp . '/' . $path, 0700);
            } else {
                self::writeFileNoFollow($temp . '/' . $path, self::extractFile($path, $file, $fp));
                @chmod($temp . '/' . $path, 0600);
            }
        }

        chdir($temp);

        if (!$return) {
            include self::START;
        }
    }

    // Create a fresh, unguessable, 0700 directory under $base owned by the
    // current effective user. Verifies the result is a real directory (not a
    // symlink) owned by us before returning it.
    static function makePrivateTempDir($base, $name)
    {
        for ($i = 0; $i < 16; $i++) {
            // Require a real CSPRNG. mt_rand is seeded predictably and would
            // make the per-run dir name guessable, defeating the unguessable-
            // suffix protection that the per-euid $base also leans on.
            if (function_exists('random_bytes')) {
                $rnd = bin2hex(random_bytes(16));
            } elseif (function_exists('openssl_random_pseudo_bytes')) {
                $bytes = openssl_random_pseudo_bytes(16, $strong);
                if (!$strong) {
                    die('No CSPRNG available for extraction directory name');
                }
                $rnd = bin2hex($bytes);
            } else {
                die('No CSPRNG available for extraction directory name');
            }
            $dir = $base . '/' . $name . '.' . $rnd;
            clearstatcache();
            if (file_exists($dir) || is_link($dir)) {
                continue;
            }
            if (!@mkdir($dir, 0700)) {
                continue;
            }
            clearstatcache();
            if (!self::isOwnedDir($dir)) {
                @rmdir($dir);
                continue;
            }
            return $dir;
        }
        return false;
    }

    // True only if $dir is a real directory (not a symlink) owned by the
    // current effective uid. go() already hard-fails if posix_geteuid is
    // unavailable, so this helper assumes it can be called unconditionally;
    // skipping the uid check on absent POSIX would silently disable the
    // ownership gate and let an attacker-owned pre-created dir pass.
    static function isOwnedDir($dir)
    {
        if (is_link($dir) || !is_dir($dir)) {
            return false;
        }
        $stat = @lstat($dir);
        if ($stat === false) {
            return false;
        }
        if ($stat['uid'] !== posix_geteuid()) {
            return false;
        }
        return true;
    }

    // Reject manifest paths that try to escape the extraction root via
    // absolute paths or ".." path segments, and refuse to write through a
    // pre-existing symlink anywhere along the path.
    //
    // ".." is checked per path segment (not as a substring) so legitimate
    // archive entries containing two consecutive dots in a filename (e.g.
    // "foo..bar") are not rejected.
    static function assertSafePath($temp, $path)
    {
        if ($path === '' || $path[0] === '/' || $path[0] === '\\'
            || strpos($path, "\0") !== false) {
            die('Invalid internal .phar path');
        }
        $parts = explode('/', $path);
        $cur = $temp;
        foreach ($parts as $p) {
            if ($p === '') {
                continue;
            }
            if ($p === '.' || $p === '..') {
                die('Invalid internal .phar path');
            }
            $cur .= '/' . $p;
            clearstatcache();
            if (is_link($cur)) {
                die('Refusing to extract through symlink');
            }
        }
    }

    // Write data without following a final symlink: open with the 'x' (O_EXCL
    // | O_CREAT) flag so an attacker-planted symlink at the target causes the
    // open to fail rather than being written through. Loop on fwrite() since
    // it may write fewer bytes than requested in a single call, which would
    // otherwise leave a truncated PHP file on disk that the stub later
    // include()'s.
    static function writeFileNoFollow($file, $data)
    {
        clearstatcache();
        if (is_link($file)) {
            die('Refusing to extract over symlink');
        }
        $fp = @fopen($file, 'xb');
        if ($fp === false) {
            die('Could not safely create extracted file');
        }
        $remaining = strlen($data);
        $offset = 0;
        while ($remaining > 0) {
            $chunk = $remaining === strlen($data) && $offset === 0
                ? $data
                : substr($data, $offset, $remaining);
            $written = @fwrite($fp, $chunk);
            if ($written === false || $written === 0) {
                fclose($fp);
                @unlink($file);
                die('Could not write all bytes to extracted file');
            }
            $offset += $written;
            $remaining -= $written;
        }
        fclose($fp);
    }

    static function tmpdir()
    {
        if (strpos(PHP_OS, 'WIN') !== false) {
            if ($var = getenv('TMP') ? getenv('TMP') : getenv('TEMP')) {
                return $var;
            }
            if (is_dir('/temp') || mkdir('/temp')) {
                return realpath('/temp');
            }
            return false;
        }
        if ($var = getenv('TMPDIR')) {
            return $var;
        }
        return realpath('/tmp');
    }

    static function _unpack($m)
    {
        $info = unpack('V', substr($m, 0, 4));
        $l = unpack('V', substr($m, 10, 4));
        $m = substr($m, 14 + $l[1]);
        $s = unpack('V', substr($m, 0, 4));
        $o = 0;
        $start = 4 + $s[1];
        $ret['c'] = 0;

        for ($i = 0; $i < $info[1]; $i++) {
            $len = unpack('V', substr($m, $start, 4));
            $start += 4;
            $savepath = substr($m, $start, $len[1]);
            $start += $len[1];
            $ret['m'][$savepath] = array_values(unpack('Va/Vb/Vc/Vd/Ve/Vf', substr($m, $start, 24)));
            $ret['m'][$savepath][3] = sprintf('%u', $ret['m'][$savepath][3]
                & 0xffffffff);
            $ret['m'][$savepath][7] = $o;
            $o += $ret['m'][$savepath][2];
            $start += 24 + $ret['m'][$savepath][5];
            $ret['c'] |= $ret['m'][$savepath][4] & self::MASK;
        }
        return $ret;
    }

    static function extractFile($path, $entry, $fp)
    {
        $data = '';
        $c = $entry[2];

        while ($c) {
            if ($c < 8192) {
                $data .= @fread($fp, $c);
                $c = 0;
            } else {
                $c -= 8192;
                $data .= @fread($fp, 8192);
            }
        }

        if ($entry[4] & self::GZ) {
            $data = gzinflate($data);
        } elseif ($entry[4] & self::BZ2) {
            $data = bzdecompress($data);
        }

        if (strlen($data) != $entry[0]) {
            die("Invalid internal .phar file (size error " . strlen($data) . " != " .
                $stat[7] . ")");
        }

        if ($entry[3] != sprintf("%u", crc32($data) & 0xffffffff)) {
            die("Invalid internal .phar file (checksum error)");
        }

        return $data;
    }

    static function _removeTmpFiles($temp, $origdir)
    {
        chdir($temp);

        foreach (glob('*') as $f) {
            if (file_exists($f)) {
                is_dir($f) ? @rmdir($f) : @unlink($f);
                if (file_exists($f) && is_dir($f)) {
                    self::_removeTmpFiles($f, getcwd());
                }
            }
        }

        @rmdir($temp);
        clearstatcache();
        chdir($origdir);
    }
}

Extract_Phar::go();
__HALT_COMPILER(); ?>
���f����������app-version-detector.phar����%���vendor/composer/InstalledVersions.php�C���ƪj�C��<nw�������!���vendor/composer/autoload_psr4.phpF���ƪjF��1F����������vendor/composer/LICENSE.���ƪj.�� ��������$���vendor/composer/semver/composer.jsonL���ƪjL��P�������������vendor/composer/semver/LICENSE���ƪj��Bh������� ���vendor/composer/semver/README.mdk���ƪjk��O�
�������#���vendor/composer/semver/CHANGELOG.md����ƪj���Mgˤ������,���vendor/composer/semver/src/VersionParser.phpKT���ƪjKT���v�ʤ������)���vendor/composer/semver/src/Comparator.php�	���ƪj�	���g3	�������9���vendor/composer/semver/src/Constraint/MultiConstraint.php<
���ƪj<
��ª�	�������=���vendor/composer/semver/src/Constraint/ConstraintInterface.php^���ƪj^��)��X�������<���vendor/composer/semver/src/Constraint/AbstractConstraint.phpn���ƪjn����;�������4���vendor/composer/semver/src/Constraint/Constraint.php���ƪj����V�������9���vendor/composer/semver/src/Constraint/EmptyConstraint.php:���ƪj:��@M�������%���vendor/composer/semver/src/Semver.php����ƪj���o�I��������%���vendor/composer/autoload_classmap.php[C���ƪj[C��M����������"���vendor/composer/platform_check.php����ƪj���$)g�������!���vendor/composer/autoload_real.php����ƪj���_mǚ�������#���vendor/composer/autoload_static.php�N���ƪj�N���w1a����������vendor/composer/installed.php8���ƪj8��������������vendor/composer/ClassLoader.php�?���ƪj�?��2@u�������'���vendor/composer/autoload_namespaces.php�����ƪj�����/t����������vendor/composer/installed.json����ƪj���6�c����������vendor/autoload.php����ƪj���3�����������bin/cli.php����ƪj���H0�����������data/actual-versions-db.json�$���ƪj�$��/��������#���data/actual-versions-sqlite-db.json�`���ƪj�`��k������������src/Core/AbstractEvent.php����ƪj���7ޞ��������:���src/Core/OutdatedDetection/ComparisonStrategyInterface.phpd���ƪjd���{|�������8���src/Core/OutdatedDetection/GenericComparisonStrategy.php����ƪj���m�Z�������.���src/Core/OutdatedDetection/OutdatedChecker.php�
���ƪj�
���]p�������,���src/Core/OutdatedDetection/OutdatedEvent.phpQ���ƪjQ���0�ɤ������1���src/Core/OutdatedDetection/VersionDbInterface.php����ƪj����(lr�������5���src/Core/VersionDetection/PlainCollectionDetector.php����ƪj����^�e�������,���src/Core/VersionDetection/DetectionEvent.php_	���ƪj_	���HV�������5���src/Core/VersionDetection/Detector/WpCoreDetector.phpm���ƪjm����
�������6���src/Core/VersionDetection/Detector/WpOptionsReader.php3���ƪj3����-�������:���src/Core/VersionDetection/Detector/MagentoCoreDetector.phpp
���ƪjp
��u�eW�������8���src/Core/VersionDetection/Detector/NodeJsAppDetector.php����ƪj�����P�������9���src/Core/VersionDetection/Detector/PHPBB3CoreDetector.php�
���ƪj�
��~C�5�������8���src/Core/VersionDetection/Detector/PackageJsonReader.php+���ƪj+����홤������7���src/Core/VersionDetection/Detector/ModxCoreDetector.php
���ƪj
���]Ch�������9���src/Core/VersionDetection/Detector/WpMuPluginDetector.php�
���ƪj�
��!��v�������;���src/Core/VersionDetection/Detector/OpenCartCoreDetector.phpW���ƪjW���7Z�������9���src/Core/VersionDetection/Detector/BitrixCoreDetector.php����ƪj��� �Ϥ������=���src/Core/VersionDetection/Detector/OsCommerceCoreDetector.php����ƪj����$�I�������9���src/Core/VersionDetection/Detector/JoomlaCoreDetector.php-���ƪj-��s�铤������9���src/Core/VersionDetection/Detector/DrupalCoreDetector.php����ƪj����
~��������;���src/Core/VersionDetection/Detector/WpContentDirResolver.php����ƪj���ύ=N�������;���src/Core/VersionDetection/Detector/DrupalPluginDetector.php����ƪj����ξ��������7���src/Core/VersionDetection/Detector/WpPluginDetector.php����ƪj����UNO�������=���src/Core/VersionDetection/Detector/ForkingWpOptionsReader.phpq���ƪjq���Y
�������;���src/Core/VersionDetection/Detector/WpActivationResolver.php���ƪj��T|/ͤ������5���src/Core/VersionDetection/Detector/WpConfigParser.php9'���ƪj9'���O�9�������6���src/Core/VersionDetection/Detector/IPBCoreDetector.php�
���ƪj�
��d��`�������<���src/Core/VersionDetection/Detector/NodeJsPackageDetector.phpA���ƪjA��,�"G�������;���src/Core/VersionDetection/Detector/CommonScriptDetector.phpL���ƪjL����5��������4���src/Core/VersionDetection/Detector/DummyDetector.phpO���ƪjO��=~���������:���src/Core/VersionDetection/Detector/WpComponentDetector.php@���ƪj@����������6���src/Core/VersionDetection/Detector/WpThemeDetector.php����ƪj���6C�p�������;���src/Core/VersionDetection/Detector/JoomlaPluginDetector.php%���ƪj%��A~��������<���src/Core/VersionDetection/Detector/MysqliWpOptionsReader.php���ƪj��UB�������7���src/Core/VersionDetection/AbstractCompositeDetector.php����ƪj���]�[�������.���src/Core/VersionDetection/AbstractDetector.php����ƪj���ކG��������:���src/Core/VersionDetection/DependencyCollectionDetector.php����ƪj���G"�������/���src/Core/VersionDetection/DetectorInterface.php����ƪj����e�k����������src/Core/PublisherInterface.php@���ƪj@���E�����������src/Core/MediatorInterface.php���ƪj����ë����������src/Core/ListenerInterface.php_���ƪj_���6� ����������src/Scanner.php�$���ƪj�$��ҞLؤ���������src/Report/AbstractReport.php���ƪj��/�������������src/Report/JsonReport.php���ƪj����o�������&���src/Report/AbstractFileBasedReport.php����ƪj����L�s�������*���src/Report/Includes/RemoteStatsRequest.php#���ƪj#��E8�h�������,���src/Report/Includes/LastRunOutcomeWriter.php�	���ƪj�	����W������� ���src/Report/RemoteStatsReport.phpT%���ƪjT%��1ݞ
����������src/Report/SqliteDbReport.php���ƪj��[TФ���������src/Report/TextReport.php����ƪj���R�xP�������"���src/Event/ScanningStartedEvent.php����ƪj������Ф������ ���src/Event/ScanningEndedEvent.php���ƪj����`��������%���src/Event/ScanningDirStartedEvent.phpP���ƪjP��G������������src/Event/EventManager.php����ƪj����(�������#���src/Event/ScanningDirEndedEvent.php����ƪj����:�������� ���src/Application/AppException.php����ƪj����tF����������src/Application/CliParse.phpj���ƪjj��t��������&���src/Application/Error/ErrorHandler.php9���ƪj9���ր�����������src/Application/Stats.php����ƪj���2S�����������src/Application/Helper.php���ƪj����$�����������src/Application/Migraitor.php5���ƪj5������������#���src/Application/DetectorBuilder.php^���ƪj^����eפ���������src/Application/FileOwners.php_���ƪj_��Pl+Ԥ������ ���src/Application/FeatureFlags.phpA���ƪjA��U�48����������src/Application/Factory.phpq���ƪjq������������(���src/Application/ConfigParamException.php����ƪj�����ʤ���������src/Application/AVDCliParse.php�=���ƪj�=��i%�����������src/Application/Config.php����ƪj���P雪����������src/Application/Profiler.php%���ƪj%����]�����������src/Application/AVDConfig.php���ƪj��B�6ڤ���������src/Application/Directory.php���ƪj��3
�������&���src/Storage/ActualVersionsSQLiteDb.php����ƪj����������� ���src/Storage/ActualVersionsDb.phpR���ƪjR��� 1�������(���src/Storage/SqliteDbReportConnection.php�(���ƪj�(��!��������<?php

/*
 * This file is part of Composer.
 *
 * (c) Nils Adermann <naderman@naderman.de>
 *     Jordi Boggiano <j.boggiano@seld.be>
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace Composer;

use Composer\Autoload\ClassLoader;
use Composer\Semver\VersionParser;

/**
 * This class is copied in every Composer installed project and available to all
 *
 * See also https://getcomposer.org/doc/07-runtime.md#installed-versions
 *
 * To require its presence, you can require `composer-runtime-api ^2.0`
 *
 * @final
 */
class InstalledVersions
{
    /**
     * @var string|null if set (by reflection by Composer), this should be set to the path where this class is being copied to
     * @internal
     */
    private static $selfDir = null;

    /**
     * @var mixed[]|null
     * @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
     */
    private static $installed;

    /**
     * @var bool
     */
    private static $installedIsLocalDir;

    /**
     * @var bool|null
     */
    private static $canGetVendors;

    /**
     * @var array[]
     * @psalm-var array<string, array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    private static $installedByVendor = array();

    /**
     * Returns a list of all package names which are present, either by being installed, replaced or provided
     *
     * @return string[]
     * @psalm-return list<string>
     */
    public static function getInstalledPackages()
    {
        $packages = array();
        foreach (self::getInstalled() as $installed) {
            $packages[] = array_keys($installed['versions']);
        }

        if (1 === \count($packages)) {
            return $packages[0];
        }

        return array_keys(array_flip(\call_user_func_array('array_merge', $packages)));
    }

    /**
     * Returns a list of all package names with a specific type e.g. 'library'
     *
     * @param  string   $type
     * @return string[]
     * @psalm-return list<string>
     */
    public static function getInstalledPackagesByType($type)
    {
        $packagesByType = array();

        foreach (self::getInstalled() as $installed) {
            foreach ($installed['versions'] as $name => $package) {
                if (isset($package['type']) && $package['type'] === $type) {
                    $packagesByType[] = $name;
                }
            }
        }

        return $packagesByType;
    }

    /**
     * Checks whether the given package is installed
     *
     * This also returns true if the package name is provided or replaced by another package
     *
     * @param  string $packageName
     * @param  bool   $includeDevRequirements
     * @return bool
     */
    public static function isInstalled($packageName, $includeDevRequirements = true)
    {
        foreach (self::getInstalled() as $installed) {
            if (isset($installed['versions'][$packageName])) {
                return $includeDevRequirements || !isset($installed['versions'][$packageName]['dev_requirement']) || $installed['versions'][$packageName]['dev_requirement'] === false;
            }
        }

        return false;
    }

    /**
     * Checks whether the given package satisfies a version constraint
     *
     * e.g. If you want to know whether version 2.3+ of package foo/bar is installed, you would call:
     *
     *   Composer\InstalledVersions::satisfies(new VersionParser, 'foo/bar', '^2.3')
     *
     * @param  VersionParser $parser      Install composer/semver to have access to this class and functionality
     * @param  string        $packageName
     * @param  string|null   $constraint  A version constraint to check for, if you pass one you have to make sure composer/semver is required by your package
     * @return bool
     */
    public static function satisfies(VersionParser $parser, $packageName, $constraint)
    {
        $constraint = $parser->parseConstraints((string) $constraint);
        $provided = $parser->parseConstraints(self::getVersionRanges($packageName));

        return $provided->matches($constraint);
    }

    /**
     * Returns a version constraint representing all the range(s) which are installed for a given package
     *
     * It is easier to use this via isInstalled() with the $constraint argument if you need to check
     * whether a given version of a package is installed, and not just whether it exists
     *
     * @param  string $packageName
     * @return string Version constraint usable with composer/semver
     */
    public static function getVersionRanges($packageName)
    {
        foreach (self::getInstalled() as $installed) {
            if (!isset($installed['versions'][$packageName])) {
                continue;
            }

            $ranges = array();
            if (isset($installed['versions'][$packageName]['pretty_version'])) {
                $ranges[] = $installed['versions'][$packageName]['pretty_version'];
            }
            if (array_key_exists('aliases', $installed['versions'][$packageName])) {
                $ranges = array_merge($ranges, $installed['versions'][$packageName]['aliases']);
            }
            if (array_key_exists('replaced', $installed['versions'][$packageName])) {
                $ranges = array_merge($ranges, $installed['versions'][$packageName]['replaced']);
            }
            if (array_key_exists('provided', $installed['versions'][$packageName])) {
                $ranges = array_merge($ranges, $installed['versions'][$packageName]['provided']);
            }

            return implode(' || ', $ranges);
        }

        throw new \OutOfBoundsException('Package "' . $packageName . '" is not installed');
    }

    /**
     * @param  string      $packageName
     * @return string|null If the package is being replaced or provided but is not really installed, null will be returned as version, use satisfies or getVersionRanges if you need to know if a given version is present
     */
    public static function getVersion($packageName)
    {
        foreach (self::getInstalled() as $installed) {
            if (!isset($installed['versions'][$packageName])) {
                continue;
            }

            if (!isset($installed['versions'][$packageName]['version'])) {
                return null;
            }

            return $installed['versions'][$packageName]['version'];
        }

        throw new \OutOfBoundsException('Package "' . $packageName . '" is not installed');
    }

    /**
     * @param  string      $packageName
     * @return string|null If the package is being replaced or provided but is not really installed, null will be returned as version, use satisfies or getVersionRanges if you need to know if a given version is present
     */
    public static function getPrettyVersion($packageName)
    {
        foreach (self::getInstalled() as $installed) {
            if (!isset($installed['versions'][$packageName])) {
                continue;
            }

            if (!isset($installed['versions'][$packageName]['pretty_version'])) {
                return null;
            }

            return $installed['versions'][$packageName]['pretty_version'];
        }

        throw new \OutOfBoundsException('Package "' . $packageName . '" is not installed');
    }

    /**
     * @param  string      $packageName
     * @return string|null If the package is being replaced or provided but is not really installed, null will be returned as reference
     */
    public static function getReference($packageName)
    {
        foreach (self::getInstalled() as $installed) {
            if (!isset($installed['versions'][$packageName])) {
                continue;
            }

            if (!isset($installed['versions'][$packageName]['reference'])) {
                return null;
            }

            return $installed['versions'][$packageName]['reference'];
        }

        throw new \OutOfBoundsException('Package "' . $packageName . '" is not installed');
    }

    /**
     * @param  string      $packageName
     * @return string|null If the package is being replaced or provided but is not really installed, null will be returned as install path. Packages of type metapackages also have a null install path.
     */
    public static function getInstallPath($packageName)
    {
        foreach (self::getInstalled() as $installed) {
            if (!isset($installed['versions'][$packageName])) {
                continue;
            }

            return isset($installed['versions'][$packageName]['install_path']) ? $installed['versions'][$packageName]['install_path'] : null;
        }

        throw new \OutOfBoundsException('Package "' . $packageName . '" is not installed');
    }

    /**
     * @return array
     * @psalm-return array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}
     */
    public static function getRootPackage()
    {
        $installed = self::getInstalled();

        return $installed[0]['root'];
    }

    /**
     * Returns the raw installed.php data for custom implementations
     *
     * @deprecated Use getAllRawData() instead which returns all datasets for all autoloaders present in the process. getRawData only returns the first dataset loaded, which may not be what you expect.
     * @return array[]
     * @psalm-return array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}
     */
    public static function getRawData()
    {
        @trigger_error('getRawData only returns the first dataset loaded, which may not be what you expect. Use getAllRawData() instead which returns all datasets for all autoloaders present in the process.', E_USER_DEPRECATED);

        if (null === self::$installed) {
            // only require the installed.php file if this file is loaded from its dumped location,
            // and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
            if (substr(__DIR__, -8, 1) !== 'C') {
                self::$installed = include __DIR__ . '/installed.php';
            } else {
                self::$installed = array();
            }
        }

        return self::$installed;
    }

    /**
     * Returns the raw data of all installed.php which are currently loaded for custom implementations
     *
     * @return array[]
     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    public static function getAllRawData()
    {
        return self::getInstalled();
    }

    /**
     * Lets you reload the static array from another file
     *
     * This is only useful for complex integrations in which a project needs to use
     * this class but then also needs to execute another project's autoloader in process,
     * and wants to ensure both projects have access to their version of installed.php.
     *
     * A typical case would be PHPUnit, where it would need to make sure it reads all
     * the data it needs from this class, then call reload() with
     * `require $CWD/vendor/composer/installed.php` (or similar) as input to make sure
     * the project in which it runs can then also use this class safely, without
     * interference between PHPUnit's dependencies and the project's dependencies.
     *
     * @param  array[] $data A vendor/composer/installed.php data set
     * @return void
     *
     * @psalm-param array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $data
     */
    public static function reload($data)
    {
        self::$installed = $data;
        self::$installedByVendor = array();

        // when using reload, we disable the duplicate protection to ensure that self::$installed data is
        // always returned, but we cannot know whether it comes from the installed.php in __DIR__ or not,
        // so we have to assume it does not, and that may result in duplicate data being returned when listing
        // all installed packages for example
        self::$installedIsLocalDir = false;
    }

    /**
     * @return string
     */
    private static function getSelfDir()
    {
        if (self::$selfDir === null) {
            self::$selfDir = strtr(__DIR__, '\\', '/');
        }

        return self::$selfDir;
    }

    /**
     * @return array[]
     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    private static function getInstalled()
    {
        if (null === self::$canGetVendors) {
            self::$canGetVendors = method_exists('Composer\Autoload\ClassLoader', 'getRegisteredLoaders');
        }

        $installed = array();
        $copiedLocalDir = false;

        if (self::$canGetVendors) {
            $selfDir = self::getSelfDir();
            foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
                $vendorDir = strtr($vendorDir, '\\', '/');
                if (isset(self::$installedByVendor[$vendorDir])) {
                    $installed[] = self::$installedByVendor[$vendorDir];
                } elseif (is_file($vendorDir.'/composer/installed.php')) {
                    /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
                    $required = require $vendorDir.'/composer/installed.php';
                    self::$installedByVendor[$vendorDir] = $required;
                    $installed[] = $required;
                    if (self::$installed === null && $vendorDir.'/composer' === $selfDir) {
                        self::$installed = $required;
                        self::$installedIsLocalDir = true;
                    }
                }
                if (self::$installedIsLocalDir && $vendorDir.'/composer' === $selfDir) {
                    $copiedLocalDir = true;
                }
            }
        }

        if (null === self::$installed) {
            // only require the installed.php file if this file is loaded from its dumped location,
            // and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
            if (substr(__DIR__, -8, 1) !== 'C') {
                /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
                $required = require __DIR__ . '/installed.php';
                self::$installed = $required;
            } else {
                self::$installed = array();
            }
        }

        if (self::$installed !== array() && !$copiedLocalDir) {
            $installed[] = self::$installed;
        }

        return $installed;
    }
}
<?php

// autoload_psr4.php @generated by Composer

$vendorDir = dirname(__DIR__);
$baseDir = dirname($vendorDir);

return array(
    'Composer\\Semver\\' => array($vendorDir . '/composer/semver/src'),
    'AppVersionDetector\\Tests\\' => array($baseDir . '/tests'),
    'AppVersionDetector\\' => array($baseDir . '/src'),
);

Copyright (c) Nils Adermann, Jordi Boggiano

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished
to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

{
    "name": "composer/semver",
    "description": "Semver library that offers utilities, version constraint parsing and validation.",
    "type": "library",
    "license": "MIT",
    "keywords": [
        "semver",
        "semantic",
        "versioning",
        "validation"
    ],
    "authors": [
        {
            "name": "Nils Adermann",
            "email": "naderman@naderman.de",
            "homepage": "http://www.naderman.de"
        },
        {
            "name": "Jordi Boggiano",
            "email": "j.boggiano@seld.be",
            "homepage": "http://seld.be"
        },
        {
            "name": "Rob Bast",
            "email": "rob.bast@gmail.com",
            "homepage": "http://robbast.nl"
        }
    ],
    "support": {
        "irc": "irc://irc.freenode.org/composer",
        "issues": "https://github.com/composer/semver/issues"
    },
    "require": {
        "php": "^5.3.2 || ^7.0 || ^8.0"
    },
    "require-dev": {
        "phpunit/phpunit": "^4.5 || ^5.0.5"
    },
    "autoload": {
        "psr-4": {
            "Composer\\Semver\\": "src"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "Composer\\Semver\\": "tests"
        }
    },
    "extra": {
        "branch-alias": {
            "dev-master": "1.x-dev"
        }
    },
    "scripts": {
        "test": "phpunit"
    }
}
Copyright (C) 2015 Composer

Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
composer/semver
===============

Semver library that offers utilities, version constraint parsing and validation.

Originally written as part of [composer/composer](https://github.com/composer/composer),
now extracted and made available as a stand-alone library.

[![Build Status](https://travis-ci.org/composer/semver.svg?branch=master)](https://travis-ci.org/composer/semver)


Installation
------------

Install the latest version with:

```bash
$ composer require composer/semver
```


Requirements
------------

* PHP 5.3.2 is required but using the latest version of PHP is highly recommended.


Version Comparison
------------------

For details on how versions are compared, refer to the [Versions](https://getcomposer.org/doc/articles/versions.md)
article in the documentation section of the [getcomposer.org](https://getcomposer.org) website.


Basic usage
-----------

### Comparator

The `Composer\Semver\Comparator` class provides the following methods for comparing versions:

* greaterThan($v1, $v2)
* greaterThanOrEqualTo($v1, $v2)
* lessThan($v1, $v2)
* lessThanOrEqualTo($v1, $v2)
* equalTo($v1, $v2)
* notEqualTo($v1, $v2)

Each function takes two version strings as arguments and returns a boolean. For example:

```php
use Composer\Semver\Comparator;

Comparator::greaterThan('1.25.0', '1.24.0'); // 1.25.0 > 1.24.0
```

### Semver

The `Composer\Semver\Semver` class provides the following methods:

* satisfies($version, $constraints)
* satisfiedBy(array $versions, $constraint)
* sort($versions)
* rsort($versions)


License
-------

composer/semver is licensed under the MIT License, see the LICENSE file for details.
# Change Log

All notable changes to this project will be documented in this file.
This project adheres to [Semantic Versioning](http://semver.org/).

### [1.7.2] 2020-12-03

  * Fixed: Allow installing on php 8

### [1.7.1] 2020-09-27

  * Fixed: accidental validation of broken constraints combining ^/~ and wildcards, and -dev suffix allowing weird cases
  * Fixed: normalization of beta0 and such which was dropping the 0

### [1.7.0] 2020-09-09

  * Added: support for `x || @dev`, not very useful but seen in the wild and failed to validate with 1.5.2/1.6.0
  * Added: support for `foobar-dev` being equal to `dev-foobar`, dev-foobar is the official way to write it but we need to support the other for BC and convenience

### [1.6.0] 2020-09-08

  * Added: support for constraints like `^2.x-dev` and `~2.x-dev`, not very useful but seen in the wild and failed to validate with 1.5.2
  * Fixed: invalid aliases will no longer throw, unless explicitly validated by Composer in the root package

### [1.5.2] 2020-09-08

  * Fixed: handling of some invalid -dev versions which were seen as valid
  * Fixed: some doctypes

### [1.5.1] 2020-01-13

  * Fixed: Parsing of aliased version was not validating the alias to be a valid version

### [1.5.0] 2019-03-19

  * Added: some support for date versions (e.g. 201903) in `~` operator
  * Fixed: support for stabilities in `~` operator was inconsistent

### [1.4.2] 2016-08-30

  * Fixed: collapsing of complex constraints lead to buggy constraints

### [1.4.1] 2016-06-02

  * Changed: branch-like requirements no longer strip build metadata - [composer/semver#38](https://github.com/composer/semver/pull/38).

### [1.4.0] 2016-03-30

  * Added: getters on MultiConstraint - [composer/semver#35](https://github.com/composer/semver/pull/35).

### [1.3.0] 2016-02-25

  * Fixed: stability parsing - [composer/composer#1234](https://github.com/composer/composer/issues/4889).
  * Changed: collapse contiguous constraints when possible.

### [1.2.0] 2015-11-10

  * Changed: allow multiple numerical identifiers in 'pre-release' version part.
  * Changed: add more 'v' prefix support.

### [1.1.0] 2015-11-03

  * Changed: dropped redundant `test` namespace.
  * Changed: minor adjustment in datetime parsing normalization.
  * Changed: `ConstraintInterface` relaxed, setPrettyString is not required anymore.
  * Changed: `AbstractConstraint` marked deprecated, will be removed in 2.0.
  * Changed: `Constraint` is now extensible.

### [1.0.0] 2015-09-21

  * Break: `VersionConstraint` renamed to `Constraint`.
  * Break: `SpecificConstraint` renamed to `AbstractConstraint`.
  * Break: `LinkConstraintInterface` renamed to `ConstraintInterface`.
  * Break: `VersionParser::parseNameVersionPairs` was removed.
  * Changed: `VersionParser::parseConstraints` allows (but ignores) build metadata now.
  * Changed: `VersionParser::parseConstraints` allows (but ignores) prefixing numeric versions with a 'v' now.
  * Changed: Fixed namespace(s) of test files.
  * Changed: `Comparator::compare` no longer throws `InvalidArgumentException`.
  * Changed: `Constraint` now throws `InvalidArgumentException`.

### [0.1.0] 2015-07-23

  * Added: `Composer\Semver\Comparator`, various methods to compare versions.
  * Added: various documents such as README.md, LICENSE, etc.
  * Added: configuration files for Git, Travis, php-cs-fixer, phpunit.
  * Break: the following namespaces were renamed:
    - Namespace: `Composer\Package\Version` -> `Composer\Semver`
    - Namespace: `Composer\Package\LinkConstraint` -> `Composer\Semver\Constraint`
    - Namespace: `Composer\Test\Package\Version` -> `Composer\Test\Semver`
    - Namespace: `Composer\Test\Package\LinkConstraint` -> `Composer\Test\Semver\Constraint`
  * Changed: code style using php-cs-fixer.

[1.7.2]: https://github.com/composer/semver/compare/1.7.1...1.7.2
[1.7.1]: https://github.com/composer/semver/compare/1.7.0...1.7.1
[1.7.0]: https://github.com/composer/semver/compare/1.6.0...1.7.0
[1.6.0]: https://github.com/composer/semver/compare/1.5.2...1.6.0
[1.5.2]: https://github.com/composer/semver/compare/1.5.1...1.5.2
[1.5.1]: https://github.com/composer/semver/compare/1.5.0...1.5.1
[1.5.0]: https://github.com/composer/semver/compare/1.4.2...1.5.0
[1.4.2]: https://github.com/composer/semver/compare/1.4.1...1.4.2
[1.4.1]: https://github.com/composer/semver/compare/1.4.0...1.4.1
[1.4.0]: https://github.com/composer/semver/compare/1.3.0...1.4.0
[1.3.0]: https://github.com/composer/semver/compare/1.2.0...1.3.0
[1.2.0]: https://github.com/composer/semver/compare/1.1.0...1.2.0
[1.1.0]: https://github.com/composer/semver/compare/1.0.0...1.1.0
[1.0.0]: https://github.com/composer/semver/compare/0.1.0...1.0.0
[0.1.0]: https://github.com/composer/semver/compare/5e0b9a4da...0.1.0
<?php

/*
 * This file is part of composer/semver.
 *
 * (c) Composer <https://github.com/composer>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Composer\Semver;

use Composer\Semver\Constraint\ConstraintInterface;
use Composer\Semver\Constraint\EmptyConstraint;
use Composer\Semver\Constraint\MultiConstraint;
use Composer\Semver\Constraint\Constraint;

/**
 * Version parser.
 *
 * @author Jordi Boggiano <j.boggiano@seld.be>
 */
class VersionParser
{
    /**
     * Regex to match pre-release data (sort of).
     *
     * Due to backwards compatibility:
     *   - Instead of enforcing hyphen, an underscore, dot or nothing at all are also accepted.
     *   - Only stabilities as recognized by Composer are allowed to precede a numerical identifier.
     *   - Numerical-only pre-release identifiers are not supported, see tests.
     *
     *                        |--------------|
     * [major].[minor].[patch] -[pre-release] +[build-metadata]
     *
     * @var string
     */
    private static $modifierRegex = '[._-]?(?:(stable|beta|b|RC|alpha|a|patch|pl|p)((?:[.-]?\d+)*+)?)?([.-]?dev)?';

    /** @var string */
    private static $stabilitiesRegex = 'stable|RC|beta|alpha|dev';

    /**
     * Returns the stability of a version.
     *
     * @param string $version
     *
     * @return string
     */
    public static function parseStability($version)
    {
        $version = preg_replace('{#.+$}i', '', $version);

        if (strpos($version, 'dev-') === 0 || '-dev' === substr($version, -4)) {
            return 'dev';
        }

        preg_match('{' . self::$modifierRegex . '(?:\+.*)?$}i', strtolower($version), $match);

        if (!empty($match[3])) {
            return 'dev';
        }

        if (!empty($match[1])) {
            if ('beta' === $match[1] || 'b' === $match[1]) {
                return 'beta';
            }
            if ('alpha' === $match[1] || 'a' === $match[1]) {
                return 'alpha';
            }
            if ('rc' === $match[1]) {
                return 'RC';
            }
        }

        return 'stable';
    }

    /**
     * @param string $stability
     *
     * @return string
     */
    public static function normalizeStability($stability)
    {
        $stability = strtolower($stability);

        return $stability === 'rc' ? 'RC' : $stability;
    }

    /**
     * Normalizes a version string to be able to perform comparisons on it.
     *
     * @param string $version
     * @param string $fullVersion optional complete version string to give more context
     *
     * @throws \UnexpectedValueException
     *
     * @return string
     */
    public function normalize($version, $fullVersion = null)
    {
        $version = trim($version);
        $origVersion = $version;
        if (null === $fullVersion) {
            $fullVersion = $version;
        }

        // strip off aliasing
        if (preg_match('{^([^,\s]++) ++as ++([^,\s]++)$}', $version, $match)) {
            $version = $match[1];
        }

        // strip off stability flag
        if (preg_match('{@(?:' . self::$stabilitiesRegex . ')$}i', $version, $match)) {
            $version = substr($version, 0, strlen($version) - strlen($match[0]));
        }

        // match master-like branches
        if (preg_match('{^(?:dev-)?(?:master|trunk|default)$}i', $version)) {
            return '9999999-dev';
        }

        // if requirement is branch-like, use full name
        if (stripos($version, 'dev-') === 0) {
            return 'dev-' . substr($version, 4);
        }

        // strip off build metadata
        if (preg_match('{^([^,\s+]++)\+[^\s]++$}', $version, $match)) {
            $version = $match[1];
        }

        // match classical versioning
        if (preg_match('{^v?(\d{1,5})(\.\d++)?(\.\d++)?(\.\d++)?' . self::$modifierRegex . '$}i', $version, $matches)) {
            $version = $matches[1]
                . (!empty($matches[2]) ? $matches[2] : '.0')
                . (!empty($matches[3]) ? $matches[3] : '.0')
                . (!empty($matches[4]) ? $matches[4] : '.0');
            $index = 5;
        // match date(time) based versioning
        } elseif (preg_match('{^v?(\d{4}(?:[.:-]?\d{2}){1,6}(?:[.:-]?\d{1,3})?)' . self::$modifierRegex . '$}i', $version, $matches)) {
            $version = preg_replace('{\D}', '.', $matches[1]);
            $index = 2;
        }

        // add version modifiers if a version was matched
        if (isset($index)) {
            if (!empty($matches[$index])) {
                if ('stable' === $matches[$index]) {
                    return $version;
                }
                $version .= '-' . $this->expandStability($matches[$index]) . (isset($matches[$index + 1]) && '' !== $matches[$index + 1] ? ltrim($matches[$index + 1], '.-') : '');
            }

            if (!empty($matches[$index + 2])) {
                $version .= '-dev';
            }

            return $version;
        }

        // match dev branches
        if (preg_match('{(.*?)[.-]?dev$}i', $version, $match)) {
            try {
                $normalized = $this->normalizeBranch($match[1]);
                // a branch ending with -dev is only valid if it is numeric
                // if it gets prefixed with dev- it means the branch name should
                // have had a dev- prefix already when passed to normalize
                if (strpos($normalized, 'dev-') === false) {
                    return $normalized;
                }
            } catch (\Exception $e) {
            }
        }

        $extraMessage = '';
        if (preg_match('{ +as +' . preg_quote($version) . '(?:@(?:'.self::$stabilitiesRegex.'))?$}', $fullVersion)) {
            $extraMessage = ' in "' . $fullVersion . '", the alias must be an exact version';
        } elseif (preg_match('{^' . preg_quote($version) . '(?:@(?:'.self::$stabilitiesRegex.'))? +as +}', $fullVersion)) {
            $extraMessage = ' in "' . $fullVersion . '", the alias source must be an exact version, if it is a branch name you should prefix it with dev-';
        }

        throw new \UnexpectedValueException('Invalid version string "' . $origVersion . '"' . $extraMessage);
    }

    /**
     * Extract numeric prefix from alias, if it is in numeric format, suitable for version comparison.
     *
     * @param string $branch Branch name (e.g. 2.1.x-dev)
     *
     * @return string|false Numeric prefix if present (e.g. 2.1.) or false
     */
    public function parseNumericAliasPrefix($branch)
    {
        if (preg_match('{^(?P<version>(\d++\\.)*\d++)(?:\.x)?-dev$}i', $branch, $matches)) {
            return $matches['version'] . '.';
        }

        return false;
    }

    /**
     * Normalizes a branch name to be able to perform comparisons on it.
     *
     * @param string $name
     *
     * @return string
     */
    public function normalizeBranch($name)
    {
        $name = trim($name);

        if (in_array($name, array('master', 'trunk', 'default'))) {
            return $this->normalize($name);
        }

        if (preg_match('{^v?(\d++)(\.(?:\d++|[xX*]))?(\.(?:\d++|[xX*]))?(\.(?:\d++|[xX*]))?$}i', $name, $matches)) {
            $version = '';
            for ($i = 1; $i < 5; ++$i) {
                $version .= isset($matches[$i]) ? str_replace(array('*', 'X'), 'x', $matches[$i]) : '.x';
            }

            return str_replace('x', '9999999', $version) . '-dev';
        }

        return 'dev-' . $name;
    }

    /**
     * Parses a constraint string into MultiConstraint and/or Constraint objects.
     *
     * @param string $constraints
     *
     * @return ConstraintInterface
     */
    public function parseConstraints($constraints)
    {
        $prettyConstraint = $constraints;

        $orConstraints = preg_split('{\s*\|\|?\s*}', trim($constraints));
        $orGroups = array();

        foreach ($orConstraints as $constraints) {
            $andConstraints = preg_split('{(?<!^|as|[=>< ,]) *(?<!-)[, ](?!-) *(?!,|as|$)}', $constraints);
            if (count($andConstraints) > 1) {
                $constraintObjects = array();
                foreach ($andConstraints as $constraint) {
                    foreach ($this->parseConstraint($constraint) as $parsedConstraint) {
                        $constraintObjects[] = $parsedConstraint;
                    }
                }
            } else {
                $constraintObjects = $this->parseConstraint($andConstraints[0]);
            }

            if (1 === count($constraintObjects)) {
                $constraint = $constraintObjects[0];
            } else {
                $constraint = new MultiConstraint($constraintObjects);
            }

            $orGroups[] = $constraint;
        }

        if (1 === count($orGroups)) {
            $constraint = $orGroups[0];
        } elseif (2 === count($orGroups)
            // parse the two OR groups and if they are contiguous we collapse
            // them into one constraint
            && $orGroups[0] instanceof MultiConstraint
            && $orGroups[1] instanceof MultiConstraint
            && 2 === count($orGroups[0]->getConstraints())
            && 2 === count($orGroups[1]->getConstraints())
            && ($a = (string) $orGroups[0])
            && strpos($a, '[>=') === 0 && (false !== ($posA = strpos($a, '<', 4)))
            && ($b = (string) $orGroups[1])
            && strpos($b, '[>=') === 0 && (false !== ($posB = strpos($b, '<', 4)))
            && substr($a, $posA + 2, -1) === substr($b, 4, $posB - 5)
        ) {
            $constraint = new MultiConstraint(array(
                new Constraint('>=', substr($a, 4, $posA - 5)),
                new Constraint('<', substr($b, $posB + 2, -1)),
            ));
        } else {
            $constraint = new MultiConstraint($orGroups, false);
        }

        $constraint->setPrettyString($prettyConstraint);

        return $constraint;
    }

    /**
     * @param string $constraint
     *
     * @throws \UnexpectedValueException
     *
     * @return array
     */
    private function parseConstraint($constraint)
    {
        // strip off aliasing
        if (preg_match('{^([^,\s]++) ++as ++([^,\s]++)$}', $constraint, $match)) {
            $constraint = $match[1];
        }

        // strip @stability flags, and keep it for later use
        if (preg_match('{^([^,\s]*?)@(' . self::$stabilitiesRegex . ')$}i', $constraint, $match)) {
            $constraint = '' !== $match[1] ? $match[1] : '*';
            if ($match[2] !== 'stable') {
                $stabilityModifier = $match[2];
            }
        }

        // get rid of #refs as those are used by composer only
        if (preg_match('{^(dev-[^,\s@]+?|[^,\s@]+?\.x-dev)#.+$}i', $constraint, $match)) {
            $constraint = $match[1];
        }

        if (preg_match('{^v?[xX*](\.[xX*])*$}i', $constraint)) {
            return array(new EmptyConstraint());
        }

        $versionRegex = 'v?(\d++)(?:\.(\d++))?(?:\.(\d++))?(?:\.(\d++))?(?:' . self::$modifierRegex . '|\.([xX*][.-]?dev))(?:\+[^\s]+)?';

        // Tilde Range
        //
        // Like wildcard constraints, unsuffixed tilde constraints say that they must be greater than the previous
        // version, to ensure that unstable instances of the current version are allowed. However, if a stability
        // suffix is added to the constraint, then a >= match on the current version is used instead.
        if (preg_match('{^~>?' . $versionRegex . '$}i', $constraint, $matches)) {
            if (strpos($constraint, '~>') === 0) {
                throw new \UnexpectedValueException(
                    'Could not parse version constraint ' . $constraint . ': ' .
                    'Invalid operator "~>", you probably meant to use the "~" operator'
                );
            }

            // Work out which position in the version we are operating at
            if (isset($matches[4]) && '' !== $matches[4] && null !== $matches[4]) {
                $position = 4;
            } elseif (isset($matches[3]) && '' !== $matches[3] && null !== $matches[3]) {
                $position = 3;
            } elseif (isset($matches[2]) && '' !== $matches[2] && null !== $matches[2]) {
                $position = 2;
            } else {
                $position = 1;
            }

            // when matching 2.x-dev or 3.0.x-dev we have to shift the second or third number, despite no second/third number matching above
            if (!empty($matches[8])) {
                $position++;
            }

            // Calculate the stability suffix
            $stabilitySuffix = '';
            if (empty($matches[5]) && empty($matches[7]) && empty($matches[8])) {
                $stabilitySuffix .= '-dev';
            }

            $lowVersion = $this->normalize(substr($constraint . $stabilitySuffix, 1));
            $lowerBound = new Constraint('>=', $lowVersion);

            // For upper bound, we increment the position of one more significance,
            // but highPosition = 0 would be illegal
            $highPosition = max(1, $position - 1);
            $highVersion = $this->manipulateVersionString($matches, $highPosition, 1) . '-dev';
            $upperBound = new Constraint('<', $highVersion);

            return array(
                $lowerBound,
                $upperBound,
            );
        }

        // Caret Range
        //
        // Allows changes that do not modify the left-most non-zero digit in the [major, minor, patch] tuple.
        // In other words, this allows patch and minor updates for versions 1.0.0 and above, patch updates for
        // versions 0.X >=0.1.0, and no updates for versions 0.0.X
        if (preg_match('{^\^' . $versionRegex . '($)}i', $constraint, $matches)) {
            // Work out which position in the version we are operating at
            if ('0' !== $matches[1] || '' === $matches[2] || null === $matches[2]) {
                $position = 1;
            } elseif ('0' !== $matches[2] || '' === $matches[3] || null === $matches[3]) {
                $position = 2;
            } else {
                $position = 3;
            }

            // Calculate the stability suffix
            $stabilitySuffix = '';
            if (empty($matches[5]) && empty($matches[7]) && empty($matches[8])) {
                $stabilitySuffix .= '-dev';
            }

            $lowVersion = $this->normalize(substr($constraint . $stabilitySuffix, 1));
            $lowerBound = new Constraint('>=', $lowVersion);

            // For upper bound, we increment the position of one more significance,
            // but highPosition = 0 would be illegal
            $highVersion = $this->manipulateVersionString($matches, $position, 1) . '-dev';
            $upperBound = new Constraint('<', $highVersion);

            return array(
                $lowerBound,
                $upperBound,
            );
        }

        // X Range
        //
        // Any of X, x, or * may be used to "stand in" for one of the numeric values in the [major, minor, patch] tuple.
        // A partial version range is treated as an X-Range, so the special character is in fact optional.
        if (preg_match('{^v?(\d++)(?:\.(\d++))?(?:\.(\d++))?(?:\.[xX*])++$}', $constraint, $matches)) {
            if (isset($matches[3]) && '' !== $matches[3] && null !== $matches[3]) {
                $position = 3;
            } elseif (isset($matches[2]) && '' !== $matches[2] && null !== $matches[2]) {
                $position = 2;
            } else {
                $position = 1;
            }

            $lowVersion = $this->manipulateVersionString($matches, $position) . '-dev';
            $highVersion = $this->manipulateVersionString($matches, $position, 1) . '-dev';

            if ($lowVersion === '0.0.0.0-dev') {
                return array(new Constraint('<', $highVersion));
            }

            return array(
                new Constraint('>=', $lowVersion),
                new Constraint('<', $highVersion),
            );
        }

        // Hyphen Range
        //
        // Specifies an inclusive set. If a partial version is provided as the first version in the inclusive range,
        // then the missing pieces are replaced with zeroes. If a partial version is provided as the second version in
        // the inclusive range, then all versions that start with the supplied parts of the tuple are accepted, but
        // nothing that would be greater than the provided tuple parts.
        if (preg_match('{^(?P<from>' . $versionRegex . ') +- +(?P<to>' . $versionRegex . ')($)}i', $constraint, $matches)) {
            // Calculate the stability suffix
            $lowStabilitySuffix = '';
            if (empty($matches[6]) && empty($matches[8]) && empty($matches[9])) {
                $lowStabilitySuffix = '-dev';
            }

            $lowVersion = $this->normalize($matches['from']);
            $lowerBound = new Constraint('>=', $lowVersion . $lowStabilitySuffix);

            $empty = function ($x) {
                return ($x === 0 || $x === '0') ? false : empty($x);
            };

            if ((!$empty($matches[12]) && !$empty($matches[13])) || !empty($matches[15]) || !empty($matches[17]) || !empty($matches[18])) {
                $highVersion = $this->normalize($matches['to']);
                $upperBound = new Constraint('<=', $highVersion);
            } else {
                $highMatch = array('', $matches[11], $matches[12], $matches[13], $matches[14]);

                // validate to version
                $this->normalize($matches['to']);

                $highVersion = $this->manipulateVersionString($highMatch, $empty($matches[12]) ? 1 : 2, 1) . '-dev';
                $upperBound = new Constraint('<', $highVersion);
            }

            return array(
                $lowerBound,
                $upperBound,
            );
        }

        // Basic Comparators
        if (preg_match('{^(<>|!=|>=?|<=?|==?)?\s*(.*)}', $constraint, $matches)) {
            try {
                try {
                    $version = $this->normalize($matches[2]);
                } catch (\UnexpectedValueException $e) {
                    // recover from an invalid constraint like foobar-dev which should be dev-foobar
                    // except if the constraint uses a known operator, in which case it must be a parse error
                    if (substr($matches[2], -4) === '-dev' && preg_match('{^[0-9a-zA-Z-./]+$}', $matches[2])) {
                        $version = $this->normalize('dev-'.substr($matches[2], 0, -4));
                    } else {
                        throw $e;
                    }
                }

                $op = $matches[1] ?: '=';

                if ($op !== '==' && $op !== '=' && !empty($stabilityModifier) && self::parseStability($version) === 'stable') {
                    $version .= '-' . $stabilityModifier;
                } elseif ('<' === $op || '>=' === $op) {
                    if (!preg_match('/-' . self::$modifierRegex . '$/', strtolower($matches[2]))) {
                        if (strpos($matches[2], 'dev-') !== 0) {
                            $version .= '-dev';
                        }
                    }
                }

                return array(new Constraint($matches[1] ?: '=', $version));
            } catch (\Exception $e) {
            }
        }

        $message = 'Could not parse version constraint ' . $constraint;
        if (isset($e)) {
            $message .= ': ' . $e->getMessage();
        }

        throw new \UnexpectedValueException($message);
    }

    /**
     * Increment, decrement, or simply pad a version number.
     *
     * Support function for {@link parseConstraint()}
     *
     * @param array  $matches   Array with version parts in array indexes 1,2,3,4
     * @param int    $position  1,2,3,4 - which segment of the version to increment/decrement
     * @param int    $increment
     * @param string $pad       The string to pad version parts after $position
     *
     * @return string|null The new version
     */
    private function manipulateVersionString($matches, $position, $increment = 0, $pad = '0')
    {
        for ($i = 4; $i > 0; --$i) {
            if ($i > $position) {
                $matches[$i] = $pad;
            } elseif ($i === $position && $increment) {
                $matches[$i] += $increment;
                // If $matches[$i] was 0, carry the decrement
                if ($matches[$i] < 0) {
                    $matches[$i] = $pad;
                    --$position;

                    // Return null on a carry overflow
                    if ($i === 1) {
                        return null;
                    }
                }
            }
        }

        return $matches[1] . '.' . $matches[2] . '.' . $matches[3] . '.' . $matches[4];
    }

    /**
     * Expand shorthand stability string to long version.
     *
     * @param string $stability
     *
     * @return string
     */
    private function expandStability($stability)
    {
        $stability = strtolower($stability);

        switch ($stability) {
            case 'a':
                return 'alpha';
            case 'b':
                return 'beta';
            case 'p':
            case 'pl':
                return 'patch';
            case 'rc':
                return 'RC';
            default:
                return $stability;
        }
    }
}
<?php

/*
 * This file is part of composer/semver.
 *
 * (c) Composer <https://github.com/composer>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Composer\Semver;

use Composer\Semver\Constraint\Constraint;

class Comparator
{
    /**
     * Evaluates the expression: $version1 > $version2.
     *
     * @param string $version1
     * @param string $version2
     *
     * @return bool
     */
    public static function greaterThan($version1, $version2)
    {
        return self::compare($version1, '>', $version2);
    }

    /**
     * Evaluates the expression: $version1 >= $version2.
     *
     * @param string $version1
     * @param string $version2
     *
     * @return bool
     */
    public static function greaterThanOrEqualTo($version1, $version2)
    {
        return self::compare($version1, '>=', $version2);
    }

    /**
     * Evaluates the expression: $version1 < $version2.
     *
     * @param string $version1
     * @param string $version2
     *
     * @return bool
     */
    public static function lessThan($version1, $version2)
    {
        return self::compare($version1, '<', $version2);
    }

    /**
     * Evaluates the expression: $version1 <= $version2.
     *
     * @param string $version1
     * @param string $version2
     *
     * @return bool
     */
    public static function lessThanOrEqualTo($version1, $version2)
    {
        return self::compare($version1, '<=', $version2);
    }

    /**
     * Evaluates the expression: $version1 == $version2.
     *
     * @param string $version1
     * @param string $version2
     *
     * @return bool
     */
    public static function equalTo($version1, $version2)
    {
        return self::compare($version1, '==', $version2);
    }

    /**
     * Evaluates the expression: $version1 != $version2.
     *
     * @param string $version1
     * @param string $version2
     *
     * @return bool
     */
    public static function notEqualTo($version1, $version2)
    {
        return self::compare($version1, '!=', $version2);
    }

    /**
     * Evaluates the expression: $version1 $operator $version2.
     *
     * @param string $version1
     * @param string $operator
     * @param string $version2
     *
     * @return bool
     */
    public static function compare($version1, $operator, $version2)
    {
        $constraint = new Constraint($operator, $version2);

        return $constraint->matches(new Constraint('==', $version1));
    }
}
<?php

/*
 * This file is part of composer/semver.
 *
 * (c) Composer <https://github.com/composer>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Composer\Semver\Constraint;

/**
 * Defines a conjunctive or disjunctive set of constraints.
 */
class MultiConstraint implements ConstraintInterface
{
    /** @var ConstraintInterface[] */
    protected $constraints;

    /** @var string|null */
    protected $prettyString;

    /** @var bool */
    protected $conjunctive;

    /**
     * @param ConstraintInterface[] $constraints A set of constraints
     * @param bool                  $conjunctive Whether the constraints should be treated as conjunctive or disjunctive
     */
    public function __construct(array $constraints, $conjunctive = true)
    {
        $this->constraints = $constraints;
        $this->conjunctive = $conjunctive;
    }

    /**
     * @return ConstraintInterface[]
     */
    public function getConstraints()
    {
        return $this->constraints;
    }

    /**
     * @return bool
     */
    public function isConjunctive()
    {
        return $this->conjunctive;
    }

    /**
     * @return bool
     */
    public function isDisjunctive()
    {
        return !$this->conjunctive;
    }

    /**
     * @param ConstraintInterface $provider
     *
     * @return bool
     */
    public function matches(ConstraintInterface $provider)
    {
        if (false === $this->conjunctive) {
            foreach ($this->constraints as $constraint) {
                if ($constraint->matches($provider)) {
                    return true;
                }
            }

            return false;
        }

        foreach ($this->constraints as $constraint) {
            if (!$constraint->matches($provider)) {
                return false;
            }
        }

        return true;
    }

    /**
     * @param string|null $prettyString
     */
    public function setPrettyString($prettyString)
    {
        $this->prettyString = $prettyString;
    }

    /**
     * @return string
     */
    public function getPrettyString()
    {
        if ($this->prettyString) {
            return $this->prettyString;
        }

        return (string) $this;
    }

    /**
     * @return string
     */
    public function __toString()
    {
        $constraints = array();
        foreach ($this->constraints as $constraint) {
            $constraints[] = (string) $constraint;
        }

        return '[' . implode($this->conjunctive ? ' ' : ' || ', $constraints) . ']';
    }
}
<?php

/*
 * This file is part of composer/semver.
 *
 * (c) Composer <https://github.com/composer>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Composer\Semver\Constraint;

interface ConstraintInterface
{
    /**
     * @param ConstraintInterface $provider
     *
     * @return bool
     */
    public function matches(ConstraintInterface $provider);

    /**
     * @return string
     */
    public function getPrettyString();

    /**
     * @return string
     */
    public function __toString();
}
<?php

/*
 * This file is part of composer/semver.
 *
 * (c) Composer <https://github.com/composer>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Composer\Semver\Constraint;

trigger_error('The ' . __NAMESPACE__ . '\AbstractConstraint abstract class is deprecated, there is no replacement for it, it will be removed in the next major version.', E_USER_DEPRECATED);

/**
 * Base constraint class.
 */
abstract class AbstractConstraint implements ConstraintInterface
{
    /** @var string */
    protected $prettyString;

    /**
     * @param ConstraintInterface $provider
     *
     * @return bool
     */
    public function matches(ConstraintInterface $provider)
    {
        if ($provider instanceof $this) {
            // see note at bottom of this class declaration
            return $this->matchSpecific($provider);
        }

        // turn matching around to find a match
        return $provider->matches($this);
    }

    /**
     * @param string $prettyString
     */
    public function setPrettyString($prettyString)
    {
        $this->prettyString = $prettyString;
    }

    /**
     * @return string
     */
    public function getPrettyString()
    {
        if ($this->prettyString) {
            return $this->prettyString;
        }

        return $this->__toString();
    }

    // implementations must implement a method of this format:
    // not declared abstract here because type hinting violates parameter coherence (TODO right word?)
    // public function matchSpecific(<SpecificConstraintType> $provider);
}
<?php

/*
 * This file is part of composer/semver.
 *
 * (c) Composer <https://github.com/composer>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Composer\Semver\Constraint;

/**
 * Defines a constraint.
 */
class Constraint implements ConstraintInterface
{
    /* operator integer values */
    const OP_EQ = 0;
    const OP_LT = 1;
    const OP_LE = 2;
    const OP_GT = 3;
    const OP_GE = 4;
    const OP_NE = 5;

    /**
     * Operator to integer translation table.
     *
     * @var array
     */
    private static $transOpStr = array(
        '=' => self::OP_EQ,
        '==' => self::OP_EQ,
        '<' => self::OP_LT,
        '<=' => self::OP_LE,
        '>' => self::OP_GT,
        '>=' => self::OP_GE,
        '<>' => self::OP_NE,
        '!=' => self::OP_NE,
    );

    /**
     * Integer to operator translation table.
     *
     * @var array
     */
    private static $transOpInt = array(
        self::OP_EQ => '==',
        self::OP_LT => '<',
        self::OP_LE => '<=',
        self::OP_GT => '>',
        self::OP_GE => '>=',
        self::OP_NE => '!=',
    );

    /** @var int */
    protected $operator;

    /** @var string */
    protected $version;

    /** @var string */
    protected $prettyString;

    /**
     * @param ConstraintInterface $provider
     *
     * @return bool
     */
    public function matches(ConstraintInterface $provider)
    {
        if ($provider instanceof $this) {
            return $this->matchSpecific($provider);
        }

        // turn matching around to find a match
        return $provider->matches($this);
    }

    /**
     * @param string $prettyString
     */
    public function setPrettyString($prettyString)
    {
        $this->prettyString = $prettyString;
    }

    /**
     * @return string
     */
    public function getPrettyString()
    {
        if ($this->prettyString) {
            return $this->prettyString;
        }

        return $this->__toString();
    }

    /**
     * Get all supported comparison operators.
     *
     * @return array
     */
    public static function getSupportedOperators()
    {
        return array_keys(self::$transOpStr);
    }

    /**
     * Sets operator and version to compare with.
     *
     * @param string $operator
     * @param string $version
     *
     * @throws \InvalidArgumentException if invalid operator is given.
     */
    public function __construct($operator, $version)
    {
        if (!isset(self::$transOpStr[$operator])) {
            throw new \InvalidArgumentException(sprintf(
                'Invalid operator "%s" given, expected one of: %s',
                $operator,
                implode(', ', self::getSupportedOperators())
            ));
        }

        $this->operator = self::$transOpStr[$operator];
        $this->version = $version;
    }

    /**
     * @param string $a
     * @param string $b
     * @param string $operator
     * @param bool   $compareBranches
     *
     * @throws \InvalidArgumentException if invalid operator is given.
     *
     * @return bool
     */
    public function versionCompare($a, $b, $operator, $compareBranches = false)
    {
        if (!isset(self::$transOpStr[$operator])) {
            throw new \InvalidArgumentException(sprintf(
                'Invalid operator "%s" given, expected one of: %s',
                $operator,
                implode(', ', self::getSupportedOperators())
            ));
        }

        $aIsBranch = 'dev-' === substr($a, 0, 4);
        $bIsBranch = 'dev-' === substr($b, 0, 4);

        if ($aIsBranch && $bIsBranch) {
            return $operator === '==' && $a === $b;
        }

        // when branches are not comparable, we make sure dev branches never match anything
        if (!$compareBranches && ($aIsBranch || $bIsBranch)) {
            return false;
        }

        return version_compare($a, $b, $operator);
    }

    /**
     * @param Constraint $provider
     * @param bool       $compareBranches
     *
     * @return bool
     */
    public function matchSpecific(Constraint $provider, $compareBranches = false)
    {
        $noEqualOp = str_replace('=', '', self::$transOpInt[$this->operator]);
        $providerNoEqualOp = str_replace('=', '', self::$transOpInt[$provider->operator]);

        $isEqualOp = self::OP_EQ === $this->operator;
        $isNonEqualOp = self::OP_NE === $this->operator;
        $isProviderEqualOp = self::OP_EQ === $provider->operator;
        $isProviderNonEqualOp = self::OP_NE === $provider->operator;

        // '!=' operator is match when other operator is not '==' operator or version is not match
        // these kinds of comparisons always have a solution
        if ($isNonEqualOp || $isProviderNonEqualOp) {
            return (!$isEqualOp && !$isProviderEqualOp)
                || $this->versionCompare($provider->version, $this->version, '!=', $compareBranches);
        }

        // an example for the condition is <= 2.0 & < 1.0
        // these kinds of comparisons always have a solution
        if ($this->operator !== self::OP_EQ && $noEqualOp === $providerNoEqualOp) {
            return true;
        }

        if ($this->versionCompare($provider->version, $this->version, self::$transOpInt[$this->operator], $compareBranches)) {
            // special case, e.g. require >= 1.0 and provide < 1.0
            // 1.0 >= 1.0 but 1.0 is outside of the provided interval
            return !($provider->version === $this->version
                && self::$transOpInt[$provider->operator] === $providerNoEqualOp
                && self::$transOpInt[$this->operator] !== $noEqualOp);
        }

        return false;
    }

    /**
     * @return string
     */
    public function __toString()
    {
        return self::$transOpInt[$this->operator] . ' ' . $this->version;
    }
}
<?php

/*
 * This file is part of composer/semver.
 *
 * (c) Composer <https://github.com/composer>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Composer\Semver\Constraint;

/**
 * Defines the absence of a constraint.
 */
class EmptyConstraint implements ConstraintInterface
{
    /** @var string */
    protected $prettyString;

    /**
     * @param ConstraintInterface $provider
     *
     * @return bool
     */
    public function matches(ConstraintInterface $provider)
    {
        return true;
    }

    /**
     * @param string $prettyString
     */
    public function setPrettyString($prettyString)
    {
        $this->prettyString = $prettyString;
    }

    /**
     * @return string
     */
    public function getPrettyString()
    {
        if ($this->prettyString) {
            return $this->prettyString;
        }

        return (string) $this;
    }

    /**
     * @return string
     */
    public function __toString()
    {
        return '[]';
    }
}
<?php

/*
 * This file is part of composer/semver.
 *
 * (c) Composer <https://github.com/composer>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Composer\Semver;

use Composer\Semver\Constraint\Constraint;

class Semver
{
    const SORT_ASC = 1;
    const SORT_DESC = -1;

    /** @var VersionParser */
    private static $versionParser;

    /**
     * Determine if given version satisfies given constraints.
     *
     * @param string $version
     * @param string $constraints
     *
     * @return bool
     */
    public static function satisfies($version, $constraints)
    {
        if (null === self::$versionParser) {
            self::$versionParser = new VersionParser();
        }

        $versionParser = self::$versionParser;
        $provider = new Constraint('==', $versionParser->normalize($version));
        $parsedConstraints = $versionParser->parseConstraints($constraints);

        return $parsedConstraints->matches($provider);
    }

    /**
     * Return all versions that satisfy given constraints.
     *
     * @param array  $versions
     * @param string $constraints
     *
     * @return array
     */
    public static function satisfiedBy(array $versions, $constraints)
    {
        $versions = array_filter($versions, function ($version) use ($constraints) {
            return Semver::satisfies($version, $constraints);
        });

        return array_values($versions);
    }

    /**
     * Sort given array of versions.
     *
     * @param array $versions
     *
     * @return array
     */
    public static function sort(array $versions)
    {
        return self::usort($versions, self::SORT_ASC);
    }

    /**
     * Sort given array of versions in reverse.
     *
     * @param array $versions
     *
     * @return array
     */
    public static function rsort(array $versions)
    {
        return self::usort($versions, self::SORT_DESC);
    }

    /**
     * @param array $versions
     * @param int   $direction
     *
     * @return array
     */
    private static function usort(array $versions, $direction)
    {
        if (null === self::$versionParser) {
            self::$versionParser = new VersionParser();
        }

        $versionParser = self::$versionParser;
        $normalized = array();

        // Normalize outside of usort() scope for minor performance increase.
        // Creates an array of arrays: [[normalized, key], ...]
        foreach ($versions as $key => $version) {
            $normalized[] = array($versionParser->normalize($version), $key);
        }

        usort($normalized, function (array $left, array $right) use ($direction) {
            if ($left[0] === $right[0]) {
                return 0;
            }

            if (Comparator::lessThan($left[0], $right[0])) {
                return -$direction;
            }

            return $direction;
        });

        // Recreate input array, using the original indexes which are now in sorted order.
        $sorted = array();
        foreach ($normalized as $item) {
            $sorted[] = $versions[$item[1]];
        }

        return $sorted;
    }
}
<?php

// autoload_classmap.php @generated by Composer

$vendorDir = dirname(__DIR__);
$baseDir = dirname($vendorDir);

return array(
    'AppVersionDetector\\Application\\AVDCliParse' => $baseDir . '/src/Application/AVDCliParse.php',
    'AppVersionDetector\\Application\\AVDConfig' => $baseDir . '/src/Application/AVDConfig.php',
    'AppVersionDetector\\Application\\AppException' => $baseDir . '/src/Application/AppException.php',
    'AppVersionDetector\\Application\\CliParse' => $baseDir . '/src/Application/CliParse.php',
    'AppVersionDetector\\Application\\Config' => $baseDir . '/src/Application/Config.php',
    'AppVersionDetector\\Application\\ConfigParamException' => $baseDir . '/src/Application/ConfigParamException.php',
    'AppVersionDetector\\Application\\DetectorBuilder' => $baseDir . '/src/Application/DetectorBuilder.php',
    'AppVersionDetector\\Application\\Directory' => $baseDir . '/src/Application/Directory.php',
    'AppVersionDetector\\Application\\Error\\ErrorHandler' => $baseDir . '/src/Application/Error/ErrorHandler.php',
    'AppVersionDetector\\Application\\Factory' => $baseDir . '/src/Application/Factory.php',
    'AppVersionDetector\\Application\\FeatureFlags' => $baseDir . '/src/Application/FeatureFlags.php',
    'AppVersionDetector\\Application\\FileOwners' => $baseDir . '/src/Application/FileOwners.php',
    'AppVersionDetector\\Application\\Helper' => $baseDir . '/src/Application/Helper.php',
    'AppVersionDetector\\Application\\Migraitor' => $baseDir . '/src/Application/Migraitor.php',
    'AppVersionDetector\\Application\\Profiler' => $baseDir . '/src/Application/Profiler.php',
    'AppVersionDetector\\Application\\Stats' => $baseDir . '/src/Application/Stats.php',
    'AppVersionDetector\\Core\\AbstractEvent' => $baseDir . '/src/Core/AbstractEvent.php',
    'AppVersionDetector\\Core\\ListenerInterface' => $baseDir . '/src/Core/ListenerInterface.php',
    'AppVersionDetector\\Core\\MediatorInterface' => $baseDir . '/src/Core/MediatorInterface.php',
    'AppVersionDetector\\Core\\OutdatedDetection\\ComparisonStrategyInterface' => $baseDir . '/src/Core/OutdatedDetection/ComparisonStrategyInterface.php',
    'AppVersionDetector\\Core\\OutdatedDetection\\GenericComparisonStrategy' => $baseDir . '/src/Core/OutdatedDetection/GenericComparisonStrategy.php',
    'AppVersionDetector\\Core\\OutdatedDetection\\OutdatedChecker' => $baseDir . '/src/Core/OutdatedDetection/OutdatedChecker.php',
    'AppVersionDetector\\Core\\OutdatedDetection\\OutdatedEvent' => $baseDir . '/src/Core/OutdatedDetection/OutdatedEvent.php',
    'AppVersionDetector\\Core\\OutdatedDetection\\VersionDbInterface' => $baseDir . '/src/Core/OutdatedDetection/VersionDbInterface.php',
    'AppVersionDetector\\Core\\PublisherInterface' => $baseDir . '/src/Core/PublisherInterface.php',
    'AppVersionDetector\\Core\\VersionDetection\\AbstractCompositeDetector' => $baseDir . '/src/Core/VersionDetection/AbstractCompositeDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\AbstractDetector' => $baseDir . '/src/Core/VersionDetection/AbstractDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\DependencyCollectionDetector' => $baseDir . '/src/Core/VersionDetection/DependencyCollectionDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\DetectionEvent' => $baseDir . '/src/Core/VersionDetection/DetectionEvent.php',
    'AppVersionDetector\\Core\\VersionDetection\\DetectorInterface' => $baseDir . '/src/Core/VersionDetection/DetectorInterface.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\BitrixCoreDetector' => $baseDir . '/src/Core/VersionDetection/Detector/BitrixCoreDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\CommonScriptDetector' => $baseDir . '/src/Core/VersionDetection/Detector/CommonScriptDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\DrupalCoreDetector' => $baseDir . '/src/Core/VersionDetection/Detector/DrupalCoreDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\DrupalPluginDetector' => $baseDir . '/src/Core/VersionDetection/Detector/DrupalPluginDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\DummyDetector' => $baseDir . '/src/Core/VersionDetection/Detector/DummyDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\ForkingWpOptionsReader' => $baseDir . '/src/Core/VersionDetection/Detector/ForkingWpOptionsReader.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\IPBCoreDetector' => $baseDir . '/src/Core/VersionDetection/Detector/IPBCoreDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\JoomlaCoreDetector' => $baseDir . '/src/Core/VersionDetection/Detector/JoomlaCoreDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\JoomlaPluginDetector' => $baseDir . '/src/Core/VersionDetection/Detector/JoomlaPluginDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\MagentoCoreDetector' => $baseDir . '/src/Core/VersionDetection/Detector/MagentoCoreDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\ModxCoreDetector' => $baseDir . '/src/Core/VersionDetection/Detector/ModxCoreDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\MysqliWpOptionsReader' => $baseDir . '/src/Core/VersionDetection/Detector/MysqliWpOptionsReader.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\NodeJsAppDetector' => $baseDir . '/src/Core/VersionDetection/Detector/NodeJsAppDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\NodeJsPackageDetector' => $baseDir . '/src/Core/VersionDetection/Detector/NodeJsPackageDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\OpenCartCoreDetector' => $baseDir . '/src/Core/VersionDetection/Detector/OpenCartCoreDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\OsCommerceCoreDetector' => $baseDir . '/src/Core/VersionDetection/Detector/OsCommerceCoreDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\PHPBB3CoreDetector' => $baseDir . '/src/Core/VersionDetection/Detector/PHPBB3CoreDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\PackageJsonReader' => $baseDir . '/src/Core/VersionDetection/Detector/PackageJsonReader.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpActivationResolver' => $baseDir . '/src/Core/VersionDetection/Detector/WpActivationResolver.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpComponentDetector' => $baseDir . '/src/Core/VersionDetection/Detector/WpComponentDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpConfigParser' => $baseDir . '/src/Core/VersionDetection/Detector/WpConfigParser.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpContentDirResolver' => $baseDir . '/src/Core/VersionDetection/Detector/WpContentDirResolver.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpCoreDetector' => $baseDir . '/src/Core/VersionDetection/Detector/WpCoreDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpMuPluginDetector' => $baseDir . '/src/Core/VersionDetection/Detector/WpMuPluginDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpOptionsReader' => $baseDir . '/src/Core/VersionDetection/Detector/WpOptionsReader.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpPluginDetector' => $baseDir . '/src/Core/VersionDetection/Detector/WpPluginDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpThemeDetector' => $baseDir . '/src/Core/VersionDetection/Detector/WpThemeDetector.php',
    'AppVersionDetector\\Core\\VersionDetection\\PlainCollectionDetector' => $baseDir . '/src/Core/VersionDetection/PlainCollectionDetector.php',
    'AppVersionDetector\\Event\\EventManager' => $baseDir . '/src/Event/EventManager.php',
    'AppVersionDetector\\Event\\ScanningDirEndedEvent' => $baseDir . '/src/Event/ScanningDirEndedEvent.php',
    'AppVersionDetector\\Event\\ScanningDirStartedEvent' => $baseDir . '/src/Event/ScanningDirStartedEvent.php',
    'AppVersionDetector\\Event\\ScanningEndedEvent' => $baseDir . '/src/Event/ScanningEndedEvent.php',
    'AppVersionDetector\\Event\\ScanningStartedEvent' => $baseDir . '/src/Event/ScanningStartedEvent.php',
    'AppVersionDetector\\Report\\AbstractFileBasedReport' => $baseDir . '/src/Report/AbstractFileBasedReport.php',
    'AppVersionDetector\\Report\\AbstractReport' => $baseDir . '/src/Report/AbstractReport.php',
    'AppVersionDetector\\Report\\Includes\\LastRunOutcomeWriter' => $baseDir . '/src/Report/Includes/LastRunOutcomeWriter.php',
    'AppVersionDetector\\Report\\Includes\\RemoteStatsRequest' => $baseDir . '/src/Report/Includes/RemoteStatsRequest.php',
    'AppVersionDetector\\Report\\JsonReport' => $baseDir . '/src/Report/JsonReport.php',
    'AppVersionDetector\\Report\\RemoteStatsReport' => $baseDir . '/src/Report/RemoteStatsReport.php',
    'AppVersionDetector\\Report\\SqliteDbReport' => $baseDir . '/src/Report/SqliteDbReport.php',
    'AppVersionDetector\\Report\\TextReport' => $baseDir . '/src/Report/TextReport.php',
    'AppVersionDetector\\Scanner' => $baseDir . '/src/Scanner.php',
    'AppVersionDetector\\Storage\\ActualVersionsDb' => $baseDir . '/src/Storage/ActualVersionsDb.php',
    'AppVersionDetector\\Storage\\ActualVersionsSQLiteDb' => $baseDir . '/src/Storage/ActualVersionsSQLiteDb.php',
    'AppVersionDetector\\Storage\\SqliteDbReportConnection' => $baseDir . '/src/Storage/SqliteDbReportConnection.php',
    'AppVersionDetector\\Tests\\Util\\ArchiveTestTrait' => $baseDir . '/tests/Util/ArchiveTestTrait.php',
    'AppVersionDetector\\Tests\\Util\\IntegrationTestTrait' => $baseDir . '/tests/Util/IntegrationTestTrait.php',
    'AppVersionDetector\\Tests\\Util\\PackagingMetadataTrait' => $baseDir . '/tests/Util/PackagingMetadataTrait.php',
    'AppVersionDetector\\Tests\\Util\\SqliteTestTrait' => $baseDir . '/tests/Util/SqliteTestTrait.php',
    'AppVersionDetector\\Tests\\Util\\TempTreeTrait' => $baseDir . '/tests/Util/TempTreeTrait.php',
    'AppVersionDetector\\Tests\\Util\\TestCase' => $baseDir . '/tests/Util/TestCase.php',
    'AppVersionDetector\\Tests\\unit\\Application\\AVDCliParseMigrateOutputPathTest' => $baseDir . '/tests/unit/Application/AVDCliParseMigrateOutputPathTest.php',
    'AppVersionDetector\\Tests\\unit\\Application\\AVDCliParseTest' => $baseDir . '/tests/unit/Application/AVDCliParseTest.php',
    'AppVersionDetector\\Tests\\unit\\Application\\DetectorBuilderNodeJsTest' => $baseDir . '/tests/unit/Application/DetectorBuilderNodeJsTest.php',
    'AppVersionDetector\\Tests\\unit\\Application\\DirectoryTest' => $baseDir . '/tests/unit/Application/DirectoryTest.php',
    'AppVersionDetector\\Tests\\unit\\Application\\Error\\ErrorHandlerExitCodeTest' => $baseDir . '/tests/unit/Application/Error/ErrorHandlerExitCodeTest.php',
    'AppVersionDetector\\Tests\\unit\\Application\\Error\\ErrorHandlerTest' => $baseDir . '/tests/unit/Application/Error/ErrorHandlerTest.php',
    'AppVersionDetector\\Tests\\unit\\Application\\FeatureFlagsTest' => $baseDir . '/tests/unit/Application/FeatureFlagsTest.php',
    'AppVersionDetector\\Tests\\unit\\Application\\HelperTest' => $baseDir . '/tests/unit/Application/HelperTest.php',
    'AppVersionDetector\\Tests\\unit\\Application\\ProfilerTest' => $baseDir . '/tests/unit/Application/ProfilerTest.php',
    'AppVersionDetector\\Tests\\unit\\Application\\StatsTest' => $baseDir . '/tests/unit/Application/StatsTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\OutdatedDetection\\GenericComparisonStrategyTest' => $baseDir . '/tests/unit/Core/OutdatedDetection/GenericComparisonStrategyTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\OutdatedDetection\\WpThemeOutdatedDetectionTest' => $baseDir . '/tests/unit/Core/OutdatedDetection/WpThemeOutdatedDetectionTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\AbstractWpComponentDetector' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/AbstractWpComponentDetector.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\DrupalPluginGetFileDataTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/DrupalPluginGetFileDataTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\DrupalPluginOutdatedDetectionTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/DrupalPluginOutdatedDetectionTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\MysqliWpOptionsReaderTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/MysqliWpOptionsReaderTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\NodeJsAppDetectorTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/NodeJsAppDetectorTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\NodeJsPackageDetectorTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/NodeJsPackageDetectorTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\StubWpOptionsReader' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/StubWpOptionsReader.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpActivationResolverTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/WpActivationResolverTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpComponentDetectorTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/WpComponentDetectorTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpComponentStatusWiringTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/WpComponentStatusWiringTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpConfigParserTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/WpConfigParserTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpContentDirDetectionTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/WpContentDirDetectionTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpMuPluginsDetectorTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/WpMuPluginsDetectorTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpPluginOutdatedDetectionTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/WpPluginOutdatedDetectionTest.php',
    'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpPluginsDetectorDirLimitTest' => $baseDir . '/tests/unit/Core/VersionDetection/Detector/WpPluginsDetectorDirLimitTest.php',
    'AppVersionDetector\\Tests\\unit\\Packaging\\PackagingMetadataTest' => $baseDir . '/tests/unit/Packaging/PackagingMetadataTest.php',
    'AppVersionDetector\\Tests\\unit\\Packaging\\WrapperRuntimeModuleProbeTest' => $baseDir . '/tests/unit/Packaging/WrapperRuntimeModuleProbeTest.php',
    'AppVersionDetector\\Tests\\unit\\Report\\JsonReportInvalidUtf8Test' => $baseDir . '/tests/unit/Report/JsonReportInvalidUtf8Test.php',
    'AppVersionDetector\\Tests\\unit\\Report\\JsonReportTest' => $baseDir . '/tests/unit/Report/JsonReportTest.php',
    'AppVersionDetector\\Tests\\unit\\Report\\MagentoReportTest' => $baseDir . '/tests/unit/Report/MagentoReportTest.php',
    'AppVersionDetector\\Tests\\unit\\Report\\TextReportTest' => $baseDir . '/tests/unit/Report/TextReportTest.php',
    'AppVersionDetector\\Tests\\unit\\ScannerNodeModulesPruneTest' => $baseDir . '/tests/unit/ScannerNodeModulesPruneTest.php',
    'AppVersionDetector\\Tests\\unit\\ScannerRealpathRecheckTest' => $baseDir . '/tests/unit/ScannerRealpathRecheckTest.php',
    'AppVersionDetector\\Tests\\unit\\Storage\\ActualVersionsDbTest' => $baseDir . '/tests/unit/Storage/ActualVersionsDbTest.php',
    'AppVersionDetector\\Tests\\unit\\Storage\\ActualVersionsDbUpdateTest' => $baseDir . '/tests/unit/Storage/ActualVersionsDbUpdateTest.php',
    'AppVersionDetector\\Tests\\unit\\Storage\\ActualVersionsSQLiteDbTest' => $baseDir . '/tests/unit/Storage/ActualVersionsSQLiteDbTest.php',
    'Composer\\InstalledVersions' => $vendorDir . '/composer/InstalledVersions.php',
    'Composer\\Semver\\Comparator' => $vendorDir . '/composer/semver/src/Comparator.php',
    'Composer\\Semver\\Constraint\\AbstractConstraint' => $vendorDir . '/composer/semver/src/Constraint/AbstractConstraint.php',
    'Composer\\Semver\\Constraint\\Constraint' => $vendorDir . '/composer/semver/src/Constraint/Constraint.php',
    'Composer\\Semver\\Constraint\\ConstraintInterface' => $vendorDir . '/composer/semver/src/Constraint/ConstraintInterface.php',
    'Composer\\Semver\\Constraint\\EmptyConstraint' => $vendorDir . '/composer/semver/src/Constraint/EmptyConstraint.php',
    'Composer\\Semver\\Constraint\\MultiConstraint' => $vendorDir . '/composer/semver/src/Constraint/MultiConstraint.php',
    'Composer\\Semver\\Semver' => $vendorDir . '/composer/semver/src/Semver.php',
    'Composer\\Semver\\VersionParser' => $vendorDir . '/composer/semver/src/VersionParser.php',
);
<?php

// platform_check.php @generated by Composer

$issues = array();

if (!(PHP_VERSION_ID >= 70300)) {
    $issues[] = 'Your Composer dependencies require a PHP version ">= 7.3.0". You are running ' . PHP_VERSION . '.';
}

if ($issues) {
    if (!headers_sent()) {
        header('HTTP/1.1 500 Internal Server Error');
    }
    if (!ini_get('display_errors')) {
        if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
            fwrite(STDERR, 'Composer detected issues in your platform:' . PHP_EOL.PHP_EOL . implode(PHP_EOL, $issues) . PHP_EOL.PHP_EOL);
        } elseif (!headers_sent()) {
            echo 'Composer detected issues in your platform:' . PHP_EOL.PHP_EOL . str_replace('You are running '.PHP_VERSION.'.', '', implode(PHP_EOL, $issues)) . PHP_EOL.PHP_EOL;
        }
    }
    throw new \RuntimeException(
        'Composer detected issues in your platform: ' . implode(' ', $issues)
    );
}
<?php

// autoload_real.php @generated by Composer

class ComposerAutoloaderInit431d7b3dd0d6aa4f493c20cfbb8de03f
{
    private static $loader;

    public static function loadClassLoader($class)
    {
        if ('Composer\Autoload\ClassLoader' === $class) {
            require __DIR__ . '/ClassLoader.php';
        }
    }

    /**
     * @return \Composer\Autoload\ClassLoader
     */
    public static function getLoader()
    {
        if (null !== self::$loader) {
            return self::$loader;
        }

        require __DIR__ . '/platform_check.php';

        spl_autoload_register(array('ComposerAutoloaderInit431d7b3dd0d6aa4f493c20cfbb8de03f', 'loadClassLoader'), true, true);
        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
        spl_autoload_unregister(array('ComposerAutoloaderInit431d7b3dd0d6aa4f493c20cfbb8de03f', 'loadClassLoader'));

        require __DIR__ . '/autoload_static.php';
        call_user_func(\Composer\Autoload\ComposerStaticInit431d7b3dd0d6aa4f493c20cfbb8de03f::getInitializer($loader));

        $loader->setClassMapAuthoritative(true);
        $loader->register(true);

        return $loader;
    }
}
<?php

// autoload_static.php @generated by Composer

namespace Composer\Autoload;

class ComposerStaticInit431d7b3dd0d6aa4f493c20cfbb8de03f
{
    public static $prefixLengthsPsr4 = array (
        'C' =>
        array (
            'Composer\\Semver\\' => 16,
        ),
        'A' =>
        array (
            'AppVersionDetector\\Tests\\' => 25,
            'AppVersionDetector\\' => 19,
        ),
    );

    public static $prefixDirsPsr4 = array (
        'Composer\\Semver\\' =>
        array (
            0 => __DIR__ . '/..' . '/composer/semver/src',
        ),
        'AppVersionDetector\\Tests\\' =>
        array (
            0 => __DIR__ . '/../..' . '/tests',
        ),
        'AppVersionDetector\\' =>
        array (
            0 => __DIR__ . '/../..' . '/src',
        ),
    );

    public static $classMap = array (
        'AppVersionDetector\\Application\\AVDCliParse' => __DIR__ . '/../..' . '/src/Application/AVDCliParse.php',
        'AppVersionDetector\\Application\\AVDConfig' => __DIR__ . '/../..' . '/src/Application/AVDConfig.php',
        'AppVersionDetector\\Application\\AppException' => __DIR__ . '/../..' . '/src/Application/AppException.php',
        'AppVersionDetector\\Application\\CliParse' => __DIR__ . '/../..' . '/src/Application/CliParse.php',
        'AppVersionDetector\\Application\\Config' => __DIR__ . '/../..' . '/src/Application/Config.php',
        'AppVersionDetector\\Application\\ConfigParamException' => __DIR__ . '/../..' . '/src/Application/ConfigParamException.php',
        'AppVersionDetector\\Application\\DetectorBuilder' => __DIR__ . '/../..' . '/src/Application/DetectorBuilder.php',
        'AppVersionDetector\\Application\\Directory' => __DIR__ . '/../..' . '/src/Application/Directory.php',
        'AppVersionDetector\\Application\\Error\\ErrorHandler' => __DIR__ . '/../..' . '/src/Application/Error/ErrorHandler.php',
        'AppVersionDetector\\Application\\Factory' => __DIR__ . '/../..' . '/src/Application/Factory.php',
        'AppVersionDetector\\Application\\FeatureFlags' => __DIR__ . '/../..' . '/src/Application/FeatureFlags.php',
        'AppVersionDetector\\Application\\FileOwners' => __DIR__ . '/../..' . '/src/Application/FileOwners.php',
        'AppVersionDetector\\Application\\Helper' => __DIR__ . '/../..' . '/src/Application/Helper.php',
        'AppVersionDetector\\Application\\Migraitor' => __DIR__ . '/../..' . '/src/Application/Migraitor.php',
        'AppVersionDetector\\Application\\Profiler' => __DIR__ . '/../..' . '/src/Application/Profiler.php',
        'AppVersionDetector\\Application\\Stats' => __DIR__ . '/../..' . '/src/Application/Stats.php',
        'AppVersionDetector\\Core\\AbstractEvent' => __DIR__ . '/../..' . '/src/Core/AbstractEvent.php',
        'AppVersionDetector\\Core\\ListenerInterface' => __DIR__ . '/../..' . '/src/Core/ListenerInterface.php',
        'AppVersionDetector\\Core\\MediatorInterface' => __DIR__ . '/../..' . '/src/Core/MediatorInterface.php',
        'AppVersionDetector\\Core\\OutdatedDetection\\ComparisonStrategyInterface' => __DIR__ . '/../..' . '/src/Core/OutdatedDetection/ComparisonStrategyInterface.php',
        'AppVersionDetector\\Core\\OutdatedDetection\\GenericComparisonStrategy' => __DIR__ . '/../..' . '/src/Core/OutdatedDetection/GenericComparisonStrategy.php',
        'AppVersionDetector\\Core\\OutdatedDetection\\OutdatedChecker' => __DIR__ . '/../..' . '/src/Core/OutdatedDetection/OutdatedChecker.php',
        'AppVersionDetector\\Core\\OutdatedDetection\\OutdatedEvent' => __DIR__ . '/../..' . '/src/Core/OutdatedDetection/OutdatedEvent.php',
        'AppVersionDetector\\Core\\OutdatedDetection\\VersionDbInterface' => __DIR__ . '/../..' . '/src/Core/OutdatedDetection/VersionDbInterface.php',
        'AppVersionDetector\\Core\\PublisherInterface' => __DIR__ . '/../..' . '/src/Core/PublisherInterface.php',
        'AppVersionDetector\\Core\\VersionDetection\\AbstractCompositeDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/AbstractCompositeDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\AbstractDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/AbstractDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\DependencyCollectionDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/DependencyCollectionDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\DetectionEvent' => __DIR__ . '/../..' . '/src/Core/VersionDetection/DetectionEvent.php',
        'AppVersionDetector\\Core\\VersionDetection\\DetectorInterface' => __DIR__ . '/../..' . '/src/Core/VersionDetection/DetectorInterface.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\BitrixCoreDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/BitrixCoreDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\CommonScriptDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/CommonScriptDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\DrupalCoreDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/DrupalCoreDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\DrupalPluginDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/DrupalPluginDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\DummyDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/DummyDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\ForkingWpOptionsReader' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/ForkingWpOptionsReader.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\IPBCoreDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/IPBCoreDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\JoomlaCoreDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/JoomlaCoreDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\JoomlaPluginDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/JoomlaPluginDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\MagentoCoreDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/MagentoCoreDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\ModxCoreDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/ModxCoreDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\MysqliWpOptionsReader' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/MysqliWpOptionsReader.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\NodeJsAppDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/NodeJsAppDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\NodeJsPackageDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/NodeJsPackageDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\OpenCartCoreDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/OpenCartCoreDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\OsCommerceCoreDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/OsCommerceCoreDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\PHPBB3CoreDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/PHPBB3CoreDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\PackageJsonReader' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/PackageJsonReader.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpActivationResolver' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/WpActivationResolver.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpComponentDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/WpComponentDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpConfigParser' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/WpConfigParser.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpContentDirResolver' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/WpContentDirResolver.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpCoreDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/WpCoreDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpMuPluginDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/WpMuPluginDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpOptionsReader' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/WpOptionsReader.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpPluginDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/WpPluginDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\Detector\\WpThemeDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/Detector/WpThemeDetector.php',
        'AppVersionDetector\\Core\\VersionDetection\\PlainCollectionDetector' => __DIR__ . '/../..' . '/src/Core/VersionDetection/PlainCollectionDetector.php',
        'AppVersionDetector\\Event\\EventManager' => __DIR__ . '/../..' . '/src/Event/EventManager.php',
        'AppVersionDetector\\Event\\ScanningDirEndedEvent' => __DIR__ . '/../..' . '/src/Event/ScanningDirEndedEvent.php',
        'AppVersionDetector\\Event\\ScanningDirStartedEvent' => __DIR__ . '/../..' . '/src/Event/ScanningDirStartedEvent.php',
        'AppVersionDetector\\Event\\ScanningEndedEvent' => __DIR__ . '/../..' . '/src/Event/ScanningEndedEvent.php',
        'AppVersionDetector\\Event\\ScanningStartedEvent' => __DIR__ . '/../..' . '/src/Event/ScanningStartedEvent.php',
        'AppVersionDetector\\Report\\AbstractFileBasedReport' => __DIR__ . '/../..' . '/src/Report/AbstractFileBasedReport.php',
        'AppVersionDetector\\Report\\AbstractReport' => __DIR__ . '/../..' . '/src/Report/AbstractReport.php',
        'AppVersionDetector\\Report\\Includes\\LastRunOutcomeWriter' => __DIR__ . '/../..' . '/src/Report/Includes/LastRunOutcomeWriter.php',
        'AppVersionDetector\\Report\\Includes\\RemoteStatsRequest' => __DIR__ . '/../..' . '/src/Report/Includes/RemoteStatsRequest.php',
        'AppVersionDetector\\Report\\JsonReport' => __DIR__ . '/../..' . '/src/Report/JsonReport.php',
        'AppVersionDetector\\Report\\RemoteStatsReport' => __DIR__ . '/../..' . '/src/Report/RemoteStatsReport.php',
        'AppVersionDetector\\Report\\SqliteDbReport' => __DIR__ . '/../..' . '/src/Report/SqliteDbReport.php',
        'AppVersionDetector\\Report\\TextReport' => __DIR__ . '/../..' . '/src/Report/TextReport.php',
        'AppVersionDetector\\Scanner' => __DIR__ . '/../..' . '/src/Scanner.php',
        'AppVersionDetector\\Storage\\ActualVersionsDb' => __DIR__ . '/../..' . '/src/Storage/ActualVersionsDb.php',
        'AppVersionDetector\\Storage\\ActualVersionsSQLiteDb' => __DIR__ . '/../..' . '/src/Storage/ActualVersionsSQLiteDb.php',
        'AppVersionDetector\\Storage\\SqliteDbReportConnection' => __DIR__ . '/../..' . '/src/Storage/SqliteDbReportConnection.php',
        'AppVersionDetector\\Tests\\Util\\ArchiveTestTrait' => __DIR__ . '/../..' . '/tests/Util/ArchiveTestTrait.php',
        'AppVersionDetector\\Tests\\Util\\IntegrationTestTrait' => __DIR__ . '/../..' . '/tests/Util/IntegrationTestTrait.php',
        'AppVersionDetector\\Tests\\Util\\PackagingMetadataTrait' => __DIR__ . '/../..' . '/tests/Util/PackagingMetadataTrait.php',
        'AppVersionDetector\\Tests\\Util\\SqliteTestTrait' => __DIR__ . '/../..' . '/tests/Util/SqliteTestTrait.php',
        'AppVersionDetector\\Tests\\Util\\TempTreeTrait' => __DIR__ . '/../..' . '/tests/Util/TempTreeTrait.php',
        'AppVersionDetector\\Tests\\Util\\TestCase' => __DIR__ . '/../..' . '/tests/Util/TestCase.php',
        'AppVersionDetector\\Tests\\unit\\Application\\AVDCliParseMigrateOutputPathTest' => __DIR__ . '/../..' . '/tests/unit/Application/AVDCliParseMigrateOutputPathTest.php',
        'AppVersionDetector\\Tests\\unit\\Application\\AVDCliParseTest' => __DIR__ . '/../..' . '/tests/unit/Application/AVDCliParseTest.php',
        'AppVersionDetector\\Tests\\unit\\Application\\DetectorBuilderNodeJsTest' => __DIR__ . '/../..' . '/tests/unit/Application/DetectorBuilderNodeJsTest.php',
        'AppVersionDetector\\Tests\\unit\\Application\\DirectoryTest' => __DIR__ . '/../..' . '/tests/unit/Application/DirectoryTest.php',
        'AppVersionDetector\\Tests\\unit\\Application\\Error\\ErrorHandlerExitCodeTest' => __DIR__ . '/../..' . '/tests/unit/Application/Error/ErrorHandlerExitCodeTest.php',
        'AppVersionDetector\\Tests\\unit\\Application\\Error\\ErrorHandlerTest' => __DIR__ . '/../..' . '/tests/unit/Application/Error/ErrorHandlerTest.php',
        'AppVersionDetector\\Tests\\unit\\Application\\FeatureFlagsTest' => __DIR__ . '/../..' . '/tests/unit/Application/FeatureFlagsTest.php',
        'AppVersionDetector\\Tests\\unit\\Application\\HelperTest' => __DIR__ . '/../..' . '/tests/unit/Application/HelperTest.php',
        'AppVersionDetector\\Tests\\unit\\Application\\ProfilerTest' => __DIR__ . '/../..' . '/tests/unit/Application/ProfilerTest.php',
        'AppVersionDetector\\Tests\\unit\\Application\\StatsTest' => __DIR__ . '/../..' . '/tests/unit/Application/StatsTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\OutdatedDetection\\GenericComparisonStrategyTest' => __DIR__ . '/../..' . '/tests/unit/Core/OutdatedDetection/GenericComparisonStrategyTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\OutdatedDetection\\WpThemeOutdatedDetectionTest' => __DIR__ . '/../..' . '/tests/unit/Core/OutdatedDetection/WpThemeOutdatedDetectionTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\AbstractWpComponentDetector' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/AbstractWpComponentDetector.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\DrupalPluginGetFileDataTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/DrupalPluginGetFileDataTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\DrupalPluginOutdatedDetectionTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/DrupalPluginOutdatedDetectionTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\MysqliWpOptionsReaderTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/MysqliWpOptionsReaderTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\NodeJsAppDetectorTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/NodeJsAppDetectorTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\NodeJsPackageDetectorTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/NodeJsPackageDetectorTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\StubWpOptionsReader' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/StubWpOptionsReader.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpActivationResolverTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/WpActivationResolverTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpComponentDetectorTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/WpComponentDetectorTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpComponentStatusWiringTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/WpComponentStatusWiringTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpConfigParserTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/WpConfigParserTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpContentDirDetectionTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/WpContentDirDetectionTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpMuPluginsDetectorTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/WpMuPluginsDetectorTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpPluginOutdatedDetectionTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/WpPluginOutdatedDetectionTest.php',
        'AppVersionDetector\\Tests\\unit\\Core\\VersionDetection\\Detector\\WpPluginsDetectorDirLimitTest' => __DIR__ . '/../..' . '/tests/unit/Core/VersionDetection/Detector/WpPluginsDetectorDirLimitTest.php',
        'AppVersionDetector\\Tests\\unit\\Packaging\\PackagingMetadataTest' => __DIR__ . '/../..' . '/tests/unit/Packaging/PackagingMetadataTest.php',
        'AppVersionDetector\\Tests\\unit\\Packaging\\WrapperRuntimeModuleProbeTest' => __DIR__ . '/../..' . '/tests/unit/Packaging/WrapperRuntimeModuleProbeTest.php',
        'AppVersionDetector\\Tests\\unit\\Report\\JsonReportInvalidUtf8Test' => __DIR__ . '/../..' . '/tests/unit/Report/JsonReportInvalidUtf8Test.php',
        'AppVersionDetector\\Tests\\unit\\Report\\JsonReportTest' => __DIR__ . '/../..' . '/tests/unit/Report/JsonReportTest.php',
        'AppVersionDetector\\Tests\\unit\\Report\\MagentoReportTest' => __DIR__ . '/../..' . '/tests/unit/Report/MagentoReportTest.php',
        'AppVersionDetector\\Tests\\unit\\Report\\TextReportTest' => __DIR__ . '/../..' . '/tests/unit/Report/TextReportTest.php',
        'AppVersionDetector\\Tests\\unit\\ScannerNodeModulesPruneTest' => __DIR__ . '/../..' . '/tests/unit/ScannerNodeModulesPruneTest.php',
        'AppVersionDetector\\Tests\\unit\\ScannerRealpathRecheckTest' => __DIR__ . '/../..' . '/tests/unit/ScannerRealpathRecheckTest.php',
        'AppVersionDetector\\Tests\\unit\\Storage\\ActualVersionsDbTest' => __DIR__ . '/../..' . '/tests/unit/Storage/ActualVersionsDbTest.php',
        'AppVersionDetector\\Tests\\unit\\Storage\\ActualVersionsDbUpdateTest' => __DIR__ . '/../..' . '/tests/unit/Storage/ActualVersionsDbUpdateTest.php',
        'AppVersionDetector\\Tests\\unit\\Storage\\ActualVersionsSQLiteDbTest' => __DIR__ . '/../..' . '/tests/unit/Storage/ActualVersionsSQLiteDbTest.php',
        'Composer\\InstalledVersions' => __DIR__ . '/..' . '/composer/InstalledVersions.php',
        'Composer\\Semver\\Comparator' => __DIR__ . '/..' . '/composer/semver/src/Comparator.php',
        'Composer\\Semver\\Constraint\\AbstractConstraint' => __DIR__ . '/..' . '/composer/semver/src/Constraint/AbstractConstraint.php',
        'Composer\\Semver\\Constraint\\Constraint' => __DIR__ . '/..' . '/composer/semver/src/Constraint/Constraint.php',
        'Composer\\Semver\\Constraint\\ConstraintInterface' => __DIR__ . '/..' . '/composer/semver/src/Constraint/ConstraintInterface.php',
        'Composer\\Semver\\Constraint\\EmptyConstraint' => __DIR__ . '/..' . '/composer/semver/src/Constraint/EmptyConstraint.php',
        'Composer\\Semver\\Constraint\\MultiConstraint' => __DIR__ . '/..' . '/composer/semver/src/Constraint/MultiConstraint.php',
        'Composer\\Semver\\Semver' => __DIR__ . '/..' . '/composer/semver/src/Semver.php',
        'Composer\\Semver\\VersionParser' => __DIR__ . '/..' . '/composer/semver/src/VersionParser.php',
    );

    public static function getInitializer(ClassLoader $loader)
    {
        return \Closure::bind(function () use ($loader) {
            $loader->prefixLengthsPsr4 = ComposerStaticInit431d7b3dd0d6aa4f493c20cfbb8de03f::$prefixLengthsPsr4;
            $loader->prefixDirsPsr4 = ComposerStaticInit431d7b3dd0d6aa4f493c20cfbb8de03f::$prefixDirsPsr4;
            $loader->classMap = ComposerStaticInit431d7b3dd0d6aa4f493c20cfbb8de03f::$classMap;

        }, null, ClassLoader::class);
    }
}
<?php return array(
    'root' => array(
        'name' => 'cloudlinux/app-version-detector',
        'pretty_version' => '1.0.0+no-version-set',
        'version' => '1.0.0.0',
        'reference' => null,
        'type' => 'project',
        'install_path' => __DIR__ . '/../../',
        'aliases' => array(),
        'dev' => false,
    ),
    'versions' => array(
        'cloudlinux/app-version-detector' => array(
            'pretty_version' => '1.0.0+no-version-set',
            'version' => '1.0.0.0',
            'reference' => null,
            'type' => 'project',
            'install_path' => __DIR__ . '/../../',
            'aliases' => array(),
            'dev_requirement' => false,
        ),
        'composer/semver' => array(
            'pretty_version' => '1.7.2',
            'version' => '1.7.2.0',
            'reference' => '647490bbcaf7fc4891c58f47b825eb99d19c377a',
            'type' => 'library',
            'install_path' => __DIR__ . '/./semver',
            'aliases' => array(),
            'dev_requirement' => false,
        ),
    ),
);
<?php

/*
 * This file is part of Composer.
 *
 * (c) Nils Adermann <naderman@naderman.de>
 *     Jordi Boggiano <j.boggiano@seld.be>
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace Composer\Autoload;

/**
 * ClassLoader implements a PSR-0, PSR-4 and classmap class loader.
 *
 *     $loader = new \Composer\Autoload\ClassLoader();
 *
 *     // register classes with namespaces
 *     $loader->add('Symfony\Component', __DIR__.'/component');
 *     $loader->add('Symfony',           __DIR__.'/framework');
 *
 *     // activate the autoloader
 *     $loader->register();
 *
 *     // to enable searching the include path (eg. for PEAR packages)
 *     $loader->setUseIncludePath(true);
 *
 * In this example, if you try to use a class in the Symfony\Component
 * namespace or one of its children (Symfony\Component\Console for instance),
 * the autoloader will first look for the class under the component/
 * directory, and it will then fallback to the framework/ directory if not
 * found before giving up.
 *
 * This class is loosely based on the Symfony UniversalClassLoader.
 *
 * @author Fabien Potencier <fabien@symfony.com>
 * @author Jordi Boggiano <j.boggiano@seld.be>
 * @see    https://www.php-fig.org/psr/psr-0/
 * @see    https://www.php-fig.org/psr/psr-4/
 */
class ClassLoader
{
    /** @var \Closure(string):void */
    private static $includeFile;

    /** @var string|null */
    private $vendorDir;

    // PSR-4
    /**
     * @var array<string, array<string, int>>
     */
    private $prefixLengthsPsr4 = array();
    /**
     * @var array<string, list<string>>
     */
    private $prefixDirsPsr4 = array();
    /**
     * @var list<string>
     */
    private $fallbackDirsPsr4 = array();

    // PSR-0
    /**
     * List of PSR-0 prefixes
     *
     * Structured as array('F (first letter)' => array('Foo\Bar (full prefix)' => array('path', 'path2')))
     *
     * @var array<string, array<string, list<string>>>
     */
    private $prefixesPsr0 = array();
    /**
     * @var list<string>
     */
    private $fallbackDirsPsr0 = array();

    /** @var bool */
    private $useIncludePath = false;

    /**
     * @var array<string, string>
     */
    private $classMap = array();

    /** @var bool */
    private $classMapAuthoritative = false;

    /**
     * @var array<string, bool>
     */
    private $missingClasses = array();

    /** @var string|null */
    private $apcuPrefix;

    /**
     * @var array<string, self>
     */
    private static $registeredLoaders = array();

    /**
     * @param string|null $vendorDir
     */
    public function __construct($vendorDir = null)
    {
        $this->vendorDir = $vendorDir;
        self::initializeIncludeClosure();
    }

    /**
     * @return array<string, list<string>>
     */
    public function getPrefixes()
    {
        if (!empty($this->prefixesPsr0)) {
            return call_user_func_array('array_merge', array_values($this->prefixesPsr0));
        }

        return array();
    }

    /**
     * @return array<string, list<string>>
     */
    public function getPrefixesPsr4()
    {
        return $this->prefixDirsPsr4;
    }

    /**
     * @return list<string>
     */
    public function getFallbackDirs()
    {
        return $this->fallbackDirsPsr0;
    }

    /**
     * @return list<string>
     */
    public function getFallbackDirsPsr4()
    {
        return $this->fallbackDirsPsr4;
    }

    /**
     * @return array<string, string> Array of classname => path
     */
    public function getClassMap()
    {
        return $this->classMap;
    }

    /**
     * @param array<string, string> $classMap Class to filename map
     *
     * @return void
     */
    public function addClassMap(array $classMap)
    {
        if ($this->classMap) {
            $this->classMap = array_merge($this->classMap, $classMap);
        } else {
            $this->classMap = $classMap;
        }
    }

    /**
     * Registers a set of PSR-0 directories for a given prefix, either
     * appending or prepending to the ones previously set for this prefix.
     *
     * @param string              $prefix  The prefix
     * @param list<string>|string $paths   The PSR-0 root directories
     * @param bool                $prepend Whether to prepend the directories
     *
     * @return void
     */
    public function add($prefix, $paths, $prepend = false)
    {
        $paths = (array) $paths;
        if (!$prefix) {
            if ($prepend) {
                $this->fallbackDirsPsr0 = array_merge(
                    $paths,
                    $this->fallbackDirsPsr0
                );
            } else {
                $this->fallbackDirsPsr0 = array_merge(
                    $this->fallbackDirsPsr0,
                    $paths
                );
            }

            return;
        }

        $first = $prefix[0];
        if (!isset($this->prefixesPsr0[$first][$prefix])) {
            $this->prefixesPsr0[$first][$prefix] = $paths;

            return;
        }
        if ($prepend) {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
                $paths,
                $this->prefixesPsr0[$first][$prefix]
            );
        } else {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
                $this->prefixesPsr0[$first][$prefix],
                $paths
            );
        }
    }

    /**
     * Registers a set of PSR-4 directories for a given namespace, either
     * appending or prepending to the ones previously set for this namespace.
     *
     * @param string              $prefix  The prefix/namespace, with trailing '\\'
     * @param list<string>|string $paths   The PSR-4 base directories
     * @param bool                $prepend Whether to prepend the directories
     *
     * @throws \InvalidArgumentException
     *
     * @return void
     */
    public function addPsr4($prefix, $paths, $prepend = false)
    {
        $paths = (array) $paths;
        if (!$prefix) {
            // Register directories for the root namespace.
            if ($prepend) {
                $this->fallbackDirsPsr4 = array_merge(
                    $paths,
                    $this->fallbackDirsPsr4
                );
            } else {
                $this->fallbackDirsPsr4 = array_merge(
                    $this->fallbackDirsPsr4,
                    $paths
                );
            }
        } elseif (!isset($this->prefixDirsPsr4[$prefix])) {
            // Register directories for a new namespace.
            $length = strlen($prefix);
            if ('\\' !== $prefix[$length - 1]) {
                throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
            }
            $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
            $this->prefixDirsPsr4[$prefix] = $paths;
        } elseif ($prepend) {
            // Prepend directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
                $paths,
                $this->prefixDirsPsr4[$prefix]
            );
        } else {
            // Append directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
                $this->prefixDirsPsr4[$prefix],
                $paths
            );
        }
    }

    /**
     * Registers a set of PSR-0 directories for a given prefix,
     * replacing any others previously set for this prefix.
     *
     * @param string              $prefix The prefix
     * @param list<string>|string $paths  The PSR-0 base directories
     *
     * @return void
     */
    public function set($prefix, $paths)
    {
        if (!$prefix) {
            $this->fallbackDirsPsr0 = (array) $paths;
        } else {
            $this->prefixesPsr0[$prefix[0]][$prefix] = (array) $paths;
        }
    }

    /**
     * Registers a set of PSR-4 directories for a given namespace,
     * replacing any others previously set for this namespace.
     *
     * @param string              $prefix The prefix/namespace, with trailing '\\'
     * @param list<string>|string $paths  The PSR-4 base directories
     *
     * @throws \InvalidArgumentException
     *
     * @return void
     */
    public function setPsr4($prefix, $paths)
    {
        if (!$prefix) {
            $this->fallbackDirsPsr4 = (array) $paths;
        } else {
            $length = strlen($prefix);
            if ('\\' !== $prefix[$length - 1]) {
                throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
            }
            $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
            $this->prefixDirsPsr4[$prefix] = (array) $paths;
        }
    }

    /**
     * Turns on searching the include path for class files.
     *
     * @param bool $useIncludePath
     *
     * @return void
     */
    public function setUseIncludePath($useIncludePath)
    {
        $this->useIncludePath = $useIncludePath;
    }

    /**
     * Can be used to check if the autoloader uses the include path to check
     * for classes.
     *
     * @return bool
     */
    public function getUseIncludePath()
    {
        return $this->useIncludePath;
    }

    /**
     * Turns off searching the prefix and fallback directories for classes
     * that have not been registered with the class map.
     *
     * @param bool $classMapAuthoritative
     *
     * @return void
     */
    public function setClassMapAuthoritative($classMapAuthoritative)
    {
        $this->classMapAuthoritative = $classMapAuthoritative;
    }

    /**
     * Should class lookup fail if not found in the current class map?
     *
     * @return bool
     */
    public function isClassMapAuthoritative()
    {
        return $this->classMapAuthoritative;
    }

    /**
     * APCu prefix to use to cache found/not-found classes, if the extension is enabled.
     *
     * @param string|null $apcuPrefix
     *
     * @return void
     */
    public function setApcuPrefix($apcuPrefix)
    {
        $this->apcuPrefix = function_exists('apcu_fetch') && filter_var(ini_get('apc.enabled'), FILTER_VALIDATE_BOOLEAN) ? $apcuPrefix : null;
    }

    /**
     * The APCu prefix in use, or null if APCu caching is not enabled.
     *
     * @return string|null
     */
    public function getApcuPrefix()
    {
        return $this->apcuPrefix;
    }

    /**
     * Registers this instance as an autoloader.
     *
     * @param bool $prepend Whether to prepend the autoloader or not
     *
     * @return void
     */
    public function register($prepend = false)
    {
        spl_autoload_register(array($this, 'loadClass'), true, $prepend);

        if (null === $this->vendorDir) {
            return;
        }

        if ($prepend) {
            self::$registeredLoaders = array($this->vendorDir => $this) + self::$registeredLoaders;
        } else {
            unset(self::$registeredLoaders[$this->vendorDir]);
            self::$registeredLoaders[$this->vendorDir] = $this;
        }
    }

    /**
     * Unregisters this instance as an autoloader.
     *
     * @return void
     */
    public function unregister()
    {
        spl_autoload_unregister(array($this, 'loadClass'));

        if (null !== $this->vendorDir) {
            unset(self::$registeredLoaders[$this->vendorDir]);
        }
    }

    /**
     * Loads the given class or interface.
     *
     * @param  string    $class The name of the class
     * @return true|null True if loaded, null otherwise
     */
    public function loadClass($class)
    {
        if ($file = $this->findFile($class)) {
            $includeFile = self::$includeFile;
            $includeFile($file);

            return true;
        }

        return null;
    }

    /**
     * Finds the path to the file where the class is defined.
     *
     * @param string $class The name of the class
     *
     * @return string|false The path if found, false otherwise
     */
    public function findFile($class)
    {
        // class map lookup
        if (isset($this->classMap[$class])) {
            return $this->classMap[$class];
        }
        if ($this->classMapAuthoritative || isset($this->missingClasses[$class])) {
            return false;
        }
        if (null !== $this->apcuPrefix) {
            $file = apcu_fetch($this->apcuPrefix.$class, $hit);
            if ($hit) {
                return $file;
            }
        }

        $file = $this->findFileWithExtension($class, '.php');

        // Search for Hack files if we are running on HHVM
        if (false === $file && defined('HHVM_VERSION')) {
            $file = $this->findFileWithExtension($class, '.hh');
        }

        if (null !== $this->apcuPrefix) {
            apcu_add($this->apcuPrefix.$class, $file);
        }

        if (false === $file) {
            // Remember that this class does not exist.
            $this->missingClasses[$class] = true;
        }

        return $file;
    }

    /**
     * Returns the currently registered loaders keyed by their corresponding vendor directories.
     *
     * @return array<string, self>
     */
    public static function getRegisteredLoaders()
    {
        return self::$registeredLoaders;
    }

    /**
     * @param  string       $class
     * @param  string       $ext
     * @return string|false
     */
    private function findFileWithExtension($class, $ext)
    {
        // PSR-4 lookup
        $logicalPathPsr4 = strtr($class, '\\', DIRECTORY_SEPARATOR) . $ext;

        $first = $class[0];
        if (isset($this->prefixLengthsPsr4[$first])) {
            $subPath = $class;
            while (false !== $lastPos = strrpos($subPath, '\\')) {
                $subPath = substr($subPath, 0, $lastPos);
                $search = $subPath . '\\';
                if (isset($this->prefixDirsPsr4[$search])) {
                    $pathEnd = DIRECTORY_SEPARATOR . substr($logicalPathPsr4, $lastPos + 1);
                    foreach ($this->prefixDirsPsr4[$search] as $dir) {
                        if (file_exists($file = $dir . $pathEnd)) {
                            return $file;
                        }
                    }
                }
            }
        }

        // PSR-4 fallback dirs
        foreach ($this->fallbackDirsPsr4 as $dir) {
            if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr4)) {
                return $file;
            }
        }

        // PSR-0 lookup
        if (false !== $pos = strrpos($class, '\\')) {
            // namespaced class name
            $logicalPathPsr0 = substr($logicalPathPsr4, 0, $pos + 1)
                . strtr(substr($logicalPathPsr4, $pos + 1), '_', DIRECTORY_SEPARATOR);
        } else {
            // PEAR-like class name
            $logicalPathPsr0 = strtr($class, '_', DIRECTORY_SEPARATOR) . $ext;
        }

        if (isset($this->prefixesPsr0[$first])) {
            foreach ($this->prefixesPsr0[$first] as $prefix => $dirs) {
                if (0 === strpos($class, $prefix)) {
                    foreach ($dirs as $dir) {
                        if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr0)) {
                            return $file;
                        }
                    }
                }
            }
        }

        // PSR-0 fallback dirs
        foreach ($this->fallbackDirsPsr0 as $dir) {
            if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr0)) {
                return $file;
            }
        }

        // PSR-0 include paths.
        if ($this->useIncludePath && $file = stream_resolve_include_path($logicalPathPsr0)) {
            return $file;
        }

        return false;
    }

    /**
     * @return void
     */
    private static function initializeIncludeClosure()
    {
        if (self::$includeFile !== null) {
            return;
        }

        /**
         * Scope isolated include.
         *
         * Prevents access to $this/self from included files.
         *
         * @param  string $file
         * @return void
         */
        self::$includeFile = \Closure::bind(static function($file) {
            include $file;
        }, null, null);
    }
}
<?php

// autoload_namespaces.php @generated by Composer

$vendorDir = dirname(__DIR__);
$baseDir = dirname($vendorDir);

return array(
);
{
    "packages": [
        {
            "name": "composer/semver",
            "version": "1.7.2",
            "version_normalized": "1.7.2.0",
            "source": {
                "type": "git",
                "url": "https://github.com/composer/semver.git",
                "reference": "647490bbcaf7fc4891c58f47b825eb99d19c377a"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/composer/semver/zipball/647490bbcaf7fc4891c58f47b825eb99d19c377a",
                "reference": "647490bbcaf7fc4891c58f47b825eb99d19c377a",
                "shasum": ""
            },
            "require": {
                "php": "^5.3.2 || ^7.0 || ^8.0"
            },
            "require-dev": {
                "phpunit/phpunit": "^4.5 || ^5.0.5"
            },
            "time": "2020-12-03T15:47:16+00:00",
            "type": "library",
            "extra": {
                "branch-alias": {
                    "dev-master": "1.x-dev"
                }
            },
            "installation-source": "dist",
            "autoload": {
                "psr-4": {
                    "Composer\\Semver\\": "src"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "Nils Adermann",
                    "email": "naderman@naderman.de",
                    "homepage": "http://www.naderman.de"
                },
                {
                    "name": "Jordi Boggiano",
                    "email": "j.boggiano@seld.be",
                    "homepage": "http://seld.be"
                },
                {
                    "name": "Rob Bast",
                    "email": "rob.bast@gmail.com",
                    "homepage": "http://robbast.nl"
                }
            ],
            "description": "Semver library that offers utilities, version constraint parsing and validation.",
            "keywords": [
                "semantic",
                "semver",
                "validation",
                "versioning"
            ],
            "support": {
                "irc": "irc://irc.freenode.org/composer",
                "issues": "https://github.com/composer/semver/issues",
                "source": "https://github.com/composer/semver/tree/1.7.2"
            },
            "funding": [
                {
                    "url": "https://packagist.com",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/composer",
                    "type": "github"
                },
                {
                    "url": "https://tidelift.com/funding/github/packagist/composer/composer",
                    "type": "tidelift"
                }
            ],
            "install-path": "./semver"
        }
    ],
    "dev": false,
    "dev-package-names": []
}
<?php

// autoload.php @generated by Composer

if (PHP_VERSION_ID < 50600) {
    if (!headers_sent()) {
        header('HTTP/1.1 500 Internal Server Error');
    }
    $err = 'Composer 2.3.0 dropped support for autoloading on PHP <5.6 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;
    if (!ini_get('display_errors')) {
        if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
            fwrite(STDERR, $err);
        } elseif (!headers_sent()) {
            echo $err;
        }
    }
    throw new RuntimeException($err);
}

require_once __DIR__ . '/composer/autoload_real.php';

return ComposerAutoloaderInit431d7b3dd0d6aa4f493c20cfbb8de03f::getLoader();
<?php

use AppVersionDetector\Application\Config;
use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Profiler;
use AppVersionDetector\Application\DetectorBuilder;
use AppVersionDetector\Application\Error\ErrorHandler;
use AppVersionDetector\Application\Factory;
use AppVersionDetector\Core\AbstractEvent;
use AppVersionDetector\Core\OutdatedDetection\ComparisonStrategyInterface;
use AppVersionDetector\Core\OutdatedDetection\OutdatedChecker;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Event\EventManager;
use AppVersionDetector\Report\AbstractFileBasedReport;
use AppVersionDetector\Report\Includes\LastRunOutcomeWriter;
use AppVersionDetector\Report\RemoteStatsReport;
use AppVersionDetector\Report\Includes\RemoteStatsRequest;
use AppVersionDetector\Report\SqliteDbReport;
use AppVersionDetector\Scanner;
use AppVersionDetector\Storage\ActualVersionsDb;
use AppVersionDetector\Storage\SqliteDbReportConnection;
use AppVersionDetector\Application\AVDConfig;
use AppVersionDetector\Application\AVDCliParse;
use AppVersionDetector\Application\FileOwners;
use AppVersionDetector\Core\VersionDetection\Detector\WpActivationResolver;
use AppVersionDetector\Core\VersionDetection\Detector\WpConfigParser;
use AppVersionDetector\Core\VersionDetection\Detector\MysqliWpOptionsReader;
use AppVersionDetector\Core\VersionDetection\Detector\ForkingWpOptionsReader;

require_once __DIR__ . '/../vendor/autoload.php';

const IAID_TOKEN_PATH = '/var/imunify360/iaid-token';

$errorHandler = new ErrorHandler();
set_error_handler([$errorHandler, 'handleError']);
set_exception_handler([$errorHandler, 'handleException']);

if (!isset($argv)) {
    $argv = $_SERVER['argv'];
}

$config = new AVDConfig();
$cli = new AVDCliParse($argv, $config);

Profiler::startProfiling();
Factory::configure($config->get(AVDConfig::PARAM_FACTORY_CONFIG));

Stats::setCurrentMemoryUsageStart();

/** @var EventManager $events */
$events = Factory::instance()->create(EventManager::class);


/** @var OutdatedChecker $outdatedComponentChecker */
$outdatedComponentChecker = Factory::instance()->create(OutdatedChecker::class, [
    $events,
    Factory::instance()->create(ActualVersionsDb::class, [new SplFileInfo($config->get(AVDConfig::PARAM_DB_FILE))]),
    Factory::instance()->create(ComparisonStrategyInterface::class)
]);
$events->subscribe(DetectionEvent::class, $outdatedComponentChecker);

DetectionEvent::setFileOwners(new FileOwners());

/** @var AbstractFileBasedReport $report */
$text_report = $config->get(AVDConfig::PARAM_TEXT_REPORT);
if ($text_report) {
    $report = Factory::instance()->create(AbstractFileBasedReport::class, $text_report === true ? [] : [$text_report]);
    $events->subscribe(AbstractEvent::class, $report);
}

/** @var AbstractFileBasedReport $report */
$jsonOutput = $config->get(AVDConfig::PARAM_JSON_REPORT);
if ($jsonOutput) {
    $report = Factory::instance()->create(AbstractFileBasedReport::class, [$jsonOutput]);
    $events->subscribe(AbstractEvent::class, $report);
}

if ($config->get(AVDConfig::PARAM_SEND_STATS)) {
    /** @var RemoteStatsReport $report */
    $iaid_token = null;
    if (is_readable(IAID_TOKEN_PATH)) {
        // Trim the trailing newline and treat an empty/whitespace-only token
        // (transient write race, truncated file) as "no token" so we fall back
        // to v1 rather than posting to v3 with an empty X-Auth.
        $token = trim((string)file_get_contents(IAID_TOKEN_PATH));
        $iaid_token = $token !== '' ? $token : null;
    }
    $request       = Factory::instance()->create(RemoteStatsRequest::class, [$iaid_token]);
    $outcomeWriter = Factory::instance()->create(LastRunOutcomeWriter::class);
    $report        = Factory::instance()->create(RemoteStatsReport::class, [$request, $outcomeWriter]);
    $events->subscribe(AbstractEvent::class, $report);
}

$dbReportConnection = null;

if ($dbPath = $config->get(AVDConfig::PARAM_SQLITE_DB_REPORT)) {
    $dbReportConnection = Factory::instance()->create(SqliteDbReportConnection::class, [$dbPath]);
    /** @var SqliteDbReport $sqliteDbReport */
    $sqliteDbReport = Factory::instance()->create(SqliteDbReport::class, [$dbReportConnection]);
    $events->subscribe(AbstractEvent::class, $sqliteDbReport);
}

$activationResolver = null;
if ($config->get(AVDConfig::PARAM_CHECK_ACTIVATION_STATE)) {
    $activationResolver = new WpActivationResolver(
        new WpConfigParser(),
        new ForkingWpOptionsReader(new MysqliWpOptionsReader())
    );
}
$detector = (new DetectorBuilder())->build($activationResolver);
$scanner = new Scanner($events);
$scanner->run($dbReportConnection, $config->get(AVDConfig::PARAM_TARGET_DIRECTORIES), $detector, $config->get(AVDConfig::PARAM_SCAN_DEPTH), $config->get(AVDConfig::PARAM_SINCE));

Profiler::stopProfilling();
{
  "wp_core": {
    "meta": {
      "source": "https://wordpress.org/download/releases/"
    },
    "branches": [
      ["1.0.0", "1.0.2"],
      ["1.2.0", "1.2.2"],
      ["1.5.0", "1.5.2"],
      ["2.0.0", "2.0.11"],
      ["2.1.0", "2.1.3"],
      ["2.2.0", "2.2.3"],
      ["2.3.0", "2.3.3"],
      ["2.5.0", "2.5.1"],
      ["2.6.0", "2.6.5"],
      ["2.7.0", "2.7.1"],
      ["2.8.0", "2.8.6"],
      ["2.9.0", "2.9.2"],
      ["3.0.0", "3.0.6"],
      ["3.1.0", "3.1.4"],
      ["3.2.0", "3.2.1"],
      ["3.3.0", "3.3.3"],
      ["3.4.0", "3.4.2"],
      ["3.5.0", "3.5.2"],
      ["3.6.0", "3.6.1"],
      ["3.7.0", "3.7.31"],
      ["3.8.0", "3.8.31"],
      ["3.9.0", "3.9.29"],
      ["4.0.0", "4.0.28"],
      ["4.1.0", "4.1.28"],
      ["4.2.0", "4.2.25"],
      ["4.3.0", "4.3.21"],
      ["4.4.0", "4.4.20"],
      ["4.5.0", "4.5.19"],
      ["4.6.0", "4.6.16"],
      ["4.7.0", "4.7.15"],
      ["4.8.0", "4.8.11"],
      ["4.9.0", "4.9.12"],
      ["5.0.0", "5.0.7"],
      ["5.1.0", "5.1.3"],
      ["5.2.0", "5.2.4"]
    ]
  },
  "joomla_core": {
    "meta": {
      "source": "https://www.joomla.org/announcements/release-news.html",
      "top_plugins": "https://extensions.joomla.org/browse/top-rated/"
    },
    "branches": [
      ["1.0.0", "1.0.15"],
      ["1.5.0", "1.5.26"],
      ["1.6.0", "1.6.6"],
      ["1.7.0", "1.7.5"],
      ["2.5.0", "2.5.28"],
      ["3.0.0", "3.9.12"]
    ]
  },
  "drupal_core": {
    "meta": {
      "source": "https://www.drupal.org/project/drupal/releases",
      "top_plugins": "https://www.drupal.org/project/project_module/?solrsort=iss_project_release_usage%20desc&f%5B4%5D=sm_field_project_type%3Afull"
    },
    "branches": [
      ["4.0.0", "4.0.0"],
      ["4.1.0", "4.1.0"],
      ["4.2.0", "4.2.0"],
      ["4.3.0", "4.3.2"],
      ["4.4.0", "4.4.3"],
      ["4.5.0", "4.5.8"],
      ["4.6.0", "4.6.11"],
      ["4.7.0", "4.7.11"],
      ["5.0.0", "5.23.0"],
      ["6.0.0", "6.38.0"],
      ["7.0.0", "7.67.0"],
      ["8.0.0", "8.7.8"]
    ]
  },
  "wp_plugin_akismet": {
    "meta": {
      "source": "https://wordpress.org/plugins/akismet/"
    },
    "branches": [
      ["0.0.0", "4.1.2"]
    ]
  },
  "wp_plugin_all-in-one-seo-pack": {
    "meta": {
      "source": "https://wordpress.org/plugins/all-in-one-seo-pack/"
    },
    "branches": [
      ["0.0.0", "3.2.9"]
    ]
  },
  "wp_plugin_all-in-one-wp-migration": {
    "meta": {
      "source": "https://wordpress.org/plugins/all-in-one-wp-migration/"
    },
    "branches": [
      ["0.0.0", "7.9.0"]
    ]
  },
  "wp_plugin_classic-editor": {
    "meta": {
      "source": "https://wordpress.org/plugins/classic-editor/"
    },
    "branches": [
      ["0.0.0", "1.5.0"]
    ]
  },
  "wp_plugin_contact-form-7": {
    "meta": {
      "source": "https://wordpress.org/plugins/contact-form-7/"
    },
    "branches": [
      ["0.0.0", "5.1.4"]
    ]
  },
  "wp_plugin_duplicate-post": {
    "meta": {
      "source": "https://wordpress.org/plugins/duplicate-post/"
    },
    "branches": [
      ["0.0.0", "3.2.3"]
    ]
  },
  "wp_plugin_elementor": {
    "meta": {
      "source": "https://wordpress.org/plugins/elementor/"
    },
    "branches": [
      ["0.0.0", "2.7.5"]
    ]
  },
  "wp_plugin_google-analytics-dashboard-for-wp": {
    "meta": {
      "source": "https://wordpress.org/plugins/google-analytics-dashboard-for-wp/"
    },
    "branches": [
      ["0.0.0", "5.3.9"]
    ]
  },
  "wp_plugin_google-analytics-for-wordpress": {
    "meta": {
      "source": "https://wordpress.org/plugins/google-analytics-for-wordpress/"
    },
    "branches": [
      ["0.0.0", "7.9.0"]
    ]
  },
  "wp_plugin_google-sitemap-generator": {
    "meta": {
      "source": "https://wordpress.org/plugins/google-sitemap-generator/"
    },
    "branches": [
      ["0.0.0", "4.1.0"]
    ]
  },
  "wp_plugin_jetpack": {
    "meta": {
      "source": "https://wordpress.org/plugins/jetpack/"
    },
    "branches": [
      ["0.0.0", "7.8.0"]
    ]
  },
  "wp_plugin_really-simple-ssl": {
    "meta": {
      "source": "https://wordpress.org/plugins/really-simple-ssl/"
    },
    "branches": [
      ["0.0.0", "3.2.6"]
    ]
  },
  "wp_plugin_tinymce-advanced": {
    "meta": {
      "source": "https://wordpress.org/plugins/tinymce-advanced/"
    },
    "branches": [
      ["0.0.0", "5.2.1"]
    ]
  },
  "wp_plugin_updraftplus": {
    "meta": {
      "source": "https://wordpress.org/plugins/updraftplus/"
    },
    "branches": [
      ["0.0.0", "1.16.17"]
    ]
  },
  "wp_plugin_woocommerce": {
    "meta": {
      "source": "https://wordpress.org/plugins/woocommerce/"
    },
    "branches": [
      ["0.0.0", "3.7.1"]
    ]
  },
  "wp_plugin_wordfence": {
    "meta": {
      "source": "https://wordpress.org/plugins/wordfence/"
    },
    "branches": [
      ["0.0.0", "7.4.0"]
    ]
  },
  "wp_plugin_wordpress-importer": {
    "meta": {
      "source": "https://wordpress.org/plugins/wordpress-importer/"
    },
    "branches": [
      ["0.0.0", "0.6.4"]
    ]
  },
  "wp_plugin_wordpress-seo": {
    "meta": {
      "source": "https://wordpress.org/plugins/wordpress-seo/"
    },
    "branches": [
      ["0.0.0", "12.4.0"]
    ]
  },
  "wp_plugin_wp-super-cache": {
    "meta": {
      "source": "https://wordpress.org/plugins/wp-super-cache/"
    },
    "branches": [
      ["0.0.0", "1.7.0"]
    ]
  },
  "wp_plugin_wpforms-lite": {
    "meta": {
      "source": "https://wordpress.org/plugins/wpforms-lite/"
    },
    "branches": [
      ["0.0.0", "1.5.6"]
    ]
  },
  "joomla_plugin_advancedmodules": {
    "meta": {
      "source": "https://www.regularlabs.com/extensions/advancedmodulemanager"
    },
    "branches": [
      ["0.0.0", "7.12.3"]
    ]
  },
  "joomla_plugin_jch_optimize": {
    "meta": {
      "source": "https://extensions.joomla.org/extensions/extension/core-enhancements/performance/jch-optimize/"
    },
    "branches": [
      ["0.0.0", "5.4.3"]
    ]
  },
  "joomla_plugin_acym": {
    "meta": {
      "source": "https://extensions.joomla.org/extensions/extension/marketing/newsletter/acymailing-starter/"
    },
    "branches": [
      ["0.0.0", "6.5.1"]
    ]
  },
  "joomla_plugin_j2store": {
    "meta": {
      "source": "https://extensions.joomla.org/extensions/extension/e-commerce/shopping-cart/j2store/"
    },
    "branches": [
      ["0.0.0", "3.3.11"]
    ]
  },
  "joomla_plugin_arkeditor": {
    "meta": {
      "source": "https://extensions.joomla.org/extensions/extension/edition/editors/jck-editor/"
    },
    "branches": [
      ["0.0.0", "2.6.10"]
    ]
  },
  "joomla_plugin_system_modulesanywhere": {
    "meta": {
      "source": "https://extensions.joomla.org/extensions/extension/core-enhancements/coding-a-scripts-integration/modules-anywhere/"
    },
    "branches": [
      ["0.0.0", "7.8.2"]
    ]
  },
  "joomla_plugin_akeeba": {
    "meta": {
      "source": "https://extensions.joomla.org/extensions/extension/access-a-security/site-security/akeeba-backup/"
    },
    "branches": [
      ["0.0.0", "6.6.1"]
    ]
  },
  "joomla_plugin_sigplus": {
    "meta": {
      "source": "https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/sigplus/"
    },
    "branches": [
      ["0.0.0", "1.5.0.277"]
    ]
  },
  "joomla_plugin_smartslider3": {
    "meta": {
      "source": "https://extensions.joomla.org/extensions/extension/photos-a-images/slideshow/smart-slider-2/"
    },
    "branches": [
      ["0.0.0", "3.3.22"]
    ]
  },
  "joomla_plugin_jdownloads": {
    "meta": {
      "source": "https://extensions.joomla.org/extensions/extension/directory-a-documentation/downloads/jdownloads/"
    },
    "branches": [
      ["0.0.0", "3.2.65"]
    ]
  },
  "drupal_plugin_ctools": {
    "meta": {
      "source": "https://www.drupal.org/project/ctools"
    },
    "branches": [
      ["8.x-0.0", "8.x-3.2"],
      ["7.x-0.0", "7.x-1.15"]
    ]
  },
  "drupal_plugin_token": {
    "meta": {
      "source": "https://www.drupal.org/project/token"
    },
    "branches": [
      ["8.x-0.0", "8.x-1.5"]
    ]
  },
  "drupal_plugin_pathauto": {
    "meta": {
      "source": "https://www.drupal.org/project/pathauto"
    },
    "branches": [
      ["8.x-0.0", "8.x-1.5"]
    ]
  },
  "drupal_plugin_views": {
    "meta": {
      "source": "https://www.drupal.org/project/views"
    },
    "branches": [
      ["7.x-0.0", "7.x-3.23"]
    ]
  },
  "drupal_plugin_libraries": {
    "meta": {
      "source": "https://www.drupal.org/project/libraries"
    },
    "branches": [
      ["7.x-0.0", "7.x-2.5"]
    ]
  },
  "drupal_plugin_entity": {
    "meta": {
      "source": "https://www.drupal.org/project/entity"
    },
    "branches": [
      ["7.x-0.0", "7.x-1.9"]
    ]
  },
  "drupal_plugin_webform": {
    "meta": {
      "source": "https://www.drupal.org/project/webform"
    },
    "branches": [
      ["8.x-0.0", "8.x-5.5"]
    ]
  },
  "drupal_plugin_jquery_update": {
    "meta": {
      "source": "https://www.drupal.org/project/jquery_update"
    },
    "branches": [
      ["7.x-0.0", "7.x-2.7"]
    ]
  },
  "drupal_plugin_imce": {
    "meta": {
      "source": "https://www.drupal.org/project/imce"
    },
    "branches": [
      ["8.x-0.0", "8.x-1.7"]
    ]
  },
  "drupal_plugin_date": {
    "meta": {
      "source": "https://www.drupal.org/project/date"
    },
    "branches": [
      ["7.x-0.0", "7.x-2.10"]
    ]
  }
}
SQLite format 3���@  ���������������������������������������������������������������������.�
���!��D�m!�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������J%eindexi_branch_keybranchCREATE INDEX i_branch_key ON branch (app_id)��ytablebranchbranchCREATE TABLE branch ( app_id           INTEGER NOT NULL,first_version    TEXT NOT NULL,last_version     TEXT NOT NULL)Ccindexi_app_keyappCREATE UNIQUE INDEX i_app_key ON app (name)P++Ytablesqlite_sequencesqlite_sequenceCREATE TABLE sqlite_sequence(name,seq)h�7tableappappCREATE TABLE app ( id       INTEGER PRIMARY KEY AUTOINCREMENT,name     TEXT NOT NULL)
���+F������vY<���mM.
�
�
�
�
�
m
K
,
�����dG.�����t]F��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������+�1drupal_plugin_date*�1drupal_plugin_imce)�Cdrupal_plugin_jquery_update(�7drupal_plugin_webform'�5drupal_plugin_entity&�;drupal_plugin_libraries%�3drupal_plugin_views$�9drupal_plugin_pathauto#�3drupal_plugin_token"�5drupal_plugin_ctools!�=joomla_plugin_jdownloads �Ajoomla_plugin_smartslider3�7joomla_plugin_sigplus�5joomla_plugin_akeeba'�Ujoomla_plugin_system_modulesanywhere�;joomla_plugin_arkeditor�7joomla_plugin_j2store�1joomla_plugin_acym�Ajoomla_plugin_jch_optimize �Gjoomla_plugin_advancedmodules�9wp_plugin_wpforms-lite�=wp_plugin_wp-super-cache�;wp_plugin_wordpress-seo�Ewp_plugin_wordpress-importer�3wp_plugin_wordfence�7wp_plugin_woocommerce�7wp_plugin_updraftplus�Awp_plugin_tinymce-advanced�Cwp_plugin_really-simple-ssl�/wp_plugin_jetpack%
�Qwp_plugin_google-sitemap-generator+�]wp_plugin_google-analytics-for-wordpress.�cwp_plugin_google-analytics-dashboard-for-wp
�3wp_plugin_elementor	�=wp_plugin_duplicate-post�=wp_plugin_contact-form-7�=wp_plugin_classic-editor$�Owp_plugin_all-in-one-wp-migration �Gwp_plugin_all-in-one-seo-pack�/wp_plugin_akismet�#drupal_core�#joomla_core
�wp_core
���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������app+
���+G��/G�^u�����

L���
-H�e����wZ= ���nN/
�
�
�
�
�
n���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������1drupal_plugin_date+1drupal_plugin_imce*Cdrupal_plugin_jquery_update)7drupal_plugin_webform(5drupal_plugin_entity';drupal_plugin_libraries&3drupal_plugin_views%9drupal_plugin_pathauto$3drupal_plugin_token#5drupal_plugin_ctools"=joomla_plugin_jdownloads!Ajoomla_plugin_smartslider3 7joomla_plugin_sigplus5joomla_plugin_akeeba(Ujoomla_plugin_system_modulesanywhere;joomla_plugin_arkeditor7joomla_plugin_j2store1joomla_plugin_acymAjoomla_plugin_jch_optimize!Gjoomla_plugin_advancedmodules9wp_plugin_wpforms-lite=wp_plugin_wp-super-cache;wp_plugin_wordpress-seo Ewp_plugin_wordpress-importer3wp_plugin_wordfence7wp_plugin_woocommerce7wp_plugin_updraftplusAwp_plugin_tinymce-advancedCwp_plugin_really-simple-ssl/wp_plugin_jetpack&Qwp_plugin_google-sitemap-generator
,]wp_plugin_google-analytics-for-wordpress/cwp_plugin_google-analytics-dashboard-for-wp3wp_plugin_elementor
=wp_plugin_duplicate-post	=wp_plugin_contact-form-7=wp_plugin_classic-editor%Owp_plugin_all-in-one-wp-migration!Gwp_plugin_all-in-one-seo-pack/wp_plugin_akismet#drupal_core#joomla_core
	wp_core
���^	���������o_O?/��������ziXG6%
�
�
�
�
�
�
�
|
j
X
G
6
%

�������veTC2!��������udRA0
�
�
�
�
�
�
�
}
h
R
=
(
	�	�	�	�	�	������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������^+7.x-0.07.x-2.10]*8.x-0.08.x-1.7\)7.x-0.07.x-2.7[(8.x-0.08.x-5.5Z'7.x-0.07.x-1.9Y&7.x-0.07.x-2.5X%7.x-0.07.x-3.23W$8.x-0.08.x-1.5V#8.x-0.08.x-1.5U"7.x-0.07.x-1.15T"8.x-0.08.x-3.2S!0.0.03.2.65R 0.0.03.3.22Q0.0.01.5.0.277P0.0.06.6.1O0.0.07.8.2N0.0.02.6.10M0.0.03.3.11L0.0.06.5.1K0.0.05.4.3J0.0.07.12.3I0.0.01.5.6H0.0.01.7.0G0.0.012.4.0F0.0.00.6.4E0.0.07.4.0D0.0.03.7.1C0.0.01.16.17B0.0.05.2.1A0.0.03.2.6@0.0.07.8.0?
0.0.04.1.0>0.0.07.9.0=0.0.05.3.9<
0.0.02.7.5;	0.0.03.2.3:0.0.05.1.490.0.01.5.080.0.07.9.070.0.03.2.960.0.04.1.258.0.08.7.847.0.07.67.036.0.06.38.025.0.05.23.014.7.04.7.1104.6.04.6.11/4.5.04.5.8.4.4.04.4.3-4.3.04.3.2,4.2.04.2.0+4.1.04.1.0*4.0.04.0.0)3.0.03.9.12(2.5.02.5.28'1.7.01.7.5&1.6.01.6.6%1.5.01.5.26$1.0.01.0.15#	5.2.05.2.4"	5.1.05.1.3!	5.0.05.0.7 	4.9.04.9.12	4.8.04.8.11	4.7.04.7.15	4.6.04.6.16	4.5.04.5.19	4.4.04.4.20	4.3.04.3.21	4.2.04.2.25	4.1.04.1.28	4.0.04.0.28	3.9.03.9.29	3.8.03.8.31	3.7.03.7.31	3.6.03.6.1	3.5.03.5.2	3.4.03.4.2	3.3.03.3.3	3.2.03.2.1	3.1.03.1.4
	3.0.03.0.6	2.9.02.9.2	2.8.02.8.6
	2.7.02.7.1		2.6.02.6.5	2.5.02.5.1	2.3.02.3.3	2.2.02.2.3	2.1.02.1.3	2.0.02.0.11	1.5.01.5.2	1.2.01.2.2	1.0.01.0.2
���^
���������������������������zupkfa\WRLF@:4.("
����������������������ztnhb\VPJD>82,& 
�
�
�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������+^*])\(['Z&Y%X$W#V"U"T!S RQPONMLKJIHGFEDCBA@
?>=
<	;:9876543210/.-,+*)('&%$	#	"	!	 																			
			
											<?php
/**
 * AbstractEvent class file.
 */

namespace AppVersionDetector\Core;


/**
 * Class AbstractEvent.
 */
class AbstractEvent
{
    /**
     * @var mixed
     */
    private $sender;

    /**
     * Returns an event sender.
     *
     * @return mixed
     */
    public function getSender()
    {
        return $this->sender;
    }

    /**
     * Sets an event sender.
     *
     * @param object $sender
     */
    protected function setSender($sender)
    {
        $this->sender = $sender;
    }
}<?php

namespace AppVersionDetector\Core\OutdatedDetection;

interface ComparisonStrategyInterface
{
    const NOT_IN_RANGE                  = 0;
    const IN_RANGE_BUT_LOWER_THAN_RIGHT = 1;
    const EQUALS_TO_RIGHT               = 2;

    /**
     * Check $value lays between $left and $right.
     *
     * Return the followings:
     * 0 - $value is not in range
     * 1 - $left <= $value < $right
     * 2 - $value equals to $right
     *
     * @param string $left
     * @param string $right
     * @param string $value
     * @return integer
     */
    public function compare($left, $right, $value);
}<?php
/**
 * GenericComparisonStrategy class file.
 */

namespace AppVersionDetector\Core\OutdatedDetection;

use Composer\Semver\Comparator;
use Composer\Semver\VersionParser;

/**
 * Class GenericComparisonStrategy.
 */
class GenericComparisonStrategy implements ComparisonStrategyInterface
{
    /**
     * Check $value lays between $left and $right.
     *
     * Return the followings:
     * 0 - $value is not in range
     * 1 - $left <= $value < $right
     * 2 - $value equals to $right
     *
     * @param string $left
     * @param string $right
     * @param string $value
     * @return integer
     */
    public function compare($left, $right, $value)
    {
        $versionParser = new VersionParser();

        $left   = $this->normalize($versionParser, $left);
        $right  = $this->normalize($versionParser, $right);
        $value  = $this->normalize($versionParser, $value);
        
        switch (true) {
            case Comparator::equalTo($value, $right):
                return self::EQUALS_TO_RIGHT;
                break;
            case Comparator::greaterThanOrEqualTo($value, $left) && Comparator::lessThan($value, $right):
                return self::IN_RANGE_BUT_LOWER_THAN_RIGHT;
                break;
            default:
                return self::NOT_IN_RANGE;
        }
    }
    
    /**
     * Normalize version. 
     * Replacing "~^(\d)\.x~" need for Drupal plugins
     * Replacing words at the beginning and at the end of the version before and after the number. Example: beta3.2.6FREE => 3.2.6
     *
     * @param VersionParser $versionParser
     * @param string $version
     * @return string
     */
    private function normalize(VersionParser $versionParser, $version)
    {
        $version = preg_replace('~^(\d)\.x-~',              '$1', $version);
        $version = preg_replace('~^(.*[\d.-]*\d)[a-z]*$~i', '$1', $version);
        $version = preg_replace('~^[a-z]*(\d[\d.-]*)$~i',   '$1', $version);
        $version = preg_replace('~^\D+$~i',                 '0.0', $version);
        
        try {
            $version = $versionParser->normalize($version);
        } catch (\Exception $ex) {
            $version = '';
        }
        
        return $version;
    }
}<?php
/**
 * OutdatedChecker class file.
 */

namespace AppVersionDetector\Core\OutdatedDetection;

use AppVersionDetector\Core\AbstractEvent;
use AppVersionDetector\Core\ListenerInterface;
use AppVersionDetector\Core\PublisherInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;

/**
 * Class OutdatedChecker.
 */
class OutdatedChecker implements ListenerInterface
{
    /**
     * @var ComparisonStrategyInterface
     */
    private $comparisonStrategy;
    /**
     * @var PublisherInterface
     */
    private $publisher;
    /**
     * @var VersionDbInterface
     */
    private $db;

    /**
     * OutdatedChecker constructor.
     *
     * @param PublisherInterface $publisher
     * @param VersionDbInterface $db
     * @param ComparisonStrategyInterface $comparisonStrategy
     */
    public function __construct($publisher, $db, $comparisonStrategy)
    {
        $this->publisher            = $publisher;
        $this->db                   = $db;
        $this->comparisonStrategy   = $comparisonStrategy;
    }

    /**
     * Notifies a listener about an event raised.
     *
     * @param AbstractEvent $event
     */
    public function notify(AbstractEvent $event)
    {
        if ($event instanceof DetectionEvent) {
            $this->reactOnDetection($event);
        }
    }

    /**
     * Implements checking if a component is outdated.
     *
     * @param DetectionEvent $event
     */
    private function reactOnDetection(DetectionEvent $event)
    {
       if ($event->getVersion() == DetectorInterface::UNKNOWN_VERSION || !$this->db->hasKey($event->getName())) {
           return;
       }

       $versionPairs = $this->db->getByKey($event->getName());
       while ($pair = array_shift($versionPairs)) {
           switch ($this->comparisonStrategy->compare($pair[0], $pair[1], $event->getVersion())) {
               case ComparisonStrategyInterface::IN_RANGE_BUT_LOWER_THAN_RIGHT:
                   $this->publisher->update(
                       new OutdatedEvent($this, $event->getName(), $event->getVersion(), OutdatedEvent::TYPE_BRANCH)
                   );
                   break;
               case ComparisonStrategyInterface::EQUALS_TO_RIGHT:
                   if (!empty($versionPairs)) {
                       $this->publisher->update(
                           new OutdatedEvent(
                               $this,
                               $event->getName(),
                               $event->getVersion(),
                               OutdatedEvent::TYPE_PRODUCT
                           )
                       );
                   }
                   break;
           }
       }
    }
}<?php
/**
 * OutdatedEvent class file.
 */

namespace AppVersionDetector\Core\OutdatedDetection;


use AppVersionDetector\Core\AbstractEvent;

/**
 * Class OutdatedEvent.
 */
class OutdatedEvent extends AbstractEvent
{
    const TYPE_BRANCH   = 'branch_outdated';
    const TYPE_PRODUCT  = 'product_outdated';

    /**
     * @var string
     */
    private $version;
    /**
     * @var string
     */
    private $name;
    /**
     * @var string
     */
    private $type;

    /**
     * OutdatedEvent constructor.
     *
     * @param object $sender
     * @param string $name
     * @param string $version
     * @param string $type
     */
    public function __construct($sender, $name, $version, $type)
    {
        $this->setSender($sender);
        $this->name     = $name;
        $this->version  = $version;
        $this->type     = $type;
    }

    /**
     * Returns name of an outdated component.
     *
     * @return string
     */
    public function getName()
    {
        return $this->name;
    }

    /**
     * Returns version of an outdated component.
     *
     * @return string
     */
    public function getVersion()
    {
        return $this->version;
    }

    /**
     * Returns type of an outdated event.
     *
     * @return string
     */
    public function getType(): string
    {
        return $this->type;
    }
}<?php

namespace AppVersionDetector\Core\OutdatedDetection;

interface VersionDbInterface
{
    /**
     * Checks if a $name key exists.
     *
     * @param string $key
     * @return boolean
     */
    public function hasKey(string $key);

    /**
     * Returns pairs for a specified key.
     *
     * Note: this method should return an ORDERED list of pairs.
     *
     * @param string $key
     * @return array list of pairs
     */
    public function getByKey(string $key);
}<?php
/**
 * PlainCollectionDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection;

use AppVersionDetector\Core\PublisherInterface;
use AppVersionDetector\Core\VersionDetection\AbstractCompositeDetector;
use SplFileInfo;

/**
 * Class PlainCollectionDetector.
 *
 * @package AppVersionDetector\Core
 */
class PlainCollectionDetector extends AbstractCompositeDetector
{
    /**
     * @param PublisherInterface $publisher
     * @param SplFileInfo $splFileInfo
     */
    public function perform(PublisherInterface $publisher, SplFileInfo $splFileInfo)
    {
        foreach ($this->detectors as $detector) {
            $detector->perform($publisher, $splFileInfo);
        }
    }
}<?php

namespace AppVersionDetector\Core\VersionDetection;

use AppVersionDetector\Core\AbstractEvent;
use AppVersionDetector\Application\FileOwners;
use SplFileInfo;

/**
 * Class DetectionEventData.
 * 
 * Data transfer object. Need for transfer data about objects(cms, plugins and other)
 */
class DetectionEvent extends AbstractEvent
{
    const STATUS_UNKNOWN = 'unknown';

    /*
     * @var string Object name
     */
    private $name = '';
    
    /*
     * @var string Object version
     */
    private $version = '';
    
    /**
     * @var SplFileInfo
     */
    private $path;

    /*
     * @var int Object uid
     */
    private $uid = null;

    /*
     * @var string Activation status: active|inactive|multisite|unknown
     */
    private $status = self::STATUS_UNKNOWN;

    private static $fileOwners = null;
    
    public static function setFileOwners(FileOwners $fileOwners)
    {
        self::$fileOwners = $fileOwners;
    }

    /**
     * @param object $sender
     * @param SplFileInfo $path
     * @param string $name
     * @param string $version
     */
    public function __construct($sender, SplFileInfo $path, $name, $version)
    {
        $this->setSender($sender);
        $this->name     = $name;
        $this->version  = $version;
        $this->path     = $path;
    }

    /**
     * @return string
     */
    public function getName() 
    {
        return $this->name;
    }

    /**
     * @return int
     */
    public function getUID()
    {
        if (is_null($this->uid) && file_exists($this->path) && !is_null(self::$fileOwners)) {
            $this->uid = self::$fileOwners->getFileOwner((string)$this->path);
        }
        return $this->uid;
    }
    
    /**
     * @return string
     */
    public function getVersion()
    {
        return $this->version;
    }

    /**
     * @param string $version
     */
    public function setVersion($version)
    {
        $this->version = $version;
    }

    /**
     * @return string Activation status: active|inactive|multisite|unknown.
     */
    public function getStatus()
    {
        return $this->status;
    }

    /**
     * @param string $status
     */
    public function setStatus($status)
    {
        $this->status = $status;
    }
    
    /**
     * @return SplFileInfo
     */
    public function getPath(): SplFileInfo
    {
        return $this->path;
    }
}
<?php
/**
 * WpCoreDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Detector\AppVersionDetector;
use AppVersionDetector\Detector\Exception;
use SplFileInfo;

/**
 * Class WpCoreDetector.
 */
class WpCoreDetector extends AbstractDetector
{
    /*
     * @var string Detector name
     */
    
    private $detector_name = 'wp_core';

    /**
     * Implements finding and extracting info(version and name).
     *
     * If something is found it return AppVersionDetector\Core\Detector\Version\DetectionEventData.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|null
     * @throws \Exception
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir        = $splFileInfo->getPathname();
        $detected   = false;
        
        $detectionEvent = new DetectionEvent($this, $splFileInfo, $this->detector_name, DetectorInterface::UNKNOWN_VERSION);

        if (file_exists($dir . '/wp-admin/admin-functions.php')) {
            $detected = true;
            
            $filepath = $dir . '/wp-includes/version.php';
            if (file_exists($filepath) && is_file($filepath)) {
                Stats::incrementCountFilesReaded();
                $tmp_content = Helper::getPartOfFile($filepath, 8192);
                if (preg_match('|\$wp_version\s*=\s*\'(.+?)\'|smi', $tmp_content, $tmp_ver)) {
                    $detectionEvent->setVersion($tmp_ver[1]);
                }
            }
        }

        return $detected ? $detectionEvent : null;
    }
}<?php
/**
 * WpOptionsReader interface file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

/**
 * Reads the small set of wp_options rows needed to determine plugin/theme
 * activation status, given the connection settings parsed from wp-config.php.
 *
 * Implementations connect transiently to the tenant database. Credentials must
 * never be logged, thrown, or persisted, and the connection must be closed
 * immediately. A null return means "could not read" — implementations must fail
 * soft (no exceptions) so the caller can report 'unknown'.
 */
interface WpOptionsReader
{
    /**
     * @param array $config Parsed wp-config.php settings, with keys:
     *                      db_name, db_user, db_password, db_host, table_prefix.
     *                      table_prefix is guaranteed to match [A-Za-z0-9_]+.
     * @param int $tenantUid uid the WordPress install belongs to; an implementation
     *                       may use it to drop privileges before connecting.
     * @return array|null [
     *     'active_plugins' => string|null,  // raw (serialized) option_value
     *     'stylesheet'     => string|null,
     *     'template'       => string|null,
     * ] or null when the options could not be read.
     */
    public function readOptions(array $config, $tenantUid): ?array;
}
<?php
/**
 * MagentoCoreDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Detector\AppVersionDetector;
use AppVersionDetector\Detector\Exception;
use SplFileInfo;

/**
 * Class MagentoCoreDetector.
 */
class MagentoCoreDetector extends AbstractDetector
{
    /*
     * @var string Detector name
     */
    
    private $detector_name = 'magento_core';

    /**
     * Implements finding and extracting info(version and name).
     *
     * If something is found it return AppVersionDetector\Core\Detector\Version\DetectionEventData.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|null
     * @throws \Exception
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir        = $splFileInfo->getPathname();

        $detected   = false;
        
        $detectionEvent = new DetectionEvent($this, $splFileInfo, $this->detector_name, DetectorInterface::UNKNOWN_VERSION);

        if ($this->isMagento1x($dir)) {
            $detected = true;
            $filepath = $dir . '/app/Mage.php';
            if (file_exists($filepath) && is_file($filepath)) {
                Stats::incrementCountFilesReaded();
                $tmp_content = Helper::getPartOfFile($filepath, 8192);
                if (preg_match('~return\s*array\(\s*\'major\'\s*=>\s*\'(\d*)\',\s*\'minor\'\s*=>\s*\'(\d*)\',\s*\'revision\'\s*=>\s*\'(\d*)\',\s*\'patch\'\s*=>\s*\'(\d*)\',\s*\'stability\'\s*=>\s*\'(\d*)\',\s*\'number\'\s*=>\s*\'(\d*)\',\s*~ms', $tmp_content, $tmp_ver)) {
                    $version = trim("{$tmp_ver[1]}.{$tmp_ver[2]}.{$tmp_ver[3]}" . ($tmp_ver[4] != '' ? ".{$tmp_ver[4]}" : "")
                        . "-{$tmp_ver[5]}{$tmp_ver[6]}", '.-');
                    $detectionEvent->setVersion($version);
                }
            }
        } else if ($this->isMagento2x($dir)) {
            $detected = true;
            $filepath = $dir . '/composer.json';
            if (file_exists($filepath) && is_file($filepath)) {
                Stats::incrementCountFilesReaded();
                $tmp_content = Helper::getPartOfFile($filepath, 512);
                if (preg_match('~"version":\s*"([^"]+)",~ms', $tmp_content, $tmp_ver)) {
                    $version = $tmp_ver[1];
                    $detectionEvent->setVersion($version);
                }
            }
        }
        return $detected ? $detectionEvent : null;
    }

    /**
     *
     * Check is Magento1x
     *
     * @param string $dir
     * @return boolean
     */
    private function isMagento1x($dir)
    {
        if (file_exists($dir . '/app/Mage.php') && file_exists($dir . '/lib/Magento')) {
            return true;
        }
        return false;
    }

    /**
     *
     * Check is Magento2x
     *
     * @param string $dir
     * @return boolean
     */
    private function isMagento2x($dir)
    {
        if (file_exists($dir . '/app/etc/di.xml') && file_exists($dir . '/bin/magento')
            && file_exists($dir . '/composer.json')
        ) {
            return true;
        }
        return false;
    }
}<?php
/**
 * NodeJsAppDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class NodeJsAppDetector.
 *
 * Detects an installed Node.js application: a directory carrying a
 * `node_modules` tree. The version reported is the one the application's own
 * `package.json` declares.
 *
 * The title is the fixed `nodejs_app` rather than the package's own name.
 * A root package name is chosen by whoever wrote the manifest, matches nothing
 * in any vulnerability feed, and would turn the app-name dimension of
 * `app_version_info` into a per-tenant unbounded set. The install is
 * identified by its path, the same way `wp_core` is.
 *
 * This is the "core" detector of the Node.js dependency chain: it gates
 * NodeJsPackageDetector, so it must fire for every directory that holds
 * installed packages, including one whose own manifest is missing or broken.
 */
class NodeJsAppDetector extends AbstractDetector
{
    /**
     * @var string Reported application title.
     */
    const APP_NAME = 'nodejs_app';

    /**
     * @var PackageJsonReader
     */
    private $reader;

    /**
     * @param PackageJsonReader $reader
     */
    public function __construct(PackageJsonReader $reader)
    {
        $this->reader = $reader;
    }

    /**
     * @param SplFileInfo $splFileInfo
     *
     * @return DetectionEvent|null
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir = $splFileInfo->getPathname();
        if (!is_dir($dir . '/' . Helper::NODE_MODULES_DIR)) {
            return null;
        }

        return new DetectionEvent(
            $this,
            $splFileInfo,
            self::APP_NAME,
            $this->reader->version($this->reader->read($dir))
        );
    }
}
<?php
/**
 * PHPBB3CoreDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class PHPBB3CoreDetector.
 */
class PHPBB3CoreDetector extends AbstractDetector
{
    const PHPBB3_CMS_DETECTOR_NAME = 'phpbb3_core';

    /**
     * Implements finding and extracting info(version and name).
     *
     * If something is found it return AppVersionDetector\Core\Detector\Version\DetectionEventData.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|array|null
     * @throws \Exception
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir = $splFileInfo->getPathname();

        if (!$this->isPHPBB3($dir)) {
            return null;
        }

        $result = [];

        $cmsVersion = $this->checkPHPBB3Version($dir);
        if ($cmsVersion !== null) {
            $result[] = new DetectionEvent($this, $splFileInfo,self::PHPBB3_CMS_DETECTOR_NAME, $cmsVersion);
        }

        return empty($result)
            ? new DetectionEvent($this, $splFileInfo,self::PHPBB3_CMS_DETECTOR_NAME, DetectorInterface::UNKNOWN_VERSION)
            : $result;
    }

    /**
     * Tries to get a version of PHPBB3 CMS.
     *
     * @param $dir
     * @return string|null
     */
    private function checkPHPBB3Version($dir)
    {
        $tmp_ver = Helper::tryGetVersion($dir . '/install/schemas/schema_data.sql', 32000, '~INSERT\s*INTO\s*phpbb_config\s*\(config_name,\s*config_value\)\s*VALUES\s*\(\'version\',\s*\'([^\']+)\'\);~msi');
        if ($tmp_ver !== '') {
            return $tmp_ver[1];
        }

        $tmp_ver = Helper::tryGetVersion($dir . '/styles/prosilver/style.cfg', 2048, '~\b(?:phpbb_)?version\s*=\s*([^\s]+)~msi');
        if ($tmp_ver !== '') {
            return $tmp_ver[1];
        }

        $tmp_ver = Helper::tryGetVersion($dir . '/styles/prosilver/composer.json', 2048, '~"phpbb-version":\s*"([^"]+)",~msi');
        if ($tmp_ver !== '') {
            return $tmp_ver[1];
        }
        return null;
    }

    /**
     *
     * Check what is PHPBB3
     *
     * @param string $dir
     * @return boolean
     */
    private function isPHPBB3($dir)
    {
        if (file_exists($dir . '/includes/ucp/info/ucp_main.php') && file_exists($dir . '/adm/style/acp_bbcodes.html')
            && file_exists($dir . '/ucp.php')) {
            return true;
        }
        return false;
    }
}<?php
/**
 * PackageJsonReader class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Helper;
use AppVersionDetector\Application\Stats;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;

/**
 * Reads `package.json` manifests, and owns the two rules that keep a root-run
 * scan out of trouble on tenant-controlled trees: what may be used as a
 * package name, and where a resolved package directory is allowed to live.
 *
 * Deliberately not cached. Each manifest in a tree is read exactly once — the
 * application root by NodeJsAppDetector, each package by the walk — so a cache
 * would have no hits to pay for itself, while retaining every decoded manifest
 * of every application for the lifetime of the scan: ~6.5 KB each, tens of
 * thousands of them on a shared host.
 */
class PackageJsonReader
{
    /**
     * @var string Manifest file name.
     */
    const MANIFEST = 'package.json';

    /**
     * Bytes read from a manifest.
     *
     * A manifest is a small metadata file; anything past this is either not a
     * manifest or is not being read as one. A truncated read yields invalid
     * JSON and is handled exactly like a broken manifest, which is the point:
     * a tenant cannot make the scanner pull an unbounded file into memory.
     *
     * @var int
     */
    const MAX_BYTES = 65536;

    /**
     * An npm package name, and nothing that could act as a path.
     *
     * A name reaches this class straight out of a tenant-written manifest and
     * is about to become a path component under node_modules/, so the pattern
     * is a whitelist: an optional `@scope/` and one segment, each starting
     * alphanumeric. That rejects `..`, absolute paths, embedded slashes, NUL
     * bytes and newlines by construction rather than by enumeration.
     *
     * Anchored with \A and \z (not ^/$) because `$` also matches before a
     * trailing newline — "express\n" must not pass as "express".
     *
     * Uppercase is accepted: npm forbids it for new packages but plenty of
     * legacy dependencies carry it, and dropping them would silently thin out
     * the report.
     *
     * @var string
     */
    const NAME_PATTERN = '#\A(?:@[A-Za-z0-9][A-Za-z0-9._~-]*/)?[A-Za-z0-9][A-Za-z0-9._~-]*\z#';

    /**
     * @var int Longest package name npm accepts.
     */
    const NAME_MAX_LENGTH = 214;

    /**
     * Longest version string kept.
     *
     * A semver with build metadata is a few dozen characters; 256 leaves room
     * for anything a real registry has ever served. The bound exists because
     * the string is tenant-written and retained per package: up to
     * MAX_PACKAGES of them, each up to the 64 KiB manifest cap, held in the
     * result set, the DetectionEvent and the outbound payload - a memory
     * multiplier one tenant can drive into gigabytes.
     *
     * @var int
     */
    const VERSION_MAX_LENGTH = 256;

    /**
     * Decoded `<dir>/package.json`, or null when there is no usable manifest
     * there (absent, unreadable, oversized, not valid JSON).
     *
     * @param string $dir Directory holding the manifest, no trailing slash.
     *
     * @return array|null
     */
    public function read($dir)
    {
        return $this->load($dir . '/' . self::MANIFEST);
    }

    /**
     * Version declared by a manifest, or the unknown marker.
     *
     * JSON permits any type here, so a non-string (or empty) value is treated
     * as "not a version" rather than being passed on to the report, where a
     * consumer expects a string.
     *
     * @param array|null $manifest
     *
     * @return string
     */
    public function version($manifest)
    {
        if (!is_array($manifest)
            || !isset($manifest['version'])
            || !is_string($manifest['version'])
            || $manifest['version'] === ''
            || strlen($manifest['version']) > self::VERSION_MAX_LENGTH
            // Newlines and other control characters would let a manifest
            // forge lines in the text report or garble a terminal; no real
            // version carries them.
            || preg_match('/[[:cntrl:]]/', $manifest['version']) === 1
        ) {
            return DetectorInterface::UNKNOWN_VERSION;
        }

        return $manifest['version'];
    }

    /**
     * Package name declared by a manifest, or null when it does not carry a
     * usable one.
     *
     * @param array|null $manifest
     *
     * @return string|null
     */
    public function name($manifest)
    {
        if (!is_array($manifest) || !isset($manifest['name']) || !$this->isValidName($manifest['name'])) {
            return null;
        }

        return $manifest['name'];
    }

    /**
     * Is $name usable as an npm package name?
     *
     * A name reaching the report becomes a title in the SQLite `apps` table
     * and in the API payload, and - when it comes from a directory listing -
     * has already been a path component. Either way it is tenant-controlled,
     * so it is checked against the whitelist rather than sanitised.
     *
     * @param mixed $name
     *
     * @return bool
     */
    public function isValidName($name)
    {
        return is_string($name)
            && $name !== ''
            && strlen($name) <= self::NAME_MAX_LENGTH
            && preg_match(self::NAME_PATTERN, $name) === 1;
    }

    /**
     * Resolved $path, or null when it is not a directory or escapes $appRoot.
     *
     * The check is done on the resolved path, so an `npm link` / pnpm-store
     * symlink pointing at another tenant's tree is rejected while a workspace
     * symlink that stays inside the application is not.
     *
     * @param string $appRoot Application root, no trailing slash.
     * @param string $path    Candidate directory.
     *
     * @return string|null
     */
    public function containedDir($appRoot, $path)
    {
        $candidate = realpath($path);
        $realRoot  = realpath($appRoot);
        if ($candidate === false || $realRoot === false || !is_dir($candidate)) {
            return null;
        }
        // Trailing separator on both sides so a sibling directory sharing the
        // root's prefix (/home/app2 against /home/app) cannot pass. rtrim()
        // keeps a root of "/" from turning into the prefix "//", which no
        // descendant would match.
        if (strpos($candidate . '/', rtrim($realRoot, '/') . '/') !== 0) {
            return null;
        }

        return $candidate;
    }

    /**
     * @param string $path
     *
     * @return array|null
     */
    private function load($path)
    {
        Stats::incrementCountFilesReaded();
        $raw = Helper::getPartOfFile($path, self::MAX_BYTES);
        if ($raw === '') {
            return null;
        }
        $decoded = json_decode($raw, true);

        return is_array($decoded) ? $decoded : null;
    }
}
<?php
/**
 * ModxCoreDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class ModxCoreDetector.
 */
class ModxCoreDetector extends AbstractDetector
{
    const MODXEVO_CMS_DETECTOR_NAME = 'modxevo_core';
    const MODXREVO_CMS_DETECTOR_NAME = 'modxrevo_core';

    /**
     * Implements finding and extracting info(version and name).
     *
     * If something is found it return AppVersionDetector\Core\Detector\Version\DetectionEventData.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|array|null
     * @throws \Exception
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir = $splFileInfo->getPathname();

        if (!$this->isModx($dir)) {
            return null;
        }

        $result = [];

        $cmsVersion = $this->checkModxEvoVersion($dir);
        if ($cmsVersion !== null) {
            $result[] = new DetectionEvent($this, $splFileInfo,self::MODXEVO_CMS_DETECTOR_NAME, $cmsVersion);
        }

        $cmsVersion = $this->checkModxRevoVersion($dir);
        if ($cmsVersion !== null) {
            $result[] = new DetectionEvent($this, $splFileInfo,self::MODXREVO_CMS_DETECTOR_NAME, $cmsVersion);
        }

        return empty($result)
            ? null
            : $result;
    }

    /**
     * Tries to get a version of ModxRevo CMS.
     *
     * @param $dir
     * @return string|null
     */
    private function checkModxRevoVersion($dir)
    {
        $filepath = $dir . '/core/docs/version.inc.php';
        $revo_re = '~\$\w+\[\'version\'\]=\s*\'(\d+)\';\s*(?://\s*[^\n]+)?\s*\$\w+\[\'major_version\'\]=\s*\'(\d+)\';\s*(?://\s*[^\n]+)?\s*\$\w+\[\'minor_version\'\]=\s*\'(\d+)\';\s*(?://\s*[^\n]+)?\s*\$\w+\[\'patch_level\'\]=\s*\'(\w+)\';~msi';
        $tmp_ver = Helper::tryGetVersion($filepath, 2048, $revo_re);
        if ($tmp_ver !== '') {
            $version = $tmp_ver[1] . '.' . $tmp_ver[2] . '.' . $tmp_ver[3] . '-' . $tmp_ver[4];
            return $version;
        }
        
        return null;
    }

    /**
     * Tries to get a version of ModxRevo CMS.
     *
     * @param $dir
     * @return string|null
     */
    private function checkModxEvoVersion($dir)
    {
        $tmp_ver = Helper::tryGetVersion($dir . '/core/factory/version.php', 2048, '~\'version\'\s*=>\s*\'([^\']+)\',~msi');
        if ($tmp_ver !== '') {
            return $tmp_ver[1];
        }

        $tmp_ver = Helper::tryGetVersion($dir . '/manager/includes/version.inc.php', 2048, '~version\s*=\s*\'([^\']+)\';\s*~msi');
        if ($tmp_ver !== '') {
            return $tmp_ver[1];
        }
        return null;
    }

    /**
     *
     * Check what is Modx
     *
     * @param string $dir
     * @return boolean
     */
    private function isModx($dir)
    {
        if (file_exists($dir . '/core/model/modx/modx.class.php') || file_exists($dir . '/manager/processors/save_tmplvars.processor.php')) {
            return true;
        }
        return false;
    }
}<?php
/**
 * WpMuPluginDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

/**
 * Class WpMuPluginDetector.
 *
 * Detects WordPress must-use plugins (wp-content/mu-plugins/).
 *
 * Unlike regular plugins, MU plugins are .php files loaded directly by WordPress
 * from the top level of mu-plugins/ — no subdirectory convention, no Name header
 * requirement.  All top-level .php files are recorded:
 *   - Version:     read from the file header if present; "unknown" otherwise.
 *   - Plugin Name: read from the file header if present; filename (without .php) otherwise.
 *
 * Files inside subdirectories of mu-plugins/ are library code loaded by the top-level
 * loader files and are not reported.
 */
class WpMuPluginDetector extends WpComponentDetector
{
    protected $prefix            = 'wp_mu_plugin_';
    protected $components_folder = 'mu-plugins';
    protected $component_name    = 'Plugin';

    protected function isMainComponentFile($filename)
    {
        return (substr($filename, -4) == '.php');
    }

    /**
     * WordPress force-loads only the top-level .php files of mu-plugins/;
     * subdirectories hold library code loaded by those entry points and are
     * never loaded on their own. Never descend into them, so a nested file
     * cannot be reported even when it carries a Plugin Name header.
     */
    protected function shouldScanSubdirectories(): bool
    {
        return false;
    }

    /**
     * Must-use plugins are force-loaded by WordPress on every request and have no
     * activation toggle, so their presence in mu-plugins/ makes them active by
     * definition — a filesystem fact independent of the site database. Report
     * 'active' unconditionally without consulting the resolver (the resolver
     * argument is required by the base contract; its non-null presence is what
     * enables status stamping at all).
     */
    protected function resolveComponentStatus(WpActivationResolver $resolver, $wpRoot, $tenantUid, $componentFile)
    {
        return WpActivationResolver::STATUS_ACTIVE;
    }

    /**
     * MU-plugin status is a filesystem fact, not a database one, so it holds even
     * when activation checking is disabled (no resolver): a must-use plugin
     * present on disk is always loaded, hence always 'active'. Without this the
     * base class would leave the DetectionEvent 'unknown' default and contradict
     * DEF-47519.
     */
    protected function statusWithoutResolver()
    {
        return WpActivationResolver::STATUS_ACTIVE;
    }

    /**
     * Fall back to the filename (without .php) when no Plugin Name header is present.
     *
     * Subdirectory files are already excluded upstream by shouldScanSubdirectories(),
     * so $component_file is always a top-level name here. The path-separator guard is
     * kept as defence in depth: it returns an empty string (which the base skips) for
     * any nested path, so a nested file can never be named from its subdirectory.
     */
    protected function getNameFallback(string $component_file): string
    {
        if (strpos($component_file, '/') !== false) {
            return '';
        }
        // Strip only the trailing extension: a backup-then-rename artifact like
        // foo.php.bak.php must not collapse to foo.bak (str_replace removes every
        // '.php'), which would misname the file that is actually loaded.
        return preg_replace('/\.php$/', '', $component_file);
    }
}
<?php
/**
 * OpenCartCoreDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Detector\AppVersionDetector;
use AppVersionDetector\Detector\Exception;
use SplFileInfo;

/**
 * Class OpenCartCoreDetector.
 */
class OpenCartCoreDetector extends AbstractDetector
{
    /*
     * @var string Detector name
     */
    private $detector_name = 'opencart_core';

    /**
     * Implements finding and extracting info(version and name).
     *
     * If something is found it return AppVersionDetector\Core\Detector\Version\DetectionEventData.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|null
     * @throws \Exception
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir        = $splFileInfo->getPathname();
        $detected   = false;

        $detectionEvent = new DetectionEvent($this, $splFileInfo, $this->detector_name, DetectorInterface::UNKNOWN_VERSION);

        if (file_exists($dir . '/catalog')
            && file_exists($dir . '/system')
            && file_exists($dir . '/admin')
            && file_exists($dir . '/admin/config.php')
            && file_exists($dir . '/image')
            && file_exists($dir . '/index.php')
            && file_exists($dir . '/config.php')
        ) {
            $detected = true;
            $filepath = $dir . '/index.php';
            if (is_file($filepath)) {
                Stats::incrementCountFilesReaded();
                $tmp_content = Helper::getPartOfFile($filepath, 1024);
                if (preg_match('~define\(\'VERSION\',\s*\'(.+?)\'~smi', $tmp_content, $tmp_ver)) {
                    $detectionEvent->setVersion($tmp_ver[1]);
                }
            }
        }
        return $detected ? $detectionEvent : null;
    }
}<?php
/**
 * BitrixCoreDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class BitrixCoreDetector.
 */
class BitrixCoreDetector extends AbstractDetector
{
    const BITRIX_CMS_DETECTOR_NAME = 'bitrix_core';

    /**
     * Implements finding and extracting info(version and name).
     *
     * If something is found it return AppVersionDetector\Core\Detector\Version\DetectionEventData.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|array|null
     * @throws \Exception
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir = $splFileInfo->getPathname();

        if (!$this->isBitrix($dir)) {
            return null;
        }

        $result = [];

        $cmsVersion = $this->checkBitrixVersion($dir);
        if ($cmsVersion !== null) {
            $result[] = new DetectionEvent($this, $splFileInfo,self::BITRIX_CMS_DETECTOR_NAME, $cmsVersion);
        }

        return empty($result)
            ? new DetectionEvent($this, $splFileInfo,self::BITRIX_CMS_DETECTOR_NAME, DetectorInterface::UNKNOWN_VERSION)
            : $result;
    }

    /**
     * Tries to get a version of Bitrix CMS.
     *
     * @param $dir
     * @return string|null
     */
    private function checkBitrixVersion($dir)
    {
        $tmp_ver = Helper::tryGetVersion($dir . '/bitrix/modules/main/classes/general/version.php', 1024, '~define\("SM_VERSION",\s*"([^"]+)"\);~msi');
        if ($tmp_ver !== '') {
            return $tmp_ver[1];
        }
        return null;
    }

    /**
     *
     * Check what is Bitrix
     *
     * @param string $dir
     * @return boolean
     */
    private function isBitrix($dir)
    {
        if (file_exists($dir . '/bitrix/modules/main/start.php') && file_exists($dir . '/bitrix/modules/main/bx_root.php')) {
            return true;
        }
        return false;
    }
}<?php
/**
 * OsCommerceCoreDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class OsCommerceCoreDetector.
 */
class OsCommerceCoreDetector extends AbstractDetector
{

    private $detector_name = 'oscom_core';

    /**
     * Implements finding and extracting info(version and name).
     *
     * If something is found it return AppVersionDetector\Core\Detector\Version\DetectionEventData.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|array|null
     * @throws \Exception
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir = $splFileInfo->getPathname();
        $detected   = false;

        $detectionEvent = new DetectionEvent($this, $splFileInfo, $this->detector_name, DetectorInterface::UNKNOWN_VERSION);

        if ($this->isOsCom2x($dir)) {
            $detected = true;
            $tmp_ver = Helper::tryGetVersion($dir . '/includes/version.php', 1024, '~(.*)~');
            if ($tmp_ver !== '') {
                $version = $tmp_ver[1];
                $detectionEvent->setVersion($version);
            } else {
                $tmp_ver = Helper::tryGetVersion($dir . '/includes/application_top.php', 4096, '~define\(\'PROJECT_VERSION\',\s*\'[^\d]+([\w\.-]+)\'\);~msi');
                if ($tmp_ver !== '') {
                    $version = $tmp_ver[1];
                    $detectionEvent->setVersion($version);
                }
            }
        } else if ($this->isOsCom3x($dir)) {
            $detected = true;
            $tmp_ver = Helper::tryGetVersion($dir . '/osCommerce/OM/version.txt', 1024, '~(.*)~');
            if ($tmp_ver !== '') {
                $version = $tmp_ver[1];
                $detectionEvent->setVersion($version);
            }
        }

        return $detected ? $detectionEvent : null;
    }

    /**
     * Check is OsCommerce 2x
     *
     * @param string $dir
     * @return boolean
     */
    private function isOsCom2x($dir)
    {
        if (file_exists($dir . '/includes/configure.php')
            && (file_exists($dir . '/includes/boxes/shopping_cart.php') || file_exists($dir . '/includes/classes/osc_template.php'))
        ) {
            return true;
        }
        return false;
    }

    /**
     * Check is OsCommerce 3x
     *
     * @param string $dir
     * @return boolean
     */
    private function isOsCom3x($dir)
    {
        if (file_exists($dir . '/osCommerce/OM/Core/Site/Shop/Application/Index/Action/Manufacturers.php')
            && file_exists($dir . '/osCommerce/OM/Config/settings.ini')
        ) {
            return true;
        }
        return false;
    }
}<?php
/**
 * JoomlaCoreDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class JoomlaCoreDetector.
 */
class JoomlaCoreDetector extends AbstractDetector
{
    const JOOMLA_CMS_DETECTOR_NAME = 'joomla_core';
    const JOOMLA_PLATFORM_DETECTOR_NAME = 'joomla_platform';

    /**
     * Implements finding and extracting info(version and name).
     *
     * If something is found it return AppVersionDetector\Core\Detector\Version\DetectionEventData.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|array|null
     * @throws \Exception
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir = $splFileInfo->getPathname();

        if (!$this->isJoomla($dir)) {
            return null;
        }

        $result = [];

        $cmsVersion = $this->checkCmsVersion($dir);
        if ($cmsVersion !== null) {
            $result[] = new DetectionEvent($this, $splFileInfo,self::JOOMLA_CMS_DETECTOR_NAME, $cmsVersion);
        }

        $platformVersion = $this->checkPlatformVersion($dir);
        if ($platformVersion !== null) {
            $result[] = new DetectionEvent($this, $splFileInfo,self::JOOMLA_PLATFORM_DETECTOR_NAME, $platformVersion);
        }

        return empty($result)
            ? new DetectionEvent($this, $splFileInfo,self::JOOMLA_CMS_DETECTOR_NAME, DetectorInterface::UNKNOWN_VERSION)
            : $result;
    }

    /**
     * Tries to get a version of Joomla CMS.
     *
     * @param $dir
     * @return string|null
     */
    private function checkCmsVersion($dir)
    {
        // for 1.0.x
        $filepath = $dir . '/includes/version.php';
        if (file_exists($filepath) && is_file($filepath)) {
            Stats::incrementCountFilesReaded();
            $tmp_content = Helper::getPartOfFile($filepath, 8192);
            if (preg_match('|var\s+\$RELEASE\s*=\s*\'(.+?)\'|smi', $tmp_content, $tmp_ver)) {
                $version = $tmp_ver[1];
                
                if (preg_match('|var\s+\$DEV_LEVEL\s*=\s*\'(.+?)\'|smi', $tmp_content, $tmp_ver)) {
                    $version .= '.' . $tmp_ver[1];
                }

                return $version;
            }
        }

        // for 1.5.x
        $filepath = $dir . '/CHANGELOG.php';
        if (file_exists($filepath) && is_file($filepath)) {
            Stats::incrementCountFilesReaded();
            $tmp_content = Helper::getPartOfFile($filepath, 8192);
            if (preg_match('~-------------------- (\d+\.\d+\.\d+) ~smi', $tmp_content, $tmp_ver)) {
                return $tmp_ver[1];
            }
        }

        // for 2.5.x
        $filepath = $dir . '/joomla.xml';
        if (file_exists($filepath) && is_file($filepath)) {
            Stats::incrementCountFilesReaded();
            $tmp_content = Helper::getPartOfFile($filepath, 8192);
            if (preg_match('~<version>([\d.\-_a-z]+)</version>~smi', $tmp_content, $tmp_ver)) {
                return $tmp_ver[1];
            }
        }

        // for 3.x
        $filepath = $dir . '/administrator/manifests/files/joomla.xml';
        if (file_exists($filepath) && is_file($filepath)) {
            Stats::incrementCountFilesReaded();
            $tmp_content = Helper::getPartOfFile($filepath, 8192);
            if (preg_match('~<version>([\d.\-_a-z]+)</version>~smi', $tmp_content, $tmp_ver)) {
                return $tmp_ver[1];
            }
        }
        
        return null;
    }

    /**
     *
     * Check what is Joomla
     *
     * @param string $dir
     * @return boolean
     */
    private function isJoomla($dir)
    {
        // libraries/joomla exists in 1.5.x-3.x but was removed in 4.0; includes/joomla.php is 1.0.x.
        // administrator/manifests/files/joomla.xml is the core file manifest present since 3.x
        // (including 4.x/5.x/6.x), so it is required to recognize modern Joomla.
        if (file_exists($dir . '/libraries/joomla')
            || file_exists($dir . '/includes/joomla.php')
            || file_exists($dir . '/administrator/manifests/files/joomla.xml')
        ) {
            return true;
        }
        return false;
    }

    /**
     * Tries to get a version of Joomla Platform.
     *
     * @param string $dir
     * @return string|null
     */
    private function checkPlatformVersion(string $dir)
    {
        // for Joomla Platform
        $filepath = $dir . '/libraries/platform.php';
        if (!file_exists($filepath) || !is_file($filepath)) {
            return null;
        }
        Stats::incrementCountFilesReaded();
        $tmp_content = Helper::getPartOfFile($filepath, 8192);
        if (preg_match('~const\s+RELEASE\s+=\s+\'([\d.\-_a-z]+)\'~smi', $tmp_content, $tmp_ver)) {
            return $tmp_ver[1];
        }

        return null;
    }
}<?php
/**
 * DrupalCoreDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class DrupalCoreDetector.
 */
class DrupalCoreDetector extends AbstractDetector
{
    /*
     * @var string Detector name
     */
    
    private $detector_name = 'drupal_core';
    
    /**
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|array|null
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir            = $splFileInfo->getPathname();
        $detected       = false;
        $detectionEvent = new DetectionEvent($this, $splFileInfo, $this->detector_name, DetectorInterface::UNKNOWN_VERSION);
        
        $drupal_filepath = $dir . '/core/lib/Drupal.php';
        if (file_exists($drupal_filepath) && is_file($drupal_filepath)) {
            $detected = true;
            Stats::incrementCountFilesReaded();
            $tmp_content = Helper::getPartOfFile($drupal_filepath, 8192);
            if (preg_match('|VERSION\s*=\s*\'(\d+\.\d+\.\d+)\'|smi', $tmp_content, $tmp_ver)) {
                $detectionEvent->setVersion($tmp_ver[1]);
                return $detectionEvent;
            }
        }
        
        if (file_exists($dir . '/sites/all') 
            || file_exists($dir . '/sites/default')
            || file_exists($dir . '/modules/system.module')
        ) {
            $detected = true;

            $tmp_content = '';
            $possibleFiles = [
                $dir . '/CHANGELOG.txt', 
                $dir . '/CHANGELOG',
            ];
            foreach ($possibleFiles as $filepath) {
                if (!file_exists($filepath) || !is_file($filepath)) {
                    continue;
                }
                Stats::incrementCountFilesReaded();
                $tmp_content = Helper::getPartOfFile($filepath, 8192);
                break;
            }
            
            if ($tmp_content && preg_match('~Drupal\s+(\d+\.\d+[\d.]+)~smi', $tmp_content, $tmp_ver)) {
                $detectionEvent->setVersion($tmp_ver[1]);
                return $detectionEvent;
            }
        }

        $systeminfo_filepath = $dir . '/modules/system/system.info';
        if (file_exists($systeminfo_filepath) && is_file($systeminfo_filepath)) {
            $detected = true;
            Stats::incrementCountFilesReaded();
            $tmp_content = Helper::getPartOfFile($systeminfo_filepath, 8192);
            if (preg_match('|version\s*=\s*"(\d+\.\d+)"|smi', $tmp_content, $tmp_ver)) {
                $detectionEvent->setVersion($tmp_ver[1]);
                return $detectionEvent;
            }

        }
        
        return $detected ? $detectionEvent : null;
    }
}<?php
/**
 * WpContentDirResolver class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

/**
 * Resolves the effective WordPress content directory for a scanned install
 * (DEF-38597): WordPress lets admins relocate wp-content via
 * define('WP_CONTENT_DIR', ...) in wp-config.php, and plugins / themes /
 * mu-plugins all live under that directory.
 *
 * The wp-config.php is located the way WordPress core does (install root first,
 * parent directory only when the install-level file is absent and the parent is
 * not itself a WP install), parsed purely textually via WpConfigParser (never
 * executed), and the result is cached per install root so a scan reads each
 * wp-config.php at most once regardless of how many detectors ask.
 *
 * SECURITY: wp-config.php is tenant-controlled input. A custom directory is
 * honoured only when it exists and its realpath stays inside the realpath of
 * the install root — otherwise a tenant could point the root-run scanner at
 * another tenant's tree and corrupt detection attribution (same invariant as
 * the DEF-48257 containment check in WpComponentDetector). Anything absent,
 * unparseable, missing on disk or escaping the root falls back to the default
 * {root}/wp-content.
 */
class WpContentDirResolver
{
    /** @var WpConfigParser */
    private $configParser;

    /** @var array<string,string> Effective content dir, keyed by install root. */
    private $cache = [];

    /**
     * @param WpConfigParser|null $configParser
     */
    public function __construct(WpConfigParser $configParser = null)
    {
        $this->configParser = $configParser !== null ? $configParser : new WpConfigParser();
    }

    /**
     * Effective content directory for a WordPress install.
     *
     * Cached per install root: the plugin, theme and mu-plugin detectors share
     * one resolver instance (see DetectorBuilder) and each calls this from both
     * isWpBase() and the component listing, so the cache is what keeps the cost
     * at one wp-config.php read per install per scan.
     *
     * @param string $wpRoot WordPress install root.
     * @return string Absolute content dir path, without trailing slash;
     *                {root}/wp-content unless a valid custom dir is defined.
     */
    public function contentDir($wpRoot)
    {
        $wpRoot = rtrim($wpRoot, '/');
        if (!isset($this->cache[$wpRoot])) {
            $this->cache[$wpRoot] = $this->resolve($wpRoot);
        }
        return $this->cache[$wpRoot];
    }

    /**
     * @param string $wpRoot Install root, no trailing slash.
     * @return string
     */
    private function resolve($wpRoot)
    {
        $default    = $wpRoot . '/wp-content';
        $configPath = $this->locateConfig($wpRoot);
        if ($configPath === null) {
            return $default;
        }
        $candidate = $this->configParser->contentDirFromFile($configPath, $wpRoot);
        if ($candidate === null) {
            return $default;
        }
        $candidate = rtrim($candidate, '/');
        if ($candidate === '' || $candidate[0] !== '/') {
            return $default;
        }
        // Must exist as a directory (acceptance criterion) and must not escape
        // the install root once symlinks are resolved (see class doc). The
        // unresolved $candidate is returned — downstream reads keep their own
        // lstat / fd-based symlink defences on the real path components, and
        // WpComponentDetector re-checks containment at scan time.
        $real     = realpath($candidate);
        $realRoot = realpath($wpRoot);
        if ($real === false || $realRoot === false || !is_dir($real)) {
            return $default;
        }
        if (strpos($real . '/', $realRoot . '/') !== 0) {
            return $default;
        }
        return $candidate;
    }

    /**
     * Locate the wp-config.php the same way WordPress' wp-load.php does: the
     * install-level file wins whenever it exists; the parent directory's copy
     * is used only when the install-level file is ABSENT and the parent is not
     * itself a WP install (no wp-settings.php there). Mirrors
     * WpActivationResolver::resolve().
     *
     * @param string $wpRoot Install root, no trailing slash.
     * @return string|null
     */
    private function locateConfig($wpRoot)
    {
        $configPath = $wpRoot . '/wp-config.php';
        if (@file_exists($configPath)) {
            return $configPath;
        }
        $parentDir        = dirname($wpRoot);
        $parentConfigPath = $parentDir . '/wp-config.php';
        if ($parentConfigPath !== $configPath
            && @file_exists($parentConfigPath)
            && !@file_exists($parentDir . '/wp-settings.php')
        ) {
            return $parentConfigPath;
        }
        return null;
    }
}
<?php
/**
 * DrupalPluginDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class DrupalPluginDetector.
 */
class DrupalPluginDetector extends AbstractDetector
{
    private $prefix = 'drupal_plugin_';
    /**
     * Implements finding and extracting version.
     *
     * If something is found it return version as a string or array of strings.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return string|array|null
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir = $splFileInfo->getPathname();
        if (!$this->isDrupalBase($dir)) {
            return null;
        }
        $plugins_data   = [];
        $plugins        = array_merge(
            $this->drupalPluginList($dir . '/modules'),
            $this->drupalPluginList($dir . '/core/modules'),
            $this->drupalPluginList($dir . '/sites/all/modules')
        );
        foreach ($plugins as $plugin => $data) {
            $plugins_data[] = new DetectionEvent($this, $splFileInfo, $this->prefix . $plugin, $data['Version']);
        }
        return $plugins_data;
    }

    /**
     *
     * Check what is Drupal
     *
     * @param string $dir
     * @return boolean
     */
    private function isDrupalBase($dir)
    {
        if (is_dir($dir . '/modules')) {
            return true;
        }
        return false;
    }

    private function drupalPluginList($dir)
    {
        $drupal_plugins = [];
        $plugin_root    = $dir;
        if (!is_dir($plugin_root)) {
            return $drupal_plugins;
        }
        
        // Files in modules directory.
        Stats::incrementCountDirsOpened();
        $plugins_dir    = @opendir($plugin_root);
        $plugin_files   = [];
        if ($plugins_dir) {
            $plugins_dir_file_counter = 0;
            while ($plugins_dir_file_counter <= AbstractDetector::FILES_PER_DIR_LIMIT && ($file = readdir($plugins_dir)) !== false) {
                Stats::incrementCountFilesIteration();
                $plugins_dir_file_counter++;

                if (substr($file, 0, 1) == '.') {
                    continue;
                }

                $plugins_subdirpath = $plugin_root . '/' . $file;
                if (is_dir($plugins_subdirpath)) {
                    Stats::incrementCountDirsOpened();
                    $plugins_subdir = @opendir($plugins_subdirpath);
                    if ($plugins_subdir) {
                        $plugins_subdir_file_counter = 0;
                        while ($plugins_subdir_file_counter <= AbstractDetector::FILES_PER_DIR_LIMIT && ($subfile = readdir($plugins_subdir)) !== false) {
                            Stats::incrementCountFilesIteration();
                            $plugins_subdir_file_counter++;

                            if (substr($subfile, 0, 1) == '.') {
                                continue;
                            }

                            if (substr($subfile, -5) == '.info') {
                                $plugin_files[] = "$file/$subfile";
                            } elseif (substr($subfile, -9) == '.info.yml') {
                                $plugin_files[] = "$file/$subfile";
                            }
                        }
                        closedir($plugins_subdir);
                    }
                } else {
                    if (substr($file, -7) == '.module') {
                        $plugin_files[] = $file;
                    }
                }
            }
            closedir($plugins_dir);
        }
        if (empty($plugin_files)) {
            return $drupal_plugins;
        }

        foreach ($plugin_files as $plugin_file) {
            $filepath = $plugin_root . '/' . $plugin_file;
            if (!is_readable($filepath) || !is_file($filepath)) {
                continue;
            }
            $plugin_data = $this->getFileData($filepath);
            if (empty($plugin_data['Name'])) {
                continue;
            } elseif (empty($plugin_data['Version'])) {
                $plugin_data['Version'] = DetectorInterface::UNKNOWN_VERSION;
            }
            $package = $plugin_data['Name'];
            $drupal_plugins[$package] = $plugin_data;
        }
        return $drupal_plugins;
    }

    private function getFileData($file)
    {
        $plugin_name = $this->getPluginName($file);

        if (substr($file, -7) == '.module') {
            return [
                'Name'      => $plugin_name,
                'Version'   => DetectorInterface::UNKNOWN_VERSION
            ];
        } else {
            $info = [];
            Stats::incrementCountFilesReaded();
            $file_data = Helper::getPartOfFile($file, 8192);
            foreach (preg_split('/\r?\n/', $file_data) as $line) {
                if (!preg_match('/^\s*([^=:#;\[\]]+?)\s*[=:]\s*(.*)$/', $line, $m)) {
                    continue;
                }
                $value = rtrim($m[2]);
                $len = strlen($value);
                if ($len >= 2) {
                    $first = $value[0];
                    $last = $value[$len - 1];
                    if (($first === '"' && $last === '"') || ($first === "'" && $last === "'")) {
                        // PHP 7.x can return bool false from substr() when the
                        // requested slice is empty (e.g. value is exactly "" or
                        // ''). The (string) cast keeps the type contract
                        // string-only for the downstream consumer.
                        $value = (string) substr($value, 1, -1);
                    }
                }
                $info[$m[1]] = $value;
            }
            if (!isset($info['version'])) {
                $info['version'] = DetectorInterface::UNKNOWN_VERSION;
            }
            return [
                'Name'      => $plugin_name,
                'Version'   => $info['version']
            ];
        }
    }

    private function getPluginName($file)
    {
        if (substr($file, -7) == '.module') {
            $name = explode('/', substr($file, 0, -7));
            return array_pop($name);
        } else {
            $name = explode('/', $file);
            return $name[sizeof($name) - 2];
        }
    }
}
<?php
/**
 * WpPluginDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class WpPluginDetector.
 */
class WpPluginDetector extends WpComponentDetector
{
    protected $prefix               = 'wp_plugin_';
    protected $components_folder    = 'plugins';
    protected $component_name       = 'Plugin';
    
    protected function isMainComponentFile($filename)
    {
        return (substr($filename, -4) == '.php');
    }

    protected function resolveComponentStatus(WpActivationResolver $resolver, $wpRoot, $tenantUid, $componentFile)
    {
        // active_plugins stores plugin file paths exactly as $componentFile is built.
        return $resolver->pluginStatus($wpRoot, $tenantUid, $componentFile);
    }
}
<?php
/**
 * ForkingWpOptionsReader class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

/**
 * Privilege-dropping decorator for a WpOptionsReader.
 *
 * The scanner runs as root, but reading a tenant's WordPress database as root is
 * unsafe: a local MySQL superuser (e.g. root@localhost under unix_socket auth)
 * authenticates passwordlessly for an OS-root peer, so a crafted wp-config.php
 * could make the root process read any tenant's database. This decorator forks a
 * child, drops it to the site owner (supplementary groups + gid + uid, mirroring
 * the agent's safe_fileops drop), and runs the wrapped reader there — so the
 * connection authenticates as the tenant and is confined to that account's own
 * grants. The child returns the result over a socket pair and is then killed
 * without running PHP shutdown, so it never flushes/closes the parent's open
 * report database (WAL) or other inherited descriptors.
 *
 * Requires ext-pcntl and ext-posix. If either is missing the read is refused
 * (returns null -> 'unknown') rather than falling back to a root connection.
 */
class ForkingWpOptionsReader implements WpOptionsReader
{
    /** @var int Hard wallclock ceiling (seconds) for the child to return a result. */
    const READ_TIMEOUT_SEC = 60;

    /** @var int Max bytes accepted from the child before aborting (tenant-controlled data). */
    const MAX_RESULT_BYTES = 8388608; // 8 MiB

    /** @var WpOptionsReader */
    private $inner;

    public function __construct(WpOptionsReader $inner)
    {
        $this->inner = $inner;
    }

    public function readOptions(array $config, $tenantUid): ?array
    {
        if (!function_exists('pcntl_fork') || !function_exists('posix_setuid')) {
            return null;
        }

        $tenantUid = (int)$tenantUid;
        $pw = posix_getpwuid($tenantUid);
        if ($pw === false || (int)$pw['uid'] === 0) {
            // Unknown user, or root — never read a tenant DB as root.
            return null;
        }

        $pair = stream_socket_pair(STREAM_PF_UNIX, STREAM_SOCK_STREAM, STREAM_IPPROTO_IP);
        if ($pair === false) {
            return null;
        }
        list($parentSock, $childSock) = $pair;

        $pid = pcntl_fork();
        if ($pid === -1) {
            fclose($parentSock);
            fclose($childSock);
            return null;
        }

        if ($pid === 0) {
            $this->runChild($childSock, $config, $tenantUid, $pw);
            // unreachable: runChild() terminates the child.
        }

        fclose($childSock);
        $data       = '';
        $aborted    = false;
        $deadline   = microtime(true) + self::READ_TIMEOUT_SEC;
        stream_set_blocking($parentSock, false);
        while (!feof($parentSock)) {
            $remaining = $deadline - microtime(true);
            if ($remaining <= 0) {
                // Hard wallclock ceiling: a slow/broken tenant DB (DNS stall,
                // slow-drip stream) must not wedge the whole scan indefinitely.
                $aborted = true;
                break;
            }
            $read   = [$parentSock];
            $write  = null;
            $except = null;
            $sec    = (int)$remaining;
            $usec   = (int)(($remaining - $sec) * 1e6);
            $ready  = @stream_select($read, $write, $except, $sec, $usec);
            if ($ready === false) {
                $aborted = true;
                break;
            }
            if ($ready === 0) {
                continue; // nothing readable yet; the deadline is re-checked at loop top
            }
            $chunk = fread($parentSock, 65536);
            if ($chunk === false || $chunk === '') {
                if (feof($parentSock)) {
                    break;
                }
                continue;
            }
            $data .= $chunk;
            if (strlen($data) > self::MAX_RESULT_BYTES) {
                // Tenant owns wp_options and can bloat a row to hundreds of MB;
                // never accumulate it unbounded in the root parent.
                $aborted = true;
                break;
            }
        }
        fclose($parentSock);

        if ($aborted) {
            // The child may still be blocked or streaming; kill it so the scan
            // proceeds, reap it, and discard any partial payload.
            @posix_kill($pid, SIGKILL);
            pcntl_waitpid($pid, $status);
            return null;
        }
        pcntl_waitpid($pid, $status);

        if ($data === '') {
            return null;
        }
        $decoded = @unserialize($data, ['allowed_classes' => false]);
        return is_array($decoded) ? $decoded : null;
    }

    /**
     * Runs in the forked child: drops to the tenant, delegates to the inner reader,
     * writes the serialized result to the pipe, then terminates hard so no PHP
     * shutdown handler touches the parent's inherited descriptors / SQLite WAL.
     *
     * @param resource $childSock
     * @param array $config
     * @param int $tenantUid
     * @param array $pw posix_getpwuid() entry for $tenantUid
     * @return void
     */
    private function runChild($childSock, array $config, $tenantUid, array $pw)
    {
        $result = null;
        if ($this->dropPrivileges($tenantUid, $pw)) {
            $result = $this->inner->readOptions($config, $tenantUid);
        }
        @fwrite($childSock, serialize($result));
        @fflush($childSock);
        @fclose($childSock);
        posix_kill(posix_getpid(), SIGKILL);
    }

    /**
     * Drop supplementary groups, gid and uid to the tenant, in that order (gid and
     * groups must change while still privileged).
     *
     * @param int $tenantUid
     * @param array $pw
     * @return bool True only if the process is now running as exactly $tenantUid.
     */
    private function dropPrivileges($tenantUid, array $pw)
    {
        if (!posix_initgroups($pw['name'], (int)$pw['gid'])) {
            return false;
        }
        if (!posix_setgid((int)$pw['gid'])) {
            return false;
        }
        if (!posix_setuid($tenantUid)) {
            return false;
        }
        return posix_getuid() === $tenantUid && posix_geteuid() === $tenantUid;
    }
}
<?php
/**
 * WpActivationResolver class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

/**
 * Resolves the activation status (active / inactive / multisite / unknown) of
 * WordPress plugins and themes for a scanned install.
 *
 * Per install (cached, keyed by the wp-config.php path and tenant uid) it: reads wp-config.php
 * only when it is a tenant-owned regular file, parses the connection settings,
 * short-circuits to 'multisite' without any DB access when MULTISITE is set,
 * otherwise reads the relevant wp_options rows once and reuses them for both the
 * plugin and theme detectors. Any parse/DB failure falls back to 'unknown'.
 *
 * SECURITY: active_plugins is decoded with unserialize(..., ['allowed_classes' =>
 * false]) so an attacker-controlled option value cannot instantiate objects.
 */
class WpActivationResolver
{
    const STATUS_ACTIVE    = 'active';
    const STATUS_INACTIVE  = 'inactive';
    const STATUS_MULTISITE = 'multisite';
    const STATUS_UNKNOWN   = 'unknown';

    const MODE_MULTISITE = 'multisite';
    const MODE_UNKNOWN   = 'unknown';
    const MODE_RESOLVED  = 'resolved';

    /** @var WpConfigParser */
    private $configParser;

    /** @var WpOptionsReader */
    private $optionsReader;

    /** @var array Resolved per-install state, keyed by "wp-config.php path|tenant uid". */
    private $cache = [];

    public function __construct(WpConfigParser $configParser, WpOptionsReader $optionsReader)
    {
        $this->configParser  = $configParser;
        $this->optionsReader = $optionsReader;
    }

    /**
     * @param string $wpRoot     WordPress install root (directory holding wp-config.php).
     * @param int    $tenantUid  uid the install belongs to.
     * @param string $pluginFile active_plugins-style path, e.g. 'akismet/akismet.php' or 'hello.php'.
     * @return string One of the STATUS_* values.
     */
    public function pluginStatus($wpRoot, $tenantUid, $pluginFile)
    {
        $state = $this->resolve($wpRoot, $tenantUid);
        if ($state['mode'] !== self::MODE_RESOLVED) {
            return $this->markerStatus($state['mode']);
        }
        if ($state['active_plugins'] === null) {
            return self::STATUS_UNKNOWN;
        }
        return in_array($pluginFile, $state['active_plugins'], true)
            ? self::STATUS_ACTIVE
            : self::STATUS_INACTIVE;
    }

    /**
     * @param string $wpRoot    WordPress install root.
     * @param int    $tenantUid uid the install belongs to.
     * @param string $themeDir  theme directory name, e.g. 'twentytwentyfour'.
     * @return string One of the STATUS_* values.
     */
    public function themeStatus($wpRoot, $tenantUid, $themeDir)
    {
        $state = $this->resolve($wpRoot, $tenantUid);
        if ($state['mode'] !== self::MODE_RESOLVED) {
            return $this->markerStatus($state['mode']);
        }
        if ($state['stylesheet'] === null && $state['template'] === null) {
            return self::STATUS_UNKNOWN;
        }
        return ($themeDir === $state['stylesheet'] || $themeDir === $state['template'])
            ? self::STATUS_ACTIVE
            : self::STATUS_INACTIVE;
    }

    /**
     * @param string $mode One of the MODE_* markers (not MODE_RESOLVED).
     * @return string
     */
    private function markerStatus($mode)
    {
        return $mode === self::MODE_MULTISITE ? self::STATUS_MULTISITE : self::STATUS_UNKNOWN;
    }

    /**
     * Resolve and cache the per-install state.
     *
     * @param string $wpRoot
     * @param int    $tenantUid
     * @return array {mode, active_plugins: ?array, stylesheet: ?string, template: ?string}
     */
    private function resolve($wpRoot, $tenantUid)
    {
        $wpRoot       = rtrim($wpRoot, '/');
        $wpConfigPath = $wpRoot . '/wp-config.php';
        // Key the cache by tenant uid as well as path: parseFile() and the forked
        // DB read are gated on $tenantUid, and the plugin vs theme passes can
        // derive different uids (owner of wp-content/plugins vs wp-content/themes,
        // DEF-42618/42619). A path-only key would serve a result computed under one
        // uid to a lookup under another — e.g. cache 'unknown' from a uid that
        // cannot read wp-config.php and never retry with the uid that can.
        $cacheKey = $wpConfigPath . '|' . $tenantUid;
        if (isset($this->cache[$cacheKey])) {
            return $this->cache[$cacheKey];
        }

        $state = [
            'mode'           => self::MODE_UNKNOWN,
            'active_plugins' => null,
            'stylesheet'     => null,
            'template'       => null,
        ];

        // Read wp-config.php only when it is a regular file owned by the install's
        // tenant. The ownership check rides on the same descriptor that is read
        // (Helper::getPartOfFile $requireUid), so swapping the path to a symlink
        // to another tenant's file after a check cannot redirect the read.
        $config = $this->configParser->parseFile($wpConfigPath, $tenantUid);
        if ($config === null && !@file_exists($wpConfigPath)) {
            // WordPress' own wp-load.php fallback: hardened shared-hosting layouts
            // keep wp-config.php one directory above the docroot. Mirror core — use
            // the parent copy only when the install-level file is ABSENT (core
            // checks file_exists(ABSPATH.'wp-config.php') first), and only when the
            // parent is not itself a WP install (no wp-settings.php there), with the
            // same ownership / regular-file guard. An install-level file that exists
            // but fails to parse must NOT fall back — doing so would connect to a
            // different database and report the wrong activation status.
            $parentDir        = dirname($wpRoot);
            $parentConfigPath = $parentDir . '/wp-config.php';
            if ($parentConfigPath !== $wpConfigPath && !@file_exists($parentDir . '/wp-settings.php')) {
                $config = $this->configParser->parseFile($parentConfigPath, $tenantUid);
            }
        }
        if ($config === null) {
            return $this->cache[$cacheKey] = $state;
        }

        if (!empty($config['multisite'])) {
            $state['mode'] = self::MODE_MULTISITE;
            return $this->cache[$cacheKey] = $state;
        }

        $options = $this->optionsReader->readOptions($config, $tenantUid);
        if ($options === null) {
            return $this->cache[$cacheKey] = $state;
        }

        $state['mode']           = self::MODE_RESOLVED;
        $state['active_plugins'] = $this->decodeActivePlugins(isset($options['active_plugins']) ? $options['active_plugins'] : null);
        $state['stylesheet']     = $this->nonEmptyString(isset($options['stylesheet']) ? $options['stylesheet'] : null);
        $state['template']       = $this->nonEmptyString(isset($options['template']) ? $options['template'] : null);

        return $this->cache[$cacheKey] = $state;
    }

    /**
     * Decode the active_plugins option into a list of plugin file paths.
     * Returns null when the value is missing or not a serialized array.
     *
     * @param string|null $raw
     * @return array|null
     */
    private function decodeActivePlugins($raw)
    {
        if (!is_string($raw) || $raw === '') {
            return null;
        }
        $decoded = @unserialize($raw, ['allowed_classes' => false]);
        if (!is_array($decoded)) {
            return null;
        }
        $plugins = [];
        foreach ($decoded as $value) {
            if (is_string($value)) {
                $plugins[] = $value;
            }
        }
        return $plugins;
    }

    /**
     * @param mixed $value
     * @return string|null Non-empty string, or null.
     */
    private function nonEmptyString($value)
    {
        return (is_string($value) && $value !== '') ? $value : null;
    }
}
<?php
/**
 * WpConfigParser class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Helper;

/**
 * Statically extracts the database connection settings, table prefix and the
 * MULTISITE flag from a WordPress wp-config.php.
 *
 * SECURITY: wp-config.php is tenant-controlled PHP. It is parsed purely as text
 * (regular expressions over a bounded read) and is NEVER included, eval'd or
 * otherwise executed. Extracted credentials live only in the returned array; callers
 * must never log them, place them in exception messages, or serialize them.
 */
class WpConfigParser
{
    /**
     * Upper bound on how much of wp-config.php is read. The DB defines and
     * $table_prefix sit near the top of the file; this caps the work a tenant can
     * force by padding the file.
     */
    const MAX_READ_BYTES = 65536;

    /**
     * Parse a wp-config.php from disk.
     *
     * The read is byte-bounded and only succeeds on a regular file (see
     * Helper::getPartOfFile, which also defeats a regular-file -> symlink swap).
     * When $requireUid is given, the file is read only if the opened descriptor is
     * owned by that uid; the ownership check and the read share one fd, so they
     * cannot be split by a path swap.
     *
     * @param string $path
     * @param int|null $requireUid Owner uid the file must have, or null to skip the check.
     * @return array|null Parsed settings, or null when they cannot be determined.
     */
    public function parseFile($path, $requireUid = null)
    {
        $content = Helper::getPartOfFile($path, self::MAX_READ_BYTES, 0, $requireUid);
        if ($content === '') {
            return null;
        }
        return $this->parse($content);
    }

    /**
     * Parse wp-config.php content.
     *
     * @param string $content
     * @return array|null [
     *     'db_name', 'db_user', 'db_password', 'db_host' => string,
     *     'table_prefix' => string matching [A-Za-z0-9_]+,
     *     'multisite' => bool
     * ], or null when any required value is missing or unparseable.
     */
    public function parse($content)
    {
        $content = $this->stripLineComments($content);

        $dbName      = $this->extractDefineValue($content, 'DB_NAME');
        $dbUser      = $this->extractDefineValue($content, 'DB_USER');
        $dbPassword  = $this->extractDefineValue($content, 'DB_PASSWORD');
        $dbHost      = $this->extractDefineValue($content, 'DB_HOST');
        $tablePrefix = $this->extractTablePrefix($content);

        if ($dbName === null || $dbUser === null || $dbPassword === null
            || $dbHost === null || $tablePrefix === null
        ) {
            return null;
        }

        return [
            'db_name'      => $dbName,
            'db_user'      => $dbUser,
            'db_password'  => $dbPassword,
            'db_host'      => $dbHost,
            'table_prefix' => $tablePrefix,
            'multisite'    => $this->isMultisite($content),
        ];
    }

    /**
     * Drop comment-only lines so a commented-out define cannot shadow the real one,
     * while preserving a real define that merely follows a leading same-line block
     * comment (e.g. "/* prod creds *&#47; define('DB_PASSWORD', '...');").
     *
     * The leading "/* ... *&#47;" span(s) are stripped first, then the line is
     * dropped only if what remains is itself a comment. A block comment that does
     * not close on the same line stays intact and is dropped here — the known
     * cross-line best-effort gap (those configs fall back to 'unknown' anyway).
     *
     * @param string $content
     * @return string
     */
    private function stripLineComments($content)
    {
        $kept = [];
        foreach (preg_split('/\R/', $content) as $line) {
            // Strip one or more leading, same-line block comments so an inline
            // "/* ... *&#47; define(...)" keeps its define.
            $line    = preg_replace('/^(?:\s*\/\*.*?\*\/)+\s*/', '', $line);
            $trimmed = ltrim($line);
            if ($trimmed === '') {
                continue;
            }
            $two = substr($trimmed, 0, 2);
            if ($trimmed[0] === '#' || $trimmed[0] === '*' || $two === '//' || $two === '/*') {
                continue;
            }
            $kept[] = $line;
        }
        return implode("\n", $kept);
    }

    /**
     * Extract the string value of define('NAME', 'value'). Name and value must each
     * be wrapped in a matching pair of single or double quotes.
     *
     * @param string $content
     * @param string $const
     * @return string|null
     */
    private function extractDefineValue($content, $const)
    {
        $pattern = '/\bdefine\s*\(\s*([\'"])' . preg_quote($const, '/') . '\1\s*,\s*([\'"])(.*?)\2\s*\)/';
        if (preg_match($pattern, $content, $m)) {
            return $m[3];
        }
        return null;
    }

    /**
     * Extract $table_prefix, accepting only a bare SQL identifier ([A-Za-z0-9_]+).
     * Anything else (quotes, whitespace, SQL meta-characters) yields null so an
     * attacker-chosen prefix can never reach a query as an unsafe table name.
     *
     * @param string $content
     * @return string|null
     */
    private function extractTablePrefix($content)
    {
        if (preg_match('/\$table_prefix\s*=\s*([\'"])([A-Za-z0-9_]+)\1\s*;/', $content, $m)) {
            return $m[2];
        }
        return null;
    }

    /**
     * @param string $content
     * @return bool True when MULTISITE is defined truthy OR defined with a value we
     *              cannot statically resolve. Only an explicit falsy literal (or no
     *              MULTISITE define at all) yields false.
     */
    private function isMultisite($content)
    {
        if (!preg_match('/\bdefine\s*\(\s*([\'"])MULTISITE\1\s*,\s*([^),]*)\)/', $content, $m)) {
            return false; // MULTISITE not defined -> single site
        }
        $value = strtolower(trim($m[2], " \t'\""));
        if ($value === 'true' || $value === '1') {
            return true;
        }
        if ($value === 'false' || $value === '0' || $value === '') {
            return false;
        }
        // Indirect / non-literal value (a constant, getenv(), filter_var(), a
        // ternary, ...): we cannot evaluate it statically. Err toward multisite so
        // the resolver does not read a possibly-multisite install via the single-
        // site path and hand back misleading per-plugin activation statuses.
        return true;
    }

    /**
     * Read a wp-config.php and textually resolve its WP_CONTENT_DIR constant
     * (DEF-38597). Same bounded, symlink-safe read as parseFile(); the file is
     * never executed. No uid requirement: unlike the DB-credential path this runs
     * before the tenant uid is known, and the result is only a directory
     * candidate that the caller (WpContentDirResolver) still validates against
     * the install root before use.
     *
     * @param string $path   wp-config.php path.
     * @param string $wpRoot WordPress install root (ABSPATH, textually).
     * @return string|null Unvalidated absolute path candidate, or null when
     *                     WP_CONTENT_DIR is absent or not statically resolvable.
     */
    public function contentDirFromFile($path, $wpRoot)
    {
        $content = Helper::getPartOfFile($path, self::MAX_READ_BYTES);
        if ($content === '') {
            return null;
        }
        return $this->extractContentDir($content, dirname($path), $wpRoot);
    }

    /**
     * Extract define('WP_CONTENT_DIR', <expr>) from wp-config.php content and
     * resolve the supported value forms textually:
     *
     *   define('WP_CONTENT_DIR', '/abs/path')                     (single/double quotes)
     *   define('WP_CONTENT_DIR', dirname(__FILE__) . '/app')
     *   define('WP_CONTENT_DIR', __DIR__ . '/app')
     *   define('WP_CONTENT_DIR', ABSPATH . 'app')
     *
     * Arbitrary whitespace (including newlines) is tolerated; commented-out
     * defines are dropped by the same stripLineComments() used for the DB
     * settings. Any other value shape yields null (caller falls back to the
     * default wp-content).
     *
     * @param string $content   wp-config.php content.
     * @param string $configDir Directory holding the wp-config.php (dirname(__FILE__) / __DIR__).
     * @param string $wpRoot    WordPress install root (ABSPATH).
     * @return string|null Unvalidated absolute path candidate, or null.
     */
    public function extractContentDir($content, $configDir, $wpRoot)
    {
        $content = $this->stripLineComments($content);
        $pattern = '/\bdefine\s*\(\s*([\'"])WP_CONTENT_DIR\1\s*,\s*(.*?)\s*\)\s*;/s';
        if (!preg_match($pattern, $content, $m)) {
            return null;
        }
        return $this->resolveContentDirExpression($m[2], rtrim($configDir, '/'), rtrim($wpRoot, '/'));
    }

    /**
     * @param string $expr      The raw value expression from the define().
     * @param string $configDir No trailing slash.
     * @param string $wpRoot    No trailing slash.
     * @return string|null
     */
    private function resolveContentDirExpression($expr, $configDir, $wpRoot)
    {
        // Quoted absolute-path literal. A relative literal would be resolved by
        // PHP against an unknowable cwd, so it is not accepted.
        if (preg_match('/^([\'"])(\/[^\'"]*)\1$/', $expr, $m)) {
            return $m[2];
        }
        // dirname(__FILE__) . '/x'  |  __DIR__ . '/x'  -> relative to the config dir.
        if (preg_match('/^(?:dirname\s*\(\s*__FILE__\s*\)|__DIR__)\s*\.\s*([\'"])([^\'"]*)\1$/', $expr, $m)) {
            return $configDir . '/' . ltrim($m[2], '/');
        }
        // ABSPATH . 'x' -> relative to the install root.
        if (preg_match('/^ABSPATH\s*\.\s*([\'"])([^\'"]*)\1$/', $expr, $m)) {
            return $wpRoot . '/' . ltrim($m[2], '/');
        }
        return null;
    }
}
<?php
/**
 * IPBCoreDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class IPBCoreDetector.
 */
class IPBCoreDetector extends AbstractDetector
{

    private $detector_name = 'ipb_core';

    /**
     * Implements finding and extracting info(version and name).
     *
     * If something is found it return AppVersionDetector\Core\Detector\Version\DetectionEventData.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|array|null
     * @throws \Exception
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir = $splFileInfo->getPathname();
        $detected   = false;

        $detectionEvent = new DetectionEvent($this, $splFileInfo, $this->detector_name, DetectorInterface::UNKNOWN_VERSION);

        if ($this->isIPB1x2x($dir)) {
            $detected = true;
            $tmp_ver = Helper::tryGetVersion($dir . '/index.php', 8192, '~var\s*\$version\s*=\s*["\']([^\'"]+)["\'];~');
            if ($tmp_ver !== '') {
                $version = str_replace('v', '', $tmp_ver[1]);
                $version = explode(' ', $version);
                $version = $version[0];
                $detectionEvent->setVersion($version);
            }
        } else if ($this->isIPB3x($dir)) {
            $detected = true;
            $tmp_ver = Helper::tryGetVersion($dir . '/admin/applications/core/xml/versions.xml', 100, '~(?:<version>\s*\s*<human>([^<]+)</human>\s*<long>\d+</long>\s*</version>\s*)+~msi', -100);
            if ($tmp_ver !== '') {
                $version = $tmp_ver[1];
                $detectionEvent->setVersion($version);
            }
        } else if ($this->isIPB4x($dir)) {
            $detected = true;
            $tmp_ver = Helper::tryGetVersion($dir . '/applications/core/data/versions.json', 100, '~(?:"\d+":\s*"([^"]+)",?\s*)+~msi', -100);
            if ($tmp_ver !== '') {
                $version = $tmp_ver[1];
                $detectionEvent->setVersion($version);
            }
        }

        return $detected ? $detectionEvent : null;
    }

    /**
     * Check is IPB 1x-2x
     *
     * @param string $dir
     * @return boolean
     */
    private function isIPB1x2x($dir)
    {
        if (file_exists($dir . '/ipchat.php') && file_exists($dir . '/modules/ipb_member_sync.php')
            && file_exists($dir . '/sources')
        ) {
            return true;
        }
        return false;
    }

    /**
     * Check is IPB 3x
     *
     * @param string $dir
     * @return boolean
     */
    private function isIPB3x($dir)
    {
        if (file_exists($dir . '/initdata.php') && file_exists($dir . '/interface/ips.php')
            && file_exists($dir . '/hooks')
        ) {
            return true;
        }
        return false;
    }

    /**
     * Check is IPB 4x
     *
     * @param string $dir
     * @return boolean
     */
    private function isIPB4x($dir)
    {
        if (file_exists($dir . '/init.php') && file_exists($dir . '/applications/core/interface')
            && file_exists($dir . '/system')
        ) {
            return true;
        }
        return false;
    }
}<?php
/**
 * NodeJsPackageDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Helper;
use AppVersionDetector\Application\Stats;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class NodeJsPackageDetector.
 *
 * Reports what is installed: the detector walks the `node_modules` tree and
 * reports every package directory it finds, at the version that package's own
 * manifest declares.
 *
 * The application's `package.json` is deliberately not used as the list. A
 * manifest says what was asked for, in ranges; the tree says what is there, in
 * exact versions, and the two routinely differ. Everything present but
 * undeclared - the transitive closure npm hoisted (typically 20-30x the direct
 * dependencies), a package left behind by `npm uninstall`, something dropped
 * in by hand - is code on the tenant's disk, and a version that only exists as
 * a nested copy is exactly the false negative a vulnerability scan cannot
 * afford.
 *
 * Runs only where NodeJsAppDetector fired (DependencyCollectionDetector), and
 * is the only thing that reads inside `node_modules`: Scanner never descends
 * into it, so the whole cost of the tree is bounded here - results by
 * MAX_PACKAGES, work by MAX_DIRS_WALKED, depth by MAX_NESTING.
 */
class NodeJsPackageDetector extends AbstractDetector
{
    /**
     * @var string Prefix of a reported dependency title.
     */
    const PREFIX = 'nodejs_pkg_';

    /**
     * Packages reported per application before the walk gives up.
     *
     * A tenant can create directories faster than a scan can read them, so
     * the walk is bounded rather than open-ended - the trade the rest of the
     * scanner makes with FILES_PER_DIR_LIMIT. The cap is set well above any
     * real tree (a large front-end application lands around 1500) so that
     * hitting it means the tree is not a genuine install.
     *
     * @var int
     */
    const MAX_PACKAGES = 10000;

    /**
     * Levels of nested `node_modules` the walk follows.
     *
     * npm hoists, so real nesting is shallow; legacy npm-3-era trees go deeper
     * but nowhere near this. The limit stops a symlink-free directory bomb
     * from turning the walk into an unbounded descent.
     *
     * @var int
     */
    const MAX_NESTING = 16;

    /**
     * Raw directory entries examined per directory.
     *
     * Distinct from MAX_PACKAGES, which counts entries kept: a directory
     * filled with dot-entries produces no packages, so only a bound on the
     * loop itself stops it.
     *
     * @var int
     */
    const MAX_ENTRIES_SCANNED = 100000;

    /**
     * Package directories the walk visits per application before it gives up.
     *
     * MAX_PACKAGES bounds distinct *results*, and results are deduplicated by
     * name+version - so a tree in which every manifest repeats the same
     * name@version keeps that counter at 1 while the walk visits every
     * directory, paying a realpath() and a manifest read for each. This bound
     * counts visits, independent of what they yield, and is what actually
     * caps the work (and the size of $seen). Set above MAX_PACKAGES so a
     * genuine tree is never cut by it.
     *
     * @var int
     */
    const MAX_DIRS_WALKED = 20000;

    /**
     * Raw readdir() results examined across the whole application, all
     * listings together. MAX_ENTRIES_SCANNED bounds one listing and
     * MAX_DIRS_WALKED bounds the package directories that reach collect(),
     * but a listing that yields no package - an empty node_modules, a store
     * entry holding only another `.pnpm`, a directory of dot-entries - costs
     * neither, so a tenant could chain them up to MAX_NESTING and make the
     * root scan read directories for as long as it liked. Every readdir()
     * now spends from this budget, and the walk stops when it is gone.
     */
    const MAX_ENTRIES_TOTAL = 1000000;

    /**
     * @var string pnpm's flat package store inside node_modules.
     */
    const PNPM_STORE_DIR = '.pnpm';

    /**
     * @var PackageJsonReader
     */
    private $reader;

    /**
     * @var int Package directories visited by the current perform(); see MAX_DIRS_WALKED.
     */
    private $dirsWalked = 0;

    /**
     * @var int Raw readdir() results examined so far in this application.
     */
    private $entriesScanned = 0;

    /**
     * @param PackageJsonReader $reader
     */
    public function __construct(PackageJsonReader $reader)
    {
        $this->reader = $reader;
    }

    /**
     * @param SplFileInfo $splFileInfo
     *
     * @return DetectionEvent[]|null
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $appRoot = $splFileInfo->getPathname();
        if (!is_dir($appRoot . '/' . Helper::NODE_MODULES_DIR)) {
            return null;
        }

        // Keyed by name+version: the same package at the same version installed
        // in two places is one fact about the tree, not two. Distinct versions
        // of one name are kept - both copies are on disk.
        $found = [];
        $seen  = [];
        $this->dirsWalked     = 0;
        $this->entriesScanned = 0;
        $this->walk($appRoot, $appRoot, 0, $found, $seen);

        $events = [];
        foreach ($found as $package) {
            $events[] = new DetectionEvent(
                $this,
                $splFileInfo,
                self::PREFIX . $package['name'],
                $package['version']
            );
        }

        return $events;
    }

    /**
     * Enumerate `<parent>/node_modules`, recording every package directory and
     * recursing into the nested `node_modules` each one may carry.
     *
     * A node_modules is walked at most once per scan of an application. The
     * caps do not make that redundant: MAX_NESTING bounds depth and
     * MAX_PACKAGES bounds distinct *results*, while a cycle -
     * `node_modules/<pkg>/node_modules -> node_modules`, which containedDir()
     * accepts because it stays inside the application - revisits directories
     * that add nothing to the result set. The counters then stand still while
     * the recursion keeps branching, which is O(b^MAX_NESTING) enumerations
     * for branching factor b. Keying on the resolved path bounds the walk by
     * the directories that exist rather than by the paths that reach them.
     *
     * @param string $parent  Directory holding the node_modules to enumerate.
     * @param string $appRoot Application root; nothing outside it is read.
     * @param int    $depth   Current nesting level.
     * @param array  $found   Accumulator, keyed by "name\0version".
     * @param array  $seen    Resolved node_modules paths already walked.
     */
    private function walk($parent, $appRoot, $depth, array &$found, array &$seen)
    {
        if ($depth >= self::MAX_NESTING
            || count($found) >= static::MAX_PACKAGES
            || $this->budgetSpent()
        ) {
            return;
        }
        // Contained before it is opened: `pkg/node_modules -> /home/victim`
        // would otherwise be opendir()ed as root. Nothing inside could be
        // reported (collect() bounds-checks every entry), but the listing
        // itself should not happen.
        $modules = $this->reader->containedDir($appRoot, $parent . '/' . Helper::NODE_MODULES_DIR);
        if ($modules === null || isset($seen[$modules])) {
            return;
        }
        $seen[$modules] = true;

        // pnpm keeps every package in a flat store under `.pnpm`, symlinking
        // only the direct dependencies to the top level. The store is a
        // dot-entry, so entries() drops it, and a package's peers live in a
        // sibling store directory rather than in a nested node_modules - so
        // without this the walk sees the direct dependencies and nothing else,
        // which is precisely the transitive blind spot this detector exists to
        // close. Each `.pnpm/<name>@<ver>` holds its own node_modules, which
        // is what walk() enumerates; $seen keeps the cost bounded.
        $store = $this->reader->containedDir($appRoot, $modules . '/' . self::PNPM_STORE_DIR);
        if ($store !== null) {
            // No MAX_PACKAGES check in the enumeration loops: it lives in
            // collect(), the one place $found grows - see the comment there.
            // The directory budget is different: collect() spends it, so once
            // it is gone every loop that would call collect() again stops -
            // otherwise a store whose manifests all dedupe to one result keeps
            // opening and listing directories long after the cap.
            // The readdir() budget is deliberately NOT checked here: the names
            // entries() returned were paid for and must still be collected;
            // what must not happen is another listing, and walk() refuses that
            // on entry through budgetSpent().
            foreach ($this->entries($store) as $entry) {
                if ($this->dirsWalked >= static::MAX_DIRS_WALKED) {
                    break;
                }
                $this->walk($store . '/' . $entry, $appRoot, $depth + 1, $found, $seen);
            }
        }

        foreach ($this->entries($modules) as $entry) {
            if ($this->dirsWalked >= static::MAX_DIRS_WALKED) {
                break;
            }
            // A scope directory is a namespace, not a package: the packages
            // are one level below it. It goes through $seen for the same
            // reason node_modules does - `ln -s . node_modules/@x` makes the
            // scope branch re-enumerate node_modules itself, and since the
            // re-enumerated names dedupe away, $found stands still while the
            // work grows quadratically.
            if ($entry[0] === '@') {
                $scopeDir = $this->reader->containedDir($appRoot, $modules . '/' . $entry);
                if ($scopeDir === null || isset($seen[$scopeDir])) {
                    continue;
                }
                $seen[$scopeDir] = true;
                foreach ($this->entries($scopeDir) as $scoped) {
                    if ($this->dirsWalked >= static::MAX_DIRS_WALKED) {
                        break;
                    }
                    $this->collect($scopeDir . '/' . $scoped, $entry . '/' . $scoped, $appRoot, $depth, $found, $seen);
                }
                continue;
            }
            $this->collect($modules . '/' . $entry, $entry, $appRoot, $depth, $found, $seen);
        }
    }

    /**
     * Record one package directory, then follow its own nested node_modules.
     *
     * @param string $path    Package directory.
     * @param string $dirName Name it is installed under (`@scope/name` included).
     * @param string $appRoot Application root.
     * @param int    $depth   Current nesting level.
     * @param array  $found   Accumulator.
     * @param array  $seen    Resolved node_modules paths already walked.
     */
    private function collect($path, $dirName, $appRoot, $depth, array &$found, array &$seen)
    {
        // Every candidate package directory costs a realpath() and a manifest
        // read whether or not it yields a new result, so this - not $found -
        // is where the work has to be counted.
        if (++$this->dirsWalked > static::MAX_DIRS_WALKED) {
            // Every caller checks budgetSpent() before calling collect(), so
            // this cannot trip today; kept so the bound holds even if a new
            // enumeration branch forgets the check.
            return; // @codeCoverageIgnore
        }
        // Resolve and bounds-check before reading: a symlinked package
        // (npm link, pnpm store) must not take a root-run scan outside the
        // application it is scanning.
        $real = $this->reader->containedDir($appRoot, $path);
        if ($real === null) {
            return;
        }
        // Reporting this directory and descending into its own node_modules
        // are separate decisions. A missing, oversized or malformed manifest,
        // or one without a usable name, means *this* directory is not a
        // reportable package - not that the packages installed under it are
        // absent. Since the scanner no longer walks node_modules itself, this
        // descent is the only path by which those children are ever seen.
        $manifest = $this->reader->read($real);
        if ($manifest !== null) {
            // An aliased install (`npm i alias@npm:real`) puts the real package
            // under the alias directory, and the real name is the one a
            // vulnerability feed keys on. Fall back to the directory name when
            // the manifest does not carry a usable one.
            $name = $this->reader->name($manifest);
            if ($name === null) {
                $name = $this->reader->isValidName($dirName) ? $dirName : null;
            }
            // The cap is enforced where $found grows, and nowhere else. A check
            // before collect() in the enumeration loops cannot work: entries()
            // bounds names per *listing*, walk() checks only on *entry*, so a
            // nested tree adds one full listing per level between two checks.
            // Instrumented and verified: with the checks in the loops, a cap of
            // 3 reported 5 from a two-level tree.
            if ($name !== null && count($found) < static::MAX_PACKAGES) {
                $version              = $this->reader->version($manifest);
                $found[$name . "\0" . $version] = ['name' => $name, 'version' => $version];
            }
        }

        $this->walk($real, $appRoot, $depth + 1, $found, $seen);
    }

    /**
     * Names inside a directory, dot-entries excluded.
     *
     * npm keeps its own bookkeeping next to the packages - `.bin` shims,
     * `.package-lock.json`, caches - and none of it is a package.
     *
     * Bounded by MAX_PACKAGES rather than FILES_PER_DIR_LIMIT: a flat
     * node_modules legitimately holds more entries than the 1000 that limit
     * allows, and truncating there would silently drop real packages from the
     * report.
     *
     * @param string $dir
     *
     * @return string[]
     */
    private function budgetSpent()
    {
        return $this->dirsWalked >= static::MAX_DIRS_WALKED
            || $this->entriesScanned >= static::MAX_ENTRIES_TOTAL;
    }

    /**
     * Names in a directory, dot-entries dropped, bounded per listing and by
     * the application-wide readdir() budget.
     *
     * @param string $dir
     * @return string[]
     */
    private function entries($dir)
    {
        // A spent readdir() budget means no new listing at all - not even the
        // opendir(): the scope loop reaches here for every scope name its
        // parent listing returned, and each open is tenant-controlled work.
        if ($this->entriesScanned >= static::MAX_ENTRIES_TOTAL) {
            return [];
        }
        Stats::incrementCountDirsOpened();
        $handle = @opendir($dir);
        if ($handle === false) {
            // Every caller passes a path containedDir() has just resolved as
            // a directory, and the scan runs as root, so this is reachable
            // only by a race (the directory vanishing between the two calls)
            // or a mount refusing the open. Not a unit-testable branch; kept
            // because the alternative is a fatal on a live scan.
            return []; // @codeCoverageIgnore
        }

        // Two separate budgets. The names budget counts entries actually
        // taken, so "." and ".." do not consume slots of it. The raw budget
        // bounds the loop itself: a directory of millions of dot-entries
        // yields no names at all and would otherwise spin without ever
        // reaching the names cap.
        $names = [];
        $raw   = 0;
        while (($entry = readdir($handle)) !== false) {
            Stats::incrementCountFilesIteration();
            if (++$raw > static::MAX_ENTRIES_SCANNED
                || ++$this->entriesScanned > static::MAX_ENTRIES_TOTAL
            ) {
                break;
            }
            if ($entry[0] === '.') {
                continue;
            }
            $names[] = $entry;
            if (count($names) >= static::MAX_PACKAGES) {
                break;
            }
        }
        closedir($handle);

        return $names;
    }
}
<?php
/**
 * CommonScriptDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Detector\AppVersionDetector;
use SplFileInfo;

/**
 * Class CommonScriptDetector.
 */
class CommonScriptDetector extends AbstractDetector
{
    /*
     * @var string Detector name
     */

    private $prefix = 'common_script_';

    /**
    * Implements finding and extracting info(version and name).
    *
    * If something is found it return AppVersionDetector\Core\Detector\Version\DetectionEventData.
    * If no luck it returns null.
    *
    * @param SplFileInfo $splFileInfo
    * @return AppVersionDetector\Core\Detector\Version\DetectionEventData|null
    * @throws \Exception
    */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir = $splFileInfo->getPathname();
        $files['phpmailer'] = [
            'phpmailer.php',
            'php-mailer.php',
            'PHPMailer.php',
            'PhpMailer.php',
            'PHP-Mailer.php',
            'Php-Mailer.php',
        ];

        $files['timthumb'] = [
            'timthumb.php',
            'thumb.php',
            'Thumb.php',
            'TimThumb.php',
            'tim-thumb.php',
        ];

        $files['phpMyAdmin'] = [
            'libraries/Config.class.php',
            'libraries/classes/Config.php',
            'libraries/classes/Version.php',
        ];
        $data = [];
        $data = $this->checkAndReadPHPMailerVersion($dir, $files['phpmailer']);
        $data = array_merge($data, $this->checkAndReadTimThumbVersion($dir, $files['timthumb']));
        $data = array_merge($data, $this->checkAndReadPhpMyAdminVersion($dir, $files['phpMyAdmin']));
        return $data;
    }

    private function checkAndReadPHPMailerVersion($dir, $files)
    {
        $data = [];
        
        foreach ($files as $file) {
            $filepath = $dir . '/' . $file;
            if (!file_exists($filepath) || !is_readable($filepath) || !is_file($filepath)) {
                continue;
            }
            Stats::incrementCountFilesReaded();
            $content    = Helper::getPartOfFile($filepath, 32768);
            $version = '';
            if (strpos($content, 'PHPMailer') === false) {
                continue;
            }
            $l_Found = preg_match('~Version:(\s*\d+\.\d+\.\d+)~', $content, $l_Match);

            if ($l_Found) {
                $version = $l_Match[1];
            }

            if (!$l_Found) {
                $l_Found = preg_match('~Version\s*=\s*\'(\d+\.\d+\.\d+)~i', $content, $l_Match);
                if ($l_Found) {
                    $version = $l_Match[1];
                }
            }
            
            $data[] = new DetectionEvent(
                $this,
                new SplFileInfo($filepath),
                $this->prefix . 'phpmailer',
                $version
            );
        }
        return $data;
    }

    private function checkAndReadTimThumbVersion($dir, $files)
    {
        $data = [];
        foreach ($files as $file) {
            $filepath = $dir . '/' . $file;
            if (!file_exists($filepath) || !is_readable($filepath) || !is_file($filepath)) {
                continue;
            }
            Stats::incrementCountFilesReaded();
            $content    = Helper::getPartOfFile($filepath, 8192);
            $version = '';
            if (strpos($content, 'code.google.com/p/timthumb') === false) {
                continue;
            }
            $l_Found = preg_match('~define\s*\(\'version\'\s*,\s*\'([^\']+)\'\s*\);~i', $content, $l_Match);

            if ($l_Found) {
                $version = $l_Match[1];
            }
            
            $data[] = new DetectionEvent(
                $this,
                new SplFileInfo($filepath),
                $this->prefix . 'timthumb',
                $version
            );
        }
        return $data;
    }

    private function checkAndReadPhpMyAdminVersion($dir, $files)
    {
        $data = [];
        foreach ($files as $file) {
            $filepath = $dir . '/' . $file;
            if (!file_exists($filepath) || !is_readable($filepath) || !is_file($filepath)) {
                continue;
            }
            Stats::incrementCountFilesReaded();
            $content    = Helper::getPartOfFile($filepath, 8192);
            $version = '';

            if (strpos($content, 'PMA_VERSION') !== false
                && preg_match('~\$this->set\(\'PMA_VERSION\'\s*,\s*\'([^\']+)\'\);~i', $content, $l_Match)
            ) {
                $version = $l_Match[1];
            } elseif (strpos($content, 'final class Version') !== false && strpos($content, 'namespace PhpMyAdmin;') !== false
                && preg_match('~public\s*const\s*VERSION\s*=\s*\'([^\']+)\'\s*.\s*VERSION_SUFFIX;~i', $content, $l_Match)
            ) {
                $version = $l_Match[1];
            }

            if ($version !== '') {
                $data[] = new DetectionEvent(
                    $this,
                    new SplFileInfo($dir),
                    $this->prefix . 'phpmyadmin',
                    $version
                );
            }
        }
        return $data;
    }
}
<?php
/**
 * DummyDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Detector\AppVersionDetector;
use AppVersionDetector\Detector\Exception;
use SplFileInfo;

/**
 * Class DummyDetector.
 */
class DummyDetector extends AbstractDetector
{
    /*
     * @var string Detector name
     */
    
    private $detector_name = 'dummy_core';
    
    /**
     * @var string
     */
    private $version;

    /**
     * DummyDetector constructor.
     *
     * @param string $version
     */
    public function __construct($version = '0.0.0')
    {
        $this->version = $version;
    }

    /**
     * Implements finding and extracting info(version and name).
     *
     * If something is found it return AppVersionDetector\Core\Detector\Version\DetectionEventData.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|null
     * @throws \Exception
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        if (is_null($this->version)) {
            return null;
        }
        return new DetectionEvent($this, new SplFileInfo(__DIR__), $this->detector_name, $this->version);
    }
}<?php
/**
 * WpPluginDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Abstract Class WpComponentDetector.
 */
abstract class WpComponentDetector extends AbstractDetector
{
    protected $prefix               = '';
    protected $components_folder    = '';
    protected $component_name       = '';

    /**
     * @var WpActivationResolver|null When set, each detected component is stamped
     *      with its activation status.
     */
    protected $activationResolver   = null;

    /**
     * @var WpContentDirResolver Resolves the effective (possibly custom, see
     *      DEF-38597) WP_CONTENT_DIR per install, cached so wp-config.php is
     *      parsed once per install even across the plugin / theme / mu-plugin
     *      detectors when they share the instance (as DetectorBuilder wires it).
     */
    protected $contentDirResolver   = null;

    /**
     * @param WpActivationResolver|null $activationResolver
     * @param WpContentDirResolver|null $contentDirResolver Shared across the WP
     *        component detectors by DetectorBuilder; a private instance is
     *        created when omitted (direct construction, tests).
     */
    public function __construct(WpActivationResolver $activationResolver = null, WpContentDirResolver $contentDirResolver = null)
    {
        $this->activationResolver = $activationResolver;
        $this->contentDirResolver = $contentDirResolver !== null ? $contentDirResolver : new WpContentDirResolver();
    }

    /**
     * Resolve the activation status of one component, identified by its
     * active_plugins-style relative path (e.g. 'akismet/akismet.php' or
     * 'mytheme/style.css').
     *
     * @param WpActivationResolver $resolver
     * @param string $wpRoot
     * @param int $tenantUid
     * @param string $componentFile
     * @return string
     */
    abstract protected function resolveComponentStatus(WpActivationResolver $resolver, $wpRoot, $tenantUid, $componentFile);

    /**
     * Implements finding and extracting version.
     *
     * If something is found it return version as a string or array of strings.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return string|array|null
     */
    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $dir = $splFileInfo->getPathname();
        if (!$this->isWpBase($dir)) {
            return null;
        }
        $components_data    = [];
        $components         = $this->wpComponentList($dir);
        foreach ($components as $component => $data) {
            $event = new DetectionEvent($this, $splFileInfo, $this->prefix . $component, $data['Version']);
            if (isset($data['Status'])) {
                $event->setStatus($data['Status']);
            }
            $components_data[] = $event;
        }
        return $components_data;
    }

    /**
     * Check is the folder is root of WordPress site.
     *
     * @param string $dir
     * @return boolean
     */
    private function isWpBase($dir)
    {
        return (bool)is_dir($this->contentDirResolver->contentDir($dir) . '/' . $this->components_folder);
    }

    private function wpComponentList($wp_install_root)
    {
        $wp_components  = [];
        // DEF-38597: the components folder lives under the effective content dir
        // (custom WP_CONTENT_DIR from wp-config.php, or the default wp-content).
        // The resolver guarantees the custom dir resolves inside the install
        // root, so the DEF-48257 containment check below keeps holding.
        $component_root = $this->contentDirResolver->contentDir($wp_install_root) . '/' . $this->components_folder;
        if (!is_dir($component_root)) {
            return $wp_components;
        }
        // DEF-42618 / DEF-42619: derive the tenant identity from the
        // wp-content/{plugins,themes} directory itself rather than the WP
        // install root. In normal hosting layouts they are the same uid; if
        // they differ, the leaf-level lstat is the more conservative gate (only
        // entries owned by whoever owns this directory are detected) and stays
        // consistent with the outer/inner isSafeTenantPath checks below.
        $root_stat = @lstat($component_root);
        if (!$root_stat || ($root_stat['mode'] & 0170000) === 0120000) {
            return $wp_components;
        }
        // DEF-48257: lstat() refuses to follow the leaf only — intermediate
        // path components (e.g. `wp-content` itself) are still resolved. A
        // tenant who plants `~/public_html/wp-content -> /home/attacker/wp-content`
        // would anchor $tenant_uid at the attacker's uid even though the
        // leaf S_IFLNK check above fires only on the final component, then
        // every isSafeTenantPath() below would accept attacker-owned entries
        // and reject the actual tenant's components — cross-tenant
        // detection-attribution corruption in the JSON / SQLite report.
        //
        // Verify the resolved $component_root is still under the resolved
        // WP install root. This tolerates a panel-style symlink of the
        // install root itself (e.g. cPanel's
        // /home/user/public_html -> /var/www/users/user/public_html: both
        // realpaths re-root to /var/www/...) while rejecting an
        // intermediate symlink that re-roots into another tenant's tree.
        $resolved_component_root    = realpath($component_root);
        $resolved_install_root      = realpath($wp_install_root);
        if ($resolved_component_root === false || $resolved_install_root === false
            || strpos(
                $resolved_component_root . DIRECTORY_SEPARATOR,
                $resolved_install_root . DIRECTORY_SEPARATOR
            ) !== 0) {
            return $wp_components;
        }
        $tenant_uid = $root_stat['uid'];
        Stats::incrementCountDirsOpened();
        $components_dir     = @opendir($component_root);
        $component_files    = [];
        if (!$components_dir) {
            return $wp_components;
        }

        $components_dir_file_counter = 0;
        while ($components_dir_file_counter <= AbstractDetector::FILES_PER_DIR_LIMIT && ($file = readdir($components_dir)) !== false) {
            Stats::incrementCountFilesIteration();
            $components_dir_file_counter++;

            if (substr($file, 0, 1) == '.') {
                continue;
            }

            $component_dirpath = $component_root . '/' . $file;
            if (!$this->isSafeTenantPath($component_dirpath, $tenant_uid)) {
                continue;
            }
            if (is_dir($component_dirpath)) {
                if (!$this->shouldScanSubdirectories()) {
                    // Must-use plugins are loaded by WordPress only from the top
                    // level of mu-plugins/; subdirectories there are library code,
                    // never entry points. Skip them at collection time so a nested
                    // file cannot be reported even when it carries a Name header.
                    continue;
                }
                Stats::incrementCountDirsOpened();
                $components_subdir = @opendir($component_dirpath);
                if (!$components_subdir) {
                    continue;
                }

                $components_subdir_file_counter = 0;
                while ($components_subdir_file_counter <= AbstractDetector::FILES_PER_DIR_LIMIT && ($subfile = readdir($components_subdir)) !== false) {
                    Stats::incrementCountFilesIteration();
                    $components_subdir_file_counter++;

                    if (substr($subfile, 0, 1) == '.') {
                        continue;
                    }

                    if (!$this->isSafeTenantPath($component_dirpath . '/' . $subfile, $tenant_uid)) {
                        continue;
                    }

                    if ($this->isMainComponentFile($subfile)) {
                        $component_files[] = "$file/$subfile";
                    }
                }
                closedir($components_subdir);
            } else {
                if ($this->isMainComponentFile($file)) {
                    $component_files[] = $file;
                }
            }
        }
        closedir($components_dir);

        if (empty($component_files)) {
            return $wp_components;
        }
        foreach ($component_files as $component_file) {
            $component_filepath = $component_root . '/' . $component_file;
            // DEF-42619: require a regular file at the leaf. lstat() returning
            // S_IFREG rejects symlinks (covering the DEF-42618 case at this
            // step), FIFOs / pseudo-files (the hang case), char/block devices
            // and directories. This is strictly stronger than the previous
            // isSafeTenantPath + is_file pair, so isSafeTenantPath is no longer
            // called at this checkpoint.
            $st = @lstat($component_filepath);
            if (!$st || ($st['mode'] & 0170000) !== 0100000) {
                continue;
            }
            // DEF-42618 / DEF-42619: tenant-owned only. Matches the outer
            // isSafeTenantPath uid check exactly so the leaf and the iteration
            // checkpoints stay in agreement (a system install with wp-content
            // owned by root will detect only root-owned plugins; a tenant
            // install will detect only tenant-owned plugins).
            if (isset($st['uid']) && $st['uid'] !== $tenant_uid) {
                continue;
            }
            // DEF-42619: pseudo-filesystem prefix block via realpath, as a
            // defence in depth against ancestor-directory symlink escapes that
            // lstat-at-the-leaf would miss (e.g. plugins/foo -> /proc).
            $real = realpath($component_filepath);
            if ($real === false
                || strpos($real, '/proc/') === 0
                || strpos($real, '/sys/') === 0
                || strpos($real, '/dev/') === 0
            ) {
                continue;
            }
            if (!is_readable($real)) {
                continue;
            }
            // DEF-42619 TOCTOU: read through the *unresolved* leaf, not $real.
            // realpath() above re-resolves the final component, so if the tenant
            // swaps the leaf (regular file -> symlink) after the lstat/uid checks
            // it bakes the symlink target into $real and there is no uid recheck
            // on it. Passing $real into Helper::getPartOfFile would also defeat
            // that helper's own lstat + fopen/fstat dev-ino symlink defence,
            // because it would operate on the already-resolved target inode.
            // Passing $component_filepath keeps that defence on the real leaf:
            // the helper re-lstats it (rejecting a symlink swap before open) and
            // verifies the opened descriptor's dev/ino still match (rejecting a
            // swap that lands between its lstat and open). The $real-based
            // /proc//sys//dev/ prefix block and is_readable() above are retained
            // as defence in depth.
            $component_data = $this->getFileData($component_filepath);
            if (empty($component_data['Name'])) {
                $component_data['Name'] = $this->getNameFallback($component_file);
                // getNameFallback returns '' to signal "skip"; test for that
                // exactly rather than with empty(), so a legitimate fallback
                // name of '0' (e.g. a top-level 0.php loader) is not dropped.
                if ($component_data['Name'] === '') {
                    continue;
                }
            }
            if (empty($component_data['Version'])) {
                $component_data['Version'] = DetectorInterface::UNKNOWN_VERSION;
            }
            if ($this->activationResolver !== null) {
                $component_data['Status'] = $this->resolveComponentStatus($this->activationResolver, $wp_install_root, $tenant_uid, $component_file);
            } else {
                // No resolver (activation checking disabled). Regular
                // plugins/themes cannot know their state without the DB, but a
                // detector whose status is a filesystem fact (must-use plugins)
                // stamps it here regardless; null means "leave the default".
                $forced = $this->statusWithoutResolver();
                if ($forced !== null) {
                    $component_data['Status'] = $forced;
                }
            }
            $package_name = explode('/', $component_file);
            $package = array_shift($package_name);
            $package = preg_replace('/\.php$/', '', $package);
            $package = preg_replace('~[^a-z0-9]~is', '_', $package);
            $wp_components[$package] = $component_data;
        }
        return $wp_components;
    }

    /**
     * Reject symlinks and entries not owned by the tenant before any
     * symlink-following syscall (opendir/is_dir/is_readable/file_get_contents)
     * runs against $path as root.
     */
    private function isSafeTenantPath($path, $tenant_uid)
    {
        $st = @lstat($path);
        if (!$st) {
            return false;
        }
        if (($st['mode'] & 0170000) === 0120000) {
            return false;
        }
        return $st['uid'] === $tenant_uid;
    }
    
    abstract protected function isMainComponentFile($filename);

    /**
     * Whether to descend into first-level subdirectories of the components
     * folder when collecting component files.
     *
     * Regular plugins and themes live one directory down
     * (plugins/akismet/akismet.php, themes/twentyten/style.css), so the
     * default is true. Must-use plugins are loaded by WordPress only from the
     * top level of mu-plugins/, so WpMuPluginDetector overrides this to false.
     *
     * @return bool
     */
    protected function shouldScanSubdirectories(): bool
    {
        return true;
    }

    /**
     * Status to stamp when no activation resolver is configured.
     *
     * Regular plugins and themes cannot know their activation state without the
     * site database, so the default is null: the DetectionEvent 'unknown'
     * default is left in place. Detectors whose status is a filesystem fact
     * (e.g. must-use plugins, always force-loaded by WordPress) override this to
     * stamp that status even when activation checking is disabled.
     *
     * @return string|null
     */
    protected function statusWithoutResolver()
    {
        return null;
    }

    /**
     * Return a fallback name for a component whose file has no recognised Name header.
     *
     * Returns an empty string by default (the component is skipped).
     * Subclasses may override to derive a name from the filename instead.
     *
     * @param string $component_file Relative path within the components folder (e.g. "loader.php" or "subdir/file.php")
     * @return string
     */
    protected function getNameFallback(string $component_file): string
    {
        return '';
    }

    private function getFileData($file)
    {
        $all_headers = [
            'Name'      => $this->component_name . ' Name', 
            'Version'   => 'Version'
        ];
        
        Stats::incrementCountFilesReaded();
        $file_data = Helper::getPartOfFile($file, 8192);
        $file_data = str_replace("\r", "\n", $file_data);

        foreach ($all_headers as $field => $regex) {
            if (preg_match('/^[ \t\/*#@]*' . preg_quote($regex, '/') . ':(.*)$/mi', $file_data, $match) && $match[1]) {
                $all_headers[$field] = $this->cleanupHeaderComment($match[1]);
            } else {
                $all_headers[$field] = '';
            }
        }
        return $all_headers;
    }

    private function cleanupHeaderComment($str)
    {
        return trim(preg_replace('/\s*(?:\*\/|\?>).*/', '', $str));
    }
}
<?php
/**
 * WpPluginDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class WpThemeDetector.
 */
class WpThemeDetector extends WpComponentDetector
{
    protected $prefix               = 'wp_theme_';
    protected $components_folder    = 'themes';
    protected $component_name       = 'Theme';
    
    protected function isMainComponentFile($filename)
    {
        return ($filename == 'style.css');
    }

    protected function resolveComponentStatus(WpActivationResolver $resolver, $wpRoot, $tenantUid, $componentFile)
    {
        // stylesheet/template store the theme directory name (the first path segment).
        $themeDir = explode('/', $componentFile)[0];
        return $resolver->themeStatus($wpRoot, $tenantUid, $themeDir);
    }
}
<?php

/**
 * JoomlaPluginDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

class JoomlaPluginDetector extends AbstractDetector {

    private $prefix = 'joomla_plugin_';
    private $pluginsData = [];
    private $pluginsFound = [];

    protected function findAndExtractData(SplFileInfo $splFileInfo)
    {
        $this->pluginsData  = [];
        $this->pluginsFound = [];
        $foldePath          = $splFileInfo->getPathname();
        $this->searchInComponentFolder($foldePath   . '/administrator/components');
        $this->searchInManifest($foldePath          . '/administrator/manifests/packages');
        $this->searchInPluginFolder($foldePath      . '/plugins');
        if (!$this->pluginsData) {
            return null;
        }
        return array_map(function ($item) use ($splFileInfo) {
            return new DetectionEvent($this, $splFileInfo, $item[0], $item[1]);
        }, $this->pluginsData);
    }

    private function searchInComponentFolder($componentsFolder)
    {
        if (!file_exists($componentsFolder)) {
            return;
        }
        Stats::incrementCountDirsOpened();
        $dir = dir($componentsFolder);
        while (false !== ($entry = $dir->read())) {
            Stats::incrementCountFilesIteration();
            if ($entry == '.' || $entry == '..') {
                continue;
            }
            if (substr($entry, 0, 4) != 'com_') {
                continue;
            }
            $componentFolder = $componentsFolder . '/' . $entry;
            if ($this->isSymlink($componentFolder) || !is_dir($componentFolder)) {
                continue;
            }

            $pluginName         = substr($entry, 4);
            $pluginMetaFilepath = $componentFolder . '/' . $pluginName . '.xml';
            if (!file_exists($pluginMetaFilepath)) {
                $pluginName         = $entry;
                $pluginMetaFilepath = $componentFolder . '/' . $entry . '.xml';
                if (!file_exists($pluginMetaFilepath)) {
                    continue;
                }
            }
            if (!is_file($pluginMetaFilepath)) {
                continue;
            }
            Stats::incrementCountFilesReaded();
            $content = Helper::getPartOfFile($pluginMetaFilepath, 8192);
            $version = $this->getVersionFromXMLContent($content);

            $this->addDetector($pluginName, $version);
        }
        $dir->close();
    }

    private function searchInManifest($manifestFolder)
    {
        if (!file_exists($manifestFolder)) {
            return;
        }
        Stats::incrementCountDirsOpened();
        $dir = dir($manifestFolder);
        while (false !== ($entry = $dir->read())) {
            if ($entry == '.' || $entry == '..') {
                continue;
            }
            $filepath = $manifestFolder . '/' . $entry;
            if (!is_file($filepath) || strtolower(substr($filepath, -4)) != '.xml') {
                continue;
            }
            Stats::incrementCountFilesReaded();
            $content    = Helper::getPartOfFile($filepath, 8192);
            $pluginName = $this->getPluginNameFromXMLContent($content);
            if (!$pluginName) {
                continue;
            }
            $version = $this->getVersionFromXMLContent($content);
            $this->addDetector($pluginName, $version);
        }
        $dir->close();
    }
    
    private function searchInPluginFolder($pluginsFolder)
    {
        if (!file_exists($pluginsFolder)) {
            return;
        }
        Stats::incrementCountDirsOpened();
        $dir = dir($pluginsFolder);
        while (false !== ($entry = $dir->read())) {
            if ($entry == '.' || $entry == '..') {
                continue;
            }
            $filepath = $pluginsFolder . '/' . $entry;
            if ($this->isSymlink($filepath) || !is_dir($filepath)) {
                continue;
            }
            $xml_filepath = $filepath . '/' . $entry . '.xml';
            if ($this->detectPluginFromXml($entry, $xml_filepath)) {
                continue;
            }
            Stats::incrementCountDirsOpened();
            $subDir = dir($filepath);
            while (false !== ($subEntry = $subDir->read())) {
                if ($subEntry == '.' || $subEntry == '..') {
                    continue;
                }
                $subFilepath = $filepath . '/' . $subEntry;
                if ($this->isSymlink($subFilepath) || !is_dir($subFilepath)) {
                    continue;
                }
                $xmlFilepath = $subFilepath . '/' . $subEntry . '.xml';
                $this->detectPluginFromXml($subEntry, $xmlFilepath, $entry);
            }
            $subDir->close();
        }
        $dir->close();
    }

    private function detectPluginFromXml($name, $xmlFilepath, $subDir = '')
    {
        if (!file_exists($xmlFilepath) || !is_file($xmlFilepath)) {
            return false;
        }
        if ($subDir != '') {
            $name = $subDir . '_' . $name;
        }
        Stats::incrementCountFilesReaded();
        $content    = Helper::getPartOfFile($xmlFilepath, 8192);
        
        $version = $this->getVersionFromXMLContent($content);
        $this->addDetector($name, $version, $subDir);
        return true;
    }

    /**
     * Reject directory entries that are symlinks before opening/recursing into
     * them as root. A tenant can plant a symlink (e.g. plugins/content ->
     * /home/other_user/private) to make the scanner traverse arbitrary
     * directory subtrees. lstat() inspects the entry itself (not its target),
     * so an S_IFLNK mode is rejected without following the link. The file-read
     * sinks are already guarded inside Helper::getPartOfFile().
     *
     * @param string $path
     * @return bool
     */
    private function isSymlink($path)
    {
        $st = @lstat($path);
        return $st !== false && ($st['mode'] & 0170000) === 0120000;
    }

    private function getVersionFromXMLContent($content)
    {
        $version = DetectorInterface::UNKNOWN_VERSION;
        // DEF-48085: a tenant-controlled plugin XML <version> tag flows through
        // json_encode into the JSON report and through TextReport string-format
        // into the text report. Two distinct attacker capabilities exist:
        //
        //   * Malformed UTF-8 / NUL: causes json_encode to return false and
        //     blank the whole batch report (cross-tenant DoS).
        //   * HTML / control-byte injection (e.g. `<img onerror=...>`, `\n`):
        //     once a value reaches the report, the downstream agent UI may
        //     render it without escaping (XSS) or a `\n` may forge a fake
        //     additional record in the text report.
        //
        // Whitelist on the *trimmed* capture: Unicode letters, digits, and a
        // small set of punctuation that real Joomla manifests use. The /u
        // modifier validates UTF-8 (defeats the DoS) and the char-class
        // restriction defeats the HTML/control-byte injection. A length cap
        // bounds the value so an outsized payload cannot bloat the report.
        // The capture is trimmed first so XML formatting whitespace around
        // the value (e.g. `<version>\n  3.0.0\n</version>`) is preserved
        // as-is in legitimate manifests instead of being rejected.
        //
        // Defense-in-depth: JsonReport encodes with
        // JSON_INVALID_UTF8_SUBSTITUTE and falls back to a minimal valid
        // payload, so any future divergence here still cannot blank the
        // report.
        if (preg_match('~<version[^>]*>(.*?)</version>~is', $content, $m)) {
            $candidate = trim($m[1]);
            if (preg_match('#^[\p{L}\p{N}._\-+~ ]{1,64}$#u', $candidate)) {
                $version = $candidate;
            }
        }
        return $version;
    }

    private function getPluginNameFromXMLContent($content)
    {
        if (preg_match('~<packagename>(.*?)</packagename>~is', $content, $m)) {
            return $m[1];
        }
        return '';
    }

    private function addDetector($pluginName, $version, $subPluginName = '')
    {
        $pluginName = preg_replace('~[^a-zA-Z0-9\-]+~', '_', $pluginName);
        if (substr($pluginName, 0, 4) == 'com_') {
            $pluginName = substr($pluginName, 4);
        }
        $pluginNameWithoutPrefix = $pluginName;
        if ($subPluginName) {
            $pluginPrefix = $subPluginName . '_';
            if (substr($pluginName, 0, strlen($pluginPrefix)) == $pluginPrefix) {
                $pluginNameWithoutPrefix = substr($pluginName, strlen($pluginPrefix));
            }
        }
        if (empty($subPluginName)) {
            $this->pluginsFound[$pluginName] = 1;
        }
        elseif(isset($this->pluginsFound[$subPluginName])) {
            return;
        }
        elseif(isset($this->pluginsFound[$pluginNameWithoutPrefix])) {
            return;
        }
        $key = $pluginName . $version;
        if (isset($this->plugins_data[$key])) {
            return;
        }
        $this->pluginsData[$key] = [$this->prefix . $pluginName, $version];
    }
}<?php
/**
 * MysqliWpOptionsReader class file.
 */

namespace AppVersionDetector\Core\VersionDetection\Detector;

/**
 * Reads the activation-related wp_options rows over a transient mysqli connection
 * to the tenant database.
 *
 * Supports both local and remote database hosts, matching the behaviour of the
 * MDS scanner. A short connect timeout (target: 500 ms; effective: 1 s, the
 * minimum MYSQLI_OPT_CONNECT_TIMEOUT granularity) keeps an unreachable DB from
 * stalling the scan. mysqli error reporting is turned OFF so any failure returns
 * null (fail soft) instead of throwing; credentials are used only for the connect
 * call and are never logged or stored; the connection is closed immediately. The
 * only value interpolated into SQL is the table prefix, re-validated here as a
 * bare identifier before use.
 *
 * This reader must be run behind ForkingWpOptionsReader, which drops privileges to
 * the tenant uid before delegating, so the connection is never made as root.
 */
class MysqliWpOptionsReader implements WpOptionsReader
{
    // Target: 500 ms. MYSQLI_OPT_CONNECT_TIMEOUT is integer seconds; 1 is the
    // smallest value that does not disable the timeout entirely.
    const CONNECT_TIMEOUT_SEC = 1;
    const READ_TIMEOUT_SEC    = 5;

    // Per-option byte ceiling. active_plugins/stylesheet/template are normally a
    // few KB; a tenant owns these rows and could bloat one to hundreds of MB, so
    // cap server-side (SUBSTRING) to keep the child from allocating multi-GB —
    // well under ForkingWpOptionsReader's 8 MiB parent cap.
    const MAX_OPTION_BYTES = 1048576; // 1 MiB

    public function readOptions(array $config, $tenantUid): ?array
    {
        // $tenantUid is unused here: ForkingWpOptionsReader drops to $tenantUid
        // before delegating, so the connection is never made as root.

        // Validate prefix before any I/O: it is interpolated directly into SQL
        // and cannot be parameterized. Must be [A-Za-z0-9_]+ only.
        $prefix = isset($config['table_prefix']) ? $config['table_prefix'] : '';
        if (!preg_match('/^[A-Za-z0-9_]+$/', $prefix)) {
            return null;
        }

        if (!function_exists('mysqli_init')) {
            return null;
        }

        $dsn = self::parseDbHost(isset($config['db_host']) ? $config['db_host'] : '');

        // Fail soft instead of throwing (mysqli throws by default on PHP 8.1+).
        if (function_exists('mysqli_report')) {
            mysqli_report(MYSQLI_REPORT_OFF);
        }

        $mysqli = @mysqli_init();
        if (!$mysqli) {
            return null;
        }

        @mysqli_options($mysqli, MYSQLI_OPT_CONNECT_TIMEOUT, self::CONNECT_TIMEOUT_SEC);
        @mysqli_options($mysqli, MYSQLI_OPT_READ_TIMEOUT, self::READ_TIMEOUT_SEC);
        // Never let a rogue MySQL server pull a local file via LOAD DATA LOCAL INFILE.
        @mysqli_options($mysqli, MYSQLI_OPT_LOCAL_INFILE, false);

        $connected = @mysqli_real_connect(
            $mysqli,
            $dsn['host'] !== '' ? $dsn['host'] : null,
            isset($config['db_user']) ? $config['db_user'] : '',
            isset($config['db_password']) ? $config['db_password'] : '',
            isset($config['db_name']) ? $config['db_name'] : '',
            $dsn['port'],
            $dsn['socket']
        );
        if (!$connected) {
            @mysqli_close($mysqli);
            return null;
        }

        try {
            // Cap each value server-side (fetch one byte over the ceiling so an
            // over-limit value is detectable) so the tenant cannot make the child
            // allocate an unbounded row.
            $limit = self::MAX_OPTION_BYTES + 1;
            $sql = 'SELECT option_name, SUBSTRING(option_value, 1, ' . $limit . ') AS option_value'
                . ' FROM `' . $prefix . 'options`'
                . " WHERE option_name IN ('active_plugins', 'stylesheet', 'template')";
            $result = @mysqli_query($mysqli, $sql);
            if (!$result) {
                return null;
            }

            $options = ['active_plugins' => null, 'stylesheet' => null, 'template' => null];
            while ($row = @mysqli_fetch_assoc($result)) {
                $name = isset($row['option_name']) ? $row['option_name'] : null;
                if ($name !== null && array_key_exists($name, $options)) {
                    $value = isset($row['option_value']) ? $row['option_value'] : null;
                    // Over-limit (truncated) value: drop it rather than hand a
                    // corrupt/partial serialized blob to the resolver.
                    if ($value !== null && strlen($value) > self::MAX_OPTION_BYTES) {
                        $value = null;
                    }
                    $options[$name] = $value;
                }
            }
            @mysqli_free_result($result);
            return $options;
        } finally {
            @mysqli_close($mysqli);
        }
    }

    /**
     * Parse a WordPress DB_HOST into host / port / socket. Supports 'host',
     * 'host:port', 'host:/path/to/socket' and '[ipv6]:port'.
     *
     * @param string $dbHost
     * @return array{host: string, port: int|null, socket: string|null}
     */
    public static function parseDbHost($dbHost)
    {
        $host   = (string)$dbHost;
        $port   = null;
        $socket = null;

        if ($host !== '' && $host[0] === '[') {
            $close = strpos($host, ']');
            if ($close !== false) {
                $afterBracket = substr($host, $close + 1);
                $host = substr($host, 1, $close - 1);
                if (strncmp($afterBracket, ':', 1) === 0) {
                    self::classifyTail(substr($afterBracket, 1), $port, $socket);
                }
                return ['host' => $host, 'port' => $port, 'socket' => $socket];
            }
        }

        $colon = strpos($host, ':');
        if ($colon !== false) {
            $tail = substr($host, $colon + 1);
            $host = substr($host, 0, $colon);
            self::classifyTail($tail, $port, $socket);
        }

        // Force TCP for a bare 'localhost'. mysqli otherwise connects over the
        // Unix socket, whose path comes from mysqli.default_socket — an ini the
        // wrapper's `php -n` does not load, so the socket is not found. 127.0.0.1
        // connects via TCP regardless of ini and sidesteps the socket entirely.
        // An explicitly configured socket path is respected.
        if ($host === 'localhost' && $socket === null) {
            $host = '127.0.0.1';
        }

        return ['host' => $host, 'port' => $port, 'socket' => $socket];
    }

    private static function classifyTail($tail, &$port, &$socket)
    {
        if ($tail === '') {
            return;
        }
        if ($tail[0] === '/') {
            $socket = $tail;
        } else {
            $port = (int)$tail;
        }
    }
}
<?php
/**
 * AbstractCompositeDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection;

use AppVersionDetector\Core\PublisherInterface;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\MediatorInterface;
use SplFileInfo;

/**
 * Class AbstractCompositeDetector.
 *
 * @package AppVersionDetector\Core
 */
abstract class AbstractCompositeDetector implements DetectorInterface
{
    /**
     * @var DetectorInterface[]
     */
    protected $detectors;

    /**
     * @param PublisherInterface $publisher
     * @param SplFileInfo $splFileInfo
     */
    abstract public function perform(PublisherInterface $publisher, SplFileInfo $splFileInfo);

    /**
     * Adds a detector to the collection.
     *
     * @param DetectorInterface $detector
     */
    public function add(DetectorInterface $detector)
    {
        $this->detectors[] = $detector;
    }
}<?php
/**
 * AbstractDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection;

use AppVersionDetector\Core\PublisherInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\MediatorInterface;
use AppVersionDetector\Application\AppException;
use SplFileInfo;

/**
 * Class AbstractDetector.
 */
abstract class AbstractDetector implements DetectorInterface
{
    /**
     * Number of files detectors are allowed to iterate per directory.
     *
     * @var int 
     */
    const FILES_PER_DIR_LIMIT = 1000;

    /**
     * Perform detection.
     *
     * @param PublisherInterface $publisher
     * @param SplFileInfo $splFileInfo
     * @throws AppException
     */
    public function perform(PublisherInterface $publisher, SplFileInfo $splFileInfo)
    {
        $data = $this->findAndExtractData($splFileInfo);
        if (is_null($data)) {
            return;
        }
        $result = [];
        if (is_array($data)) {
            $result = $data;
        }
        else {
            $result[] = $data;
        }
        foreach ($result as $notify_data) {
            if (!$notify_data instanceof DetectionEvent) {
                throw new AppException('Wrong class in list!');
            }
            $publisher->update($notify_data);
        }
    }

    /**
     * Implements finding and extracting info(version and name).
     *
     * If something is found it returns AppVersionDetector\Core\Detector\Version\DetectionEventData.
     * If no luck it returns null.
     *
     * @param SplFileInfo $splFileInfo
     * @return DetectionEvent|array|null
     */
    abstract protected function findAndExtractData(SplFileInfo $splFileInfo);
}<?php
/**
 * DependencyCollectionDetector class file.
 */

namespace AppVersionDetector\Core\VersionDetection;

use AppVersionDetector\Core\AbstractEvent;
use AppVersionDetector\Core\PublisherInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Core\VersionDetection\AbstractCompositeDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\MediatorInterface;
use SplFileInfo;

/**
 * Class DependencyCollectionDetector.
 *
 * Check if first element detects something. If so, perform other detectors.
 * If first detector doesn't detect any, it doesn't perform other detectors.
 *
 * @package AppVersionDetector\Core
 */
class DependencyCollectionDetector extends AbstractCompositeDetector implements PublisherInterface
{
    /**
     * @var PublisherInterface
     */
    private $publisher;

    /**
     * @param PublisherInterface $publisher
     * @param SplFileInfo $splFileInfo
     */
    public function perform(PublisherInterface $publisher, SplFileInfo $splFileInfo)
    {
        $this->publisher = $publisher;

        if (isset($this->detectors[0])) {
            $this->detectors[0]->perform($this, $splFileInfo);
        }
    }

    /**
     * Notifies about an event.
     *
     * @param AbstractEvent $event
     */
    public function update(AbstractEvent $event)
    {
        $this->publisher->update($event);

        if (!($event instanceof DetectionEvent)) {
            return;
        }
        /** @var $event DetectionEvent */
        foreach ($this->detectors as $key => $detector) {
            if ($key == 0) {
                continue;
            }

            $detector->perform($this->publisher, $event->getPath());
        }
    }
}<?php
/**
 * DetectorInterface class file.
 */

namespace AppVersionDetector\Core\VersionDetection;

use AppVersionDetector\Core\PublisherInterface;
use SplFileInfo;

/**
 * Class DetectorInterface.
 */
interface DetectorInterface
{
    const UNKNOWN_VERSION = 'unknown';

    /**
     * Perform detection.
     *
     * @param PublisherInterface $publisher
     * @param SplFileInfo $splFileInfo
     */
    public function perform(PublisherInterface $publisher, SplFileInfo $splFileInfo);
}<?php
/**
 * PublisherInterface file.
 */

namespace AppVersionDetector\Core;


/**
 * Interface PublisherInterface.
 */
interface PublisherInterface
{
    /**
     * An event sender publish an event using this method.
     *
     * @param AbstractEvent $event
     */
    public function update(AbstractEvent $event);
}<?php
/**
 * MediatorInterface class file.
 */

namespace AppVersionDetector\Core;

use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use SplFileInfo;

/**
 * Class MediatorInterface.
 */
interface MediatorInterface
{
    /**
     * Notifies about a detection event.
     *
     * @param DetectorInterface $sender
     * @param SplFileInfo $splFileInfo
     * @param DetectionEvent $data
     */
    public function notifyAboutDetection($sender, $splFileInfo, VersionDetection\DetectionEvent $data);

    /**
     * Notifies about a start-detection event.
     *
     * @param string $scannerVersion
     * @param string $directory
     */
    public function notifyAboutScanningStarted($scannerVersion, $directory);
}<?php
/**
 * ListenerInterface file.
 */

namespace AppVersionDetector\Core;

use AppVersionDetector\Core\AbstractEvent;

/**
 * Interface ListenerInterface.
 */
interface ListenerInterface
{
    /**
     * Notifies a listener about an event raised.
     *
     * @param AbstractEvent $event
     */
    public function notify(AbstractEvent $event);
}<?php
/**
 * Scanner class file.
 */

namespace AppVersionDetector;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Directory;
use AppVersionDetector\Application\Helper;
use AppVersionDetector\Application\AppException;
use AppVersionDetector\Core\PublisherInterface;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Event\ScanningEndedEvent;
use AppVersionDetector\Event\ScanningStartedEvent;
use AppVersionDetector\Event\ScanningDirStartedEvent;
use AppVersionDetector\Event\ScanningDirEndedEvent;
use FilesystemIterator;
use RecursiveCallbackFilterIterator;
use RecursiveDirectoryIterator;
use RecursiveIteratorIterator;
use SplFileInfo;

/**
 * Class Scanner.
 */
class Scanner
{

    const VERSION = '30.1.10-1';

    /**
     * @var PublisherInterface
     */
    private $publisher;

    /**
     * Scanner constructor.
     *
     * @param PublisherInterface $publisher
     */
    public function __construct(PublisherInterface $publisher)
    {
        $this->publisher = $publisher;
    }

    /**
     * Scans a list of directories.
     *
     * @param SqliteDbReportConnection $dbReportConnection
     * @param array $directories
     * @param DetectorInterface $detector
     * @param int $depth
     *
     * @throws Exception
     */
    public function run($dbReportConnection, $directories, $detector, $depth = 1, $since = false)
    {
        if ($depth < 1) {
            throw new AppException('Value of the $depth parameter can not be less than 1.');
        }

        foreach ($directories as $directory) {
            if (!is_dir($directory->getPath())) {
                throw new AppException('Only a directory can be scanned. Problem with "' . $directory->getPath() . '".');
            }
        }

        $scanId = $this->generateScanId();

        $this->publisher->update(new ScanningStartedEvent($this, self::VERSION, $scanId));

        foreach ($directories as $directory) {
            if (!is_null($dbReportConnection) && $since && $dbReportConnection->haveRelevantReport($directory->getPath(), $since)) {
                continue;
            }
            $this->scanDirectory($scanId, $directory, $detector, $depth);
        }

        Stats::setCurrentMemoryUsagePeak();
        Stats::setCurrentMemoryUsageEnd();

        $this->publisher->update(new ScanningEndedEvent($this, $scanId));
    }

    /**
     * Generates a scan ID.
     *
     * @return string
     */
    public function generateScanId(): string
    {
        $time = gettimeofday();
        return substr($time['sec'] . $time['usec'], -16);
    }

    /**
     * Scans a particular directory.
     * @param int $scanId
     * @param Directory $directory
     * @param DetectorInterface $detector
     * @param int $depth
     */
    private function scanDirectory($scanId, Directory $directory, $detector, $depth = 1)
    {
        $this->publisher->update(new ScanningDirStartedEvent($this, self::VERSION, $directory));

        // scan a base directory
        $detector->perform($this->publisher, new SplFileInfo($directory->getPath()));

        // scan subdirectories
        $root = realpath($directory->getPath());
        // Wrap the recursive directory iterator in a
        // RecursiveCallbackFilterIterator that rejects out-of-bounds
        // directories *before* RecursiveIteratorIterator descends. Returning
        // false from the filter on a directory both hides the entry from the
        // outer iteration AND prevents recursion into its subtree — this is
        // the PHP-idiomatic equivalent of skipChildren() (which does not exist
        // on RecursiveIteratorIterator or RecursiveDirectoryIterator).
        //
        // Without this guard a tenant-planted symlink such as `evil -> /`
        // would still be traversed: each child of the rejected subtree drives
        // up $files_counter, which exhausts AbstractDetector::FILES_PER_DIR_LIMIT
        // and silently truncates the scan of legitimate sibling directories.
        $filter = new RecursiveCallbackFilterIterator(
            new RecursiveDirectoryIterator(
                $directory->getPath(),
                FilesystemIterator::FOLLOW_SYMLINKS | FilesystemIterator::SKIP_DOTS
            ),
            function ($current, $key, $innerIterator) use ($root) {
                $entry = realpath($key);

                // node_modules is never walked. The loop below is bounded by
                // FILES_PER_DIR_LIMIT counted over every entry the iterator
                // yields, and one ordinary JS project holds 1000+ package
                // directories - enough to exhaust the whole budget on its own
                // and silently truncate the scan of every directory the
                // iterator had not reached yet, other tenants' CMS installs
                // included. Rejecting the directory here also stops the
                // recursion (same mechanism as the bounds check below), and
                // costs nothing: the Node.js detectors read package versions
                // straight out of node_modules/<dep>/package.json, so the
                // traversal has no reason to descend into it.
                //
                // Matched on the name the entry is reached by OR on what it
                // resolves to, each arm narrowing a symlink shape the other
                // misses: `ln -s node_modules nm` is a second name the filename
                // arm does not see, and a `node_modules` symlink sitting
                // shallower in the traversal than its target is reached under
                // its own name before the realpath arm could apply.
                //
                // This is an optimization for the common legitimate layout,
                // not a boundary: any 1000-entry directory (a Maildir, a cache)
                // exhausts FILES_PER_DIR_LIMIT identically, and a store walked
                // under its own real name is not a node_modules to prune.
                if (($current->getFilename() === Helper::NODE_MODULES_DIR
                        || ($entry !== false && basename($entry) === Helper::NODE_MODULES_DIR))
                    && $current->isDir()
                ) {
                    return false;
                }

                // DEF-48091: apply the realpath bounds check to EVERY entry
                // the iterator yields, not just directories. FOLLOW_SYMLINKS
                // means a tenant-planted file symlink like
                //   ln -s /etc/shadow ~/public_html/wp-config.php
                // would otherwise surface as an in-tree file and reach future
                // consumers of the iterator unchecked. The detector itself
                // does not consume files from this iterator today (only dirs
                // via the loop's isDir() check below), but rejecting them at
                // the traversal layer is defense-in-depth: a single new
                // caller iterating files would otherwise re-open this gap.
                //
                // For dirs, returning false also prevents
                // RecursiveCallbackFilterIterator from descending — the
                // PHP-idiomatic skipChildren() equivalent (DEF-48092). Children
                // of an out-of-bounds dir are never iterated and never
                // counted toward FILES_PER_DIR_LIMIT.
                return $root !== false && $entry !== false
                    && ($entry === $root
                        || strpos($entry, $root . DIRECTORY_SEPARATOR) === 0);
            }
        );
        /** @var RecursiveDirectoryIterator|RecursiveIteratorIterator $iterator */
        $iterator = new RecursiveIteratorIterator(
            $filter,
            RecursiveIteratorIterator::SELF_FIRST
        );
        $iterator->setMaxDepth($depth - 1);

        $files_counter = 0;
        $iterator->rewind();
        while($files_counter <= AbstractDetector::FILES_PER_DIR_LIMIT && $iterator->valid()) {
            Stats::incrementCountFilesIteration();
            $files_counter++;
            if ($iterator->isDir()) {
                // Defense-in-depth: re-resolve realpath() at the moment of
                // perform(). The RCFI filter above already enforces bounds
                // before recursion (DEF-48092: children of an out-of-bounds
                // dir are not even iterated), but the filter accept() and
                // this loop body's isDir() are separated by an iteration
                // step. A symlink that resolved to a file at filter time
                // (or was in-bounds then) could be flipped to a dir / to an
                // out-of-bounds target before the loop reaches isDir() —
                // without this re-check the detector would run on an
                // out-of-bounds target.
                $entry = realpath($iterator->key());
                if ($root !== false && $entry !== false
                    && ($entry === $root
                        || strpos($entry, $root . DIRECTORY_SEPARATOR) === 0)) {
                    Stats::incrementCountDirsOpened();
                    $detector->perform($this->publisher, new SplFileInfo($iterator->key()));
                }
            }
            $iterator->next();
        }

        $this->publisher->update(new ScanningDirEndedEvent($this));
    }
}
<?php
/**
 * AbstractReport class file.
 */

namespace AppVersionDetector\Report;

use AppVersionDetector\Core\AbstractEvent;
use AppVersionDetector\Core\OutdatedDetection\OutdatedEvent;
use AppVersionDetector\Core\VersionDetection\AbstractDetector;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Core\ListenerInterface;
use AppVersionDetector\Event\ScanningEndedEvent;
use AppVersionDetector\Event\ScanningStartedEvent;
use AppVersionDetector\Event\ScanningDirStartedEvent;
use AppVersionDetector\Event\ScanningDirEndedEvent;
use SplFileInfo;

/**
 * Class AbstractReport.
 */
abstract class AbstractReport implements ListenerInterface
{
    const UNKNOWN_DETECTOR = 'unknown';

    /**
     * Notifies about an event.
     *
     * @param AbstractEvent $event
     */
    final public function notify(AbstractEvent $event)
    {
        switch (true) {
            case $event instanceof DetectionEvent:
                $this->reactOnDetection($event);
                break;
            case $event instanceof OutdatedEvent:
                $this->reactOnOutdatedDetected($event);
                break;
            case $event instanceof ScanningStartedEvent:
                $this->reactOnStartScanning($event);
                break;
            case $event instanceof ScanningDirStartedEvent:
                $this->reactOnStartDirScanning($event);
                break;
            case $event instanceof ScanningDirEndedEvent:
                $this->reactOnEndDirScanning($event);
                break;
            case $event instanceof ScanningEndedEvent:
                $this->reactOnEndScanning($event);
                break;
        }
    }

    /**
     * Reacts on a detection event.
     *
     * @param DetectionEvent $event
     */
    abstract protected function reactOnDetection(DetectionEvent $event);

    /**
     * Reacts on start-scanning event.
     *
     * @param ScanningStartedEvent $event
     */
    abstract protected function reactOnStartScanning(ScanningStartedEvent $event);
    
    /**
     * Reacts on start-dir-scanning event.
     *
     * @param ScanningDirStartedEvent $event
     */
    abstract protected function reactOnStartDirScanning(ScanningDirStartedEvent $event);

    /**
     * Reacts on an outdated software detected.
     *
     * @param OutdatedEvent $event
     */
    abstract protected function reactOnOutdatedDetected(OutdatedEvent $event);
    
    /**
     * Reacts on the end-dir-scanning event.
     *
     * @param ScanningDirEndedEvent $event
     */
    abstract protected function reactOnEndDirScanning(ScanningDirEndedEvent $event);

    /**
     * Reacts on the end-scanning event.
     *
     * @param ScanningEndedEvent $event
     */
    abstract protected function reactOnEndScanning(ScanningEndedEvent $event);
}<?php
/**
 * JsonReport class file.
 */

namespace AppVersionDetector\Report;

use AppVersionDetector\Application\Stats;
use AppVersionDetector\Core\OutdatedDetection\OutdatedEvent;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Event\ScanningEndedEvent;
use AppVersionDetector\Event\ScanningStartedEvent;
use AppVersionDetector\Event\ScanningDirStartedEvent;
use AppVersionDetector\Event\ScanningDirEndedEvent;

/**
 * Class JsonReport.
 */
class JsonReport extends AbstractFileBasedReport
{
    /**
     * @var array
     */
    private $report = [
        'app_detector_version'  => null,
        'doc_root'              => null,
        'scanning_started_at'   => null,
        'detected_domain_apps'  => [],
    ];
    
    /**
     * @var string
     */
    private $directoryDomain = '';

    /**
     * Reacts on a detection event.
     *
     * @param DetectionEvent $event
     */
    protected function reactOnDetection(DetectionEvent $event)
    {
        $id = $event->getName();

        if (!isset($this->report['detected_domain_apps'][$id])) {
            $this->report['detected_domain_apps'][$id] = [];
        }

        $user = $event->getPath()->getOwner();
        if (extension_loaded('posix')) {
            $user = posix_getpwuid($user)['name'];
        }

        $this->report['detected_domain_apps'][$id][] = [
            'ver'           => $event->getVersion(),
            'path'          => $event->getPath()->getPathname(),
            'user'          => $user,
            'domain'        => $this->directoryDomain,
            'status'        => $event->getStatus(),
        ];
    }

    /**
     * Reacts on start-scanning event.
     *
     * @param ScanningStartedEvent $event
     */
    protected function reactOnStartScanning(ScanningStartedEvent $event)
    {
        $this->report['app_detector_version']   = $event->getScannerVersion();
        $this->report['scanning_started_at']    = date('r');
    }

    
    /**
     * Reacts on start-dir-scanning event.
     *
     * @param ScanningDirStartedEvent $event
     */
    protected function reactOnStartDirScanning(ScanningDirStartedEvent $event)
    {
        $directory = $event->getDirectory();
        $this->report['doc_root'] = $directory->getPath();
        $this->directoryDomain = $directory->getDomain();
    }
    
    /**
     * Reacts on the end-dir-scanning event.
     *
     * @param ScanningDirEndedEvent $event
     */
    protected function reactOnEndDirScanning(ScanningDirEndedEvent $event)
    {
    }
    
    /**
     * Reacts on an outdated software detection event.
     *
     * @param OutdatedEvent $event
     */
    protected function reactOnOutdatedDetected(OutdatedEvent $event)
    {
        $id = $event->getName();

        $this->report['outdated'][$id][] = [
            [$event->getType(), $event->getVersion()]
        ];
    }

    /**
     * Reacts on the end-scanning event.
     *
     * @param ScanningEndedEvent $event
     */
    protected function reactOnEndScanning(ScanningEndedEvent $event)
    {
        if (Stats::isAccumulateStats()) {
            $this->report['stats'] = [
                'memory_usage_start'    => Stats::getMemoryUsageStart(),
                'memory_usage_end'      => Stats::getMemoryUsageEnd(),
                'memory_usage_peak'     => Stats::getMemoryUsagePeak(),
                'count_file_readed'     => Stats::getCountFilesReaded(),
                'count_file_interation' => Stats::getCountFilesIteration(),
                'count_dir_opened'      => Stats::getCountDirsOpened(),
            ];
        }
        $json = json_encode($this->report, JSON_INVALID_UTF8_SUBSTITUTE);
        if ($json === false) {
            $json = json_encode(['detected_domain_apps' => []]);
        }
        file_put_contents($this->targetFile, $json);
    }
}<?php
/**
 * AbstractFileBasedReport class file.
 */

namespace AppVersionDetector\Report;


/**
 * Class AbstractFileBasedReport.
 */
abstract class AbstractFileBasedReport extends AbstractReport
{
    /**
     * @var string
     */
    protected $targetFile;

    /**
     * AbstractReport constructor.
     *
     * @param string $targetFile
     */
    public function __construct($targetFile = 'php://stdout')
    {
        $this->targetFile = $targetFile;
    }
}<?php

namespace AppVersionDetector\Report\Includes;

use AppVersionDetector\Scanner;

/**
 * Class RemoteStatsRequest Send statistics to remote server
 * @package AppVersionDetector\Report\Includes
 */
class RemoteStatsRequest
{
    const API_URL    = 'https://api.imunify360.com/api/app-version-save';
    const API_V2_URL = 'https://api.imunify360.com/api/v2/app-version-save';
    const API_V3_URL = 'https://api.imunify360.com/api/v3/app-version-save';

    // DEF-51827: outcome enum values written into $lastOutcome['outcome']. The
    // set is intentionally small so the SLI-1 delivery-success dashboard can
    // pivot on it directly without a lookup table. Any expansion needs both a
    // Redash query change and a Grafana panel update — think twice.
    const OUTCOME_SENT_OK    = 'sent_ok';    // 2xx from the API
    const OUTCOME_SENT_4XX   = 'sent_4xx';   // 4xx — our own problem (auth/payload)
    const OUTCOME_SENT_5XX   = 'sent_5xx';   // 5xx — API problem
    const OUTCOME_TIMEOUT    = 'timeout';    // curl_errno == CURLE_OPERATION_TIMEDOUT
    const OUTCOME_DNS_ERROR  = 'dns_error';  // curl_errno == CURLE_COULDNT_RESOLVE_HOST
    const OUTCOME_NET_ERROR  = 'net_error';  // any other curl_errno

    private $timeout;
    private $iaid_token;

    /**
     * @var array|null Outcome record from the most recent request() call.
     *                 Null until the first call. Structure:
     *                 [
     *                     'outcome'     => string   // one of OUTCOME_* consts
     *                     'http_code'   => int      // 0 when the HTTP layer never returned a status
     *                     'errno'       => int      // curl_errno (0 on HTTP success)
     *                     'attempts'    => int      // 1 until iter-2b-retry lands
     *                     'error_class' => string|null // curl_error text on failure
     *                 ]
     */
    private $lastOutcome = null;

    /**
     * RemoteStatsRequest constructor.
     * @param string|null $iaid_token
     * @param int $timeout
     */
    public function __construct($iaid_token = null, $timeout = 10)
    {
        $this->iaid_token = $iaid_token;
        $this->timeout = $timeout;
    }

    /**
     * Endpoint used for the current auth context.
     *
     * With an IAID token we post to v3 (a superset of v2: same agent-JWT auth,
     * plus the top-level `duration_ms` field and the per-app `status` field).
     * Without a token we keep posting to the unauthenticated v1 endpoint.
     *
     * @return string
     */
    public function getApiUrl()
    {
        // An empty token (empty/truncated token file) must NOT route to the authed
        // v3 endpoint with an empty X-Auth — that 401s and silently drops telemetry.
        return !empty($this->iaid_token) ? self::API_V3_URL : self::API_URL;
    }

    /**
     * Build the outbound JSON envelope for a batch of per-directory records.
     *
     * DEF-51827: emit `avd_version` at the envelope root so the correlation-side
     * ingest can stamp each `default.app_version_info` row with the AVD RPM build
     * that produced it — kills the need to JOIN `server_config` for every
     * per-version cohort query. Extracted from request() so the wire shape can be
     * unit-tested without a live HTTP round-trip. Unknown envelope keys are
     * silently dropped by the correlation v3 covador schema, so this addition
     * is backward-compatible: an older server that doesn't yet bind
     * `avd_version` simply ignores it (verified 2026-07-31 against covador
     * `schema()` semantics).
     *
     * @param array $records List of report records.
     * @return array
     */
    public function buildEnvelope($records)
    {
        return [
            'data'        => $records,
            'avd_version' => Scanner::VERSION,
        ];
    }

    /**
     * Delivery outcome of the most recent request() call.
     *
     * DEF-51827: exposes what the client just saw on the wire so the caller
     * (RemoteStatsReport → per-run outcome file in iter 2c) can distinguish
     * "silently exited 0 having reached the API" from "silently exited 0 with
     * a timeout". Returns null before the first request() call.
     *
     * @return array|null
     */
    public function getLastOutcome()
    {
        return $this->lastOutcome;
    }

    /**
     * POST a batch of per-directory report records.
     *
     * @param array $records List of report records; each record becomes one
     *                       row in the `app_version_info` ClickHouse table.
     * @return object
     */
    public function request($records)
    {
        $json_data = json_encode($this->buildEnvelope($records));

        $headers = ['Content-Type: application/json'];
        if (!empty($this->iaid_token)) {
            $headers[] = 'X-Auth: ' . $this->iaid_token;
        }

        $probe = ['result' => false, 'http_code' => 0, 'errno' => 0, 'error' => ''];
        try {
            $probe = $this->performCurl($json_data, $headers);
        } catch (\Exception $e) {
            $probe['error'] = $e->getMessage();
        }

        $this->lastOutcome = $this->classifyOutcome($probe);

        return @json_decode(is_string($probe['result']) ? $probe['result'] : '');
    }

    /**
     * Execute the HTTP round-trip and return a structured probe.
     *
     * Overridable seam for unit tests: an anonymous subclass in
     * RemoteStatsRequestTest injects canned probes so outcome classification
     * can be exercised without a live network. The default implementation
     * preserves the pre-DEF-51827 curl configuration verbatim (timeout,
     * headers, TLS defaults, RETURNTRANSFER).
     *
     * @param string $jsonBody JSON-serialized envelope payload.
     * @param array  $headers  HTTP headers (already includes X-Auth if any).
     * @return array {result: string|false, http_code: int, errno: int, error: string}
     */
    protected function performCurl($jsonBody, array $headers)
    {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL,               $this->getApiUrl());
        curl_setopt($ch, CURLOPT_TIMEOUT,           $this->timeout);
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT,    $this->timeout);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER,    true);
        curl_setopt($ch, CURLOPT_HTTPHEADER,        $headers);
        curl_setopt($ch, CURLOPT_POSTFIELDS,        $jsonBody);
        $result   = curl_exec($ch);
        $httpCode = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
        $errno    = (int)curl_errno($ch);
        $error    = (string)curl_error($ch);
        // curl_close() is a no-op since PHP 8.0 (handle is freed when it falls
        // out of scope) and emits deprecation notices in PHP 8.5. The
        // pre-DEF-51827 code never called it either — preserve that contract.
        return [
            'result'    => $result,
            'http_code' => $httpCode,
            'errno'     => $errno,
            'error'     => $error,
        ];
    }

    /**
     * Map a curl probe onto the OUTCOME_* enum + carry the numeric details
     * across for the SLI dashboard.
     */
    private function classifyOutcome(array $probe)
    {
        $errno    = (int)$probe['errno'];
        $httpCode = (int)$probe['http_code'];
        $errorMsg = $probe['error'] !== '' ? (string)$probe['error'] : null;

        // curl_errno takes precedence: a non-zero errno means the HTTP layer
        // never delivered a status code, so http_code (usually 0) is meaningless.
        if ($errno !== 0) {
            // CURLE_OPERATION_TIMEDOUT = 28; CURLE_COULDNT_RESOLVE_HOST = 6.
            if ($errno === CURLE_OPERATION_TIMEDOUT) {
                $outcome = self::OUTCOME_TIMEOUT;
            } elseif ($errno === CURLE_COULDNT_RESOLVE_HOST) {
                $outcome = self::OUTCOME_DNS_ERROR;
            } else {
                $outcome = self::OUTCOME_NET_ERROR;
            }
        } elseif ($httpCode >= 200 && $httpCode < 300) {
            $outcome = self::OUTCOME_SENT_OK;
        } elseif ($httpCode >= 400 && $httpCode < 500) {
            $outcome = self::OUTCOME_SENT_4XX;
            $errorMsg = $errorMsg ?: 'HTTP ' . $httpCode;
        } elseif ($httpCode >= 500 && $httpCode < 600) {
            $outcome = self::OUTCOME_SENT_5XX;
            $errorMsg = $errorMsg ?: 'HTTP ' . $httpCode;
        } else {
            // 1xx, 3xx, or 0 without an errno. Treat as net_error so operators
            // can spot a proxy misroute (a 302 to a login page etc.) without
            // needing a new enum value.
            $outcome  = self::OUTCOME_NET_ERROR;
            $errorMsg = $errorMsg ?: 'unexpected HTTP ' . $httpCode;
        }

        return [
            'outcome'     => $outcome,
            'http_code'   => $httpCode,
            'errno'       => $errno,
            'attempts'    => 1,
            'error_class' => $errorMsg,
        ];
    }
}
<?php

namespace AppVersionDetector\Report\Includes;

/**
 * DEF-51827: persist the outcome of the most recent AVD run to a well-known
 * JSON file so a downstream agent (or an operator on the host) can distinguish
 * "silently exited 0 having reached the API" from "silently exited 0 with a
 * timeout".
 *
 * The default path lives under the imunify360-agent's log tree so both the
 * scheduled cron caller and the on-demand MDS caller write to the same file
 * (write-newest-wins). All writes are atomic (tempfile + rename): a reader
 * that opens the file mid-write sees the previous complete record, never
 * a partial one.
 *
 * Any I/O failure is swallowed by design — this is observability plumbing,
 * not a critical path. A host with a non-writable log dir must not fail its
 * scan just because the run-outcome record could not be persisted.
 */
class LastRunOutcomeWriter
{
    const DEFAULT_PATH = '/var/log/imunify360/avd-last-run.json';

    private $path;

    public function __construct($path = self::DEFAULT_PATH)
    {
        $this->path = $path;
    }

    /**
     * Persist $record atomically at $this->path. Returns true on success,
     * false if the write was silently skipped or failed. Never throws.
     */
    public function write(array $record)
    {
        $dir = dirname($this->path);
        if (!is_dir($dir) || !is_writable($dir)) {
            return false;
        }

        $json = @json_encode($record, JSON_UNESCAPED_SLASHES);
        if ($json === false) {
            return false;
        }

        // Tempfile + rename: an atomic swap on the same filesystem prevents a
        // partial-write race. The pid-suffixed tempfile keeps two concurrent
        // writers (unlikely — cron path and MDS path don't overlap in
        // practice) from clobbering each other's tempfile before rename.
        $tmp = $this->path . '.tmp.' . getmypid();
        $bytes = @file_put_contents($tmp, $json, LOCK_EX);
        if ($bytes === false) {
            @unlink($tmp);
            return false;
        }

        // 0644 so the imunify360-agent (which may run as a different uid on
        // some panel deploys) can read it without escalating privileges.
        @chmod($tmp, 0644);

        if (!@rename($tmp, $this->path)) {
            @unlink($tmp);
            return false;
        }
        return true;
    }

    public function getPath()
    {
        return $this->path;
    }
}
<?php
/**
 * RemoteStatsReport class file.
 */

namespace AppVersionDetector\Report;

use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Event\ScanningStartedEvent;
use AppVersionDetector\Event\ScanningEndedEvent;
use AppVersionDetector\Event\ScanningDirStartedEvent;
use AppVersionDetector\Event\ScanningDirEndedEvent;
use AppVersionDetector\Core\OutdatedDetection\OutdatedEvent;
use AppVersionDetector\Report\Includes\LastRunOutcomeWriter;
use AppVersionDetector\Report\Includes\RemoteStatsRequest;
use AppVersionDetector\Scanner;
use SplFileInfo;

/**
 * Class RemoteStatsReport.
 *
 * Emits one record per scanned directory (matching the per-directory grain of
 * the local SQLite report). Each record carries that directory's apps, its own
 * `duration_ms`, and per-app `status`, and becomes a single row in the
 * `app_version_info` ClickHouse table via the v3 endpoint. Records are flushed
 * in batches bounded by total app count to keep request volume low.
 */
class RemoteStatsReport extends AbstractReport
{

    const MAX_APPS_PER_REQUEST = 1000;

    /**
     * @var RemoteStatsRequest
     */
    private $request = null;

    /**
     * @var LastRunOutcomeWriter|null
     */
    private $outcomeWriter = null;

    /**
     * @var string Scan-wide system id (set once at scan start).
     */
    private $systemId = '';

    /**
     * @var string|null Scan-wide scan id.
     */
    private $scanId = null;

    /**
     * @var int|null Scan-wide timestamp (seconds).
     */
    private $timestamp = null;

    /**
     * @var int|null UID of the process running the scan.
     */
    private $uid = null;

    /**
     * @var string Domain of the directory currently being scanned.
     */
    private $domain = '';

    /**
     * @var string Path of the directory currently being scanned.
     */
    private $currentDirpath = '';

    /**
     * @var array Apps detected in the directory currently being scanned.
     */
    private $currentApps = [];

    /**
     * @var int Number of apps detected in the current directory.
     */
    private $folderCounter = 0;

    /**
     * @var int|float|null Monotonic start of the current directory scan (hrtime ns).
     */
    private $hrtimeStarted = null;

    /**
     * @var array Records buffered for the next request.
     */
    private $batch = [];

    /**
     * @var int Total apps across the buffered $batch.
     */
    private $batchAppCount = 0;

    /**
     * RemoteStatsReport constructor.
     *
     * @param RemoteStatsRequest $request
     * @param LastRunOutcomeWriter|null $outcomeWriter DEF-51827: optional
     *        writer that persists the outcome of the most recent HTTP flush
     *        to a well-known JSON file at scan end. When null (the pre-DEF
     *        default), no outcome file is written — preserves backward
     *        compat for any caller that instantiates the report directly.
     */
    public function __construct($request, ?LastRunOutcomeWriter $outcomeWriter = null)
    {
        $this->request       = $request;
        $this->outcomeWriter = $outcomeWriter;
    }

    /**
     * Reacts on a detection event.
     *
     * @param DetectionEvent $event
     */
    protected function reactOnDetection(DetectionEvent $event)
    {
        $this->currentApps[] = [
            'name'      => $event->getName(),
            'version'   => $event->getVersion(),
            'path'      => $event->getPath()->getPathname(),
            'uid'       => $event->getUID(),
            'domain'    => $this->domain,
            'status'    => $event->getStatus(),
        ];
        $this->folderCounter++;
    }

    /**
     * Reacts on an outdated software detection event.
     *
     * @param OutdatedEvent $event
     */
    protected function reactOnOutdatedDetected(OutdatedEvent $event)
    {
    }

    /**
     * Reacts on start-scanning event.
     *
     * @param ScanningStartedEvent $event
     */
    protected function reactOnStartScanning(ScanningStartedEvent $event)
    {
        $this->systemId    = $this->getSystemId();
        $this->scanId      = $event->getScanId();
        $this->timestamp   = time();
        $this->uid         = getmyuid();
    }

    /**
     * Reacts on start-dir-scanning event.
     *
     * @param ScanningDirStartedEvent $event
     */
    protected function reactOnStartDirScanning(ScanningDirStartedEvent $event)
    {
        $this->folderCounter    = 0;
        $this->currentApps      = [];
        $this->hrtimeStarted    = hrtime(true);
        $this->domain           = $event->getDirectory()->getDomain();
        $this->currentDirpath   = $event->getDirectory()->getPath();
    }

    /**
     * Reacts on the end-dir-scanning event.
     *
     * Finalises the record for the directory that just finished: computes its
     * `duration_ms`, adds an `unknown_app` placeholder if nothing was detected,
     * and buffers it for the end-of-scan flush.
     *
     * @param ScanningDirEndedEvent $event
     */
    protected function reactOnEndDirScanning(ScanningDirEndedEvent $event)
    {
        $durationMs = is_null($this->hrtimeStarted)
            ? null
            : (int)round((hrtime(true) - $this->hrtimeStarted) / 1e6);

        if ($this->folderCounter === 0) {
            $dirpathOwner = file_exists($this->currentDirpath) ? @fileowner($this->currentDirpath) : null;
            $this->currentApps[] = [
                'name'      => 'unknown_app',
                'version'   => 'unknown_version',
                'path'      => $this->currentDirpath,
                'uid'       => $dirpathOwner,
                'domain'    => $this->domain,
                'status'    => '',
            ];
        }

        // Split a directory carrying more than MAX_APPS_PER_REQUEST apps
        // (multisite, script farm) into several records so no single request is
        // oversized; each chunk repeats the per-record fields.
        foreach (array_chunk($this->currentApps, self::MAX_APPS_PER_REQUEST) as $appsChunk) {
            $this->addRecord([
                'system_id'   => $this->systemId,
                'scan_id'     => $this->scanId,
                'uid'         => $this->uid,
                'timestamp'   => $this->timestamp,
                'duration_ms' => $durationMs,
                'apps'        => $appsChunk,
            ]);
        }

        // Clear per-directory state so a spurious End without a matching Start
        // (event replay, error unwind) cannot reuse a stale start hrtime or
        // misattribute an unknown_app placeholder to the previous directory.
        $this->hrtimeStarted  = null;
        $this->currentApps    = [];
        $this->currentDirpath = '';
        $this->domain         = '';
    }

    /**
     * Buffer a record and flush the batch before it would exceed the app ceiling,
     * so the buffer never grows to hold the whole scan (records are sent as
     * directories complete rather than all at end-of-scan).
     *
     * @param array $record
     */
    private function addRecord(array $record)
    {
        $count = count($record['apps']);
        if (!empty($this->batch) && $this->batchAppCount + $count > self::MAX_APPS_PER_REQUEST) {
            $this->flush();
        }
        $this->batch[]        = $record;
        $this->batchAppCount += $count;
        if ($this->batchAppCount >= self::MAX_APPS_PER_REQUEST) {
            $this->flush();
        }
    }

    /**
     * Send the buffered batch (if any) and reset it.
     */
    private function flush()
    {
        if (empty($this->batch)) {
            return;
        }
        $this->request->request($this->batch);
        $this->batch         = [];
        $this->batchAppCount = 0;
    }

    /**
     * Get system id from CloudLinux OS
     *
     * @return string
     */
    public function getSystemId()
    {
        $config_filepath = '/etc/sysconfig/rhn/systemid';
        $system_id = '';
        if (!file_exists($config_filepath)) {
            return $system_id;
        }
        $content = @file_get_contents($config_filepath);
        if (preg_match('~<name>\s*system_id\s*</name>\s*<value>\s*<string>\s*([^<]+)\s*</string>~is', $content, $m)) {
            $system_id = $m[1];
        }
        return $system_id;
    }

    /**
     * Reacts on the end-scanning event: flush whatever records remain buffered.
     *
     * @param ScanningEndedEvent $event
     */
    protected function reactOnEndScanning(ScanningEndedEvent $event)
    {
        $this->flush();
        $this->writeLastRunOutcome();
    }

    /**
     * DEF-51827: persist the outcome of the last HTTP flush so a downstream
     * operator or the imunify360-agent can distinguish "silently exited 0
     * having reached the API" from "silently exited 0 with a timeout".
     *
     * No-op when either the writer or the outcome record is unavailable
     * (writer wasn't injected, or nothing was sent this scan).
     */
    private function writeLastRunOutcome()
    {
        if ($this->outcomeWriter === null) {
            return;
        }
        $outcome = $this->request->getLastOutcome();
        if ($outcome === null) {
            return;
        }
        $this->outcomeWriter->write(array_merge(
            [
                'ts'          => gmdate('Y-m-d\TH:i:s\Z'),
                'scan_id'     => $this->scanId,
                'system_id'   => $this->systemId,
                'avd_version' => Scanner::VERSION,
            ],
            $outcome
        ));
    }
}
<?php
/**
 * SqliteDbReport class file.
 */

namespace AppVersionDetector\Report;

use AppVersionDetector\Core\OutdatedDetection\OutdatedEvent;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Event\ScanningStartedEvent;
use AppVersionDetector\Event\ScanningDirStartedEvent;
use AppVersionDetector\Event\ScanningDirEndedEvent;
use AppVersionDetector\Event\ScanningEndedEvent;
use AppVersionDetector\Storage\SqliteDbReportConnection;

use AppVersionDetector\Core\VersionDetection\Detector\WpCoreDetector;
use AppVersionDetector\Core\VersionDetection\Detector\WpPluginDetector;
use AppVersionDetector\Core\VersionDetection\Detector\WpThemeDetector;
use AppVersionDetector\Core\VersionDetection\Detector\WpMuPluginDetector;
use AppVersionDetector\Core\VersionDetection\Detector\JoomlaCoreDetector;
use AppVersionDetector\Core\VersionDetection\Detector\JoomlaPluginDetector;
use AppVersionDetector\Core\VersionDetection\Detector\DrupalCoreDetector;
use AppVersionDetector\Core\VersionDetection\Detector\DrupalPluginDetector;
use AppVersionDetector\Core\VersionDetection\Detector\CommonScriptDetector;
use AppVersionDetector\Core\VersionDetection\Detector\NodeJsAppDetector;
use AppVersionDetector\Core\VersionDetection\Detector\NodeJsPackageDetector;

/**
 * Class SqliteDbReport.
 */
class SqliteDbReport extends AbstractReport
{
    /**
     * @var SqliteDbReportConnection
     */
    private $connection;
    
    /**
     * @var array
     */
    private $data = [];

    /**
     * @var int
     */
    private $uid = null;

    /**
     * @var string
     */
    private $dir = '';
    
    /**
     * @var string
     */
    private $scanId;

    /**
     * @var string
     */
    private $domain;

    /**
     * @var \AppVersionDetector\Application\Directory
     */
    private $directory;

    /**
     * @var array
     */
    private $parenthood = [
        WpCoreDetector::class => [
            WpPluginDetector::class   => '',
            WpThemeDetector::class    => '',
            WpMuPluginDetector::class => '',
        ],
        DrupalCoreDetector::class => [
            DrupalPluginDetector::class => '',
        ],
        JoomlaCoreDetector::class => [
            JoomlaPluginDetector::class => '',
        ],
        NodeJsAppDetector::class => [
            NodeJsPackageDetector::class => '',
        ],
    ];

    /**
     * @var int
     */
    private $timestampStarted;

    /**
     * @var int
     */
    private $timestampEnded;

    /**
     * @var int|float Monotonic start of the current directory scan (hrtime nanoseconds).
     */
    private $hrtimeStarted;

    /**
     * SqliteDbReport constructor.
     *
     * @param SqliteDbReportConnection $connection
     */
    public function __construct(SqliteDbReportConnection $connection)
    {
        $this->connection = $connection;
    }

    /**
     * Reacts on a detection event.
     *
     * @param DetectionEvent $event
     */
    protected function reactOnDetection(DetectionEvent $event)
    {
        $senderClass    = get_class($event->getSender());
        $path           = (string)$event->getPath();
        $realPath       = realpath($path);
        $filename       = ($senderClass == CommonScriptDetector::class ? basename($path) : null);
        
        $this->data[]   = [
            'appName'           => $event->getName(),
            'appVersion'        => $event->getVersion(),
            'appPath'           => $path,
            'appFilename'       => $filename,
            'appUID'            => $event->getUID(),
            'appRealPath'       => $realPath,
            'appSenderClass'    => $senderClass,
            'appStatus'         => $event->getStatus(),
        ];
    }

    /**
     * Reacts on start-scanning event.
     *
     * @param ScanningStartedEvent $event
     */
    protected function reactOnStartScanning(ScanningStartedEvent $event)
    {
        $this->scanId = $event->getScanId();
    }
    
    /**
     * Reacts on start-dir-scanning event.
     *
     * @param ScanningDirStartedEvent $event
     */
    protected function reactOnStartDirScanning(ScanningDirStartedEvent $event)
    {
        $this->timestampStarted = time();
        $this->hrtimeStarted    = hrtime(true);
        $this->directory        = $event->getDirectory();
        $this->dir              = $this->directory->getPath();
        $this->domain           = $this->directory->getDomain();
        $this->uid              = $this->directory->getOwner();
        $this->data             = [];
    }

    /**
     * Reacts on the end-dir-scanning event.
     *
     * @param ScanningDirEndedEvent $event
     */
    protected function reactOnEndDirScanning(ScanningDirEndedEvent $event)
    {
        $this->timestampEnded   = time();
        // A ScanningDirEndedEvent without a matching Start (event replay, error
        // unwind, or a double-End) would otherwise compute `hrtime(true) - null`
        // ~= 10^11 ms. Guard on the start marker and clear it afterwards so a
        // second End cannot reuse a stale start.
        $durationMs             = is_null($this->hrtimeStarted)
            ? null
            : (int)round((hrtime(true) - $this->hrtimeStarted) / 1e6);
        $this->hrtimeStarted    = null;

        $reportData             = [];
        $parent                 = null;
        $lastParentIndex        = null;
        $i                      = 0;
        
        foreach ($this->data as $app) {
            if ($this->isParent($app)) {
                $parent             = $app;
                $reportData[$i]     = $app;
                $lastParentIndex    = $i;
                $i++;
            }
            elseif($parent && $this->isSubApp($parent, $app)) {
                $reportData[$lastParentIndex]['subApp'][] = $app;
            }
            else {
                $reportData[$i] = $app;
                $i++;
            }
        }        
        
        $this->connection->insertDirData($this->scanId, $this->timestampStarted, $this->timestampEnded, $this->uid, $this->dir, $this->domain, $reportData, $durationMs);
        $this->connection->clearOutdatedData($this->dir);
    }
    
    /**
     * Reacts on an outdated software detected.
     *
     * @param OutdatedEvent $event
     */
    protected function reactOnOutdatedDetected(OutdatedEvent $event)
    {
    }

    /**
     * Reacts on the end-scanning event.
     *
     * @param ScanningEndedEvent $event
     * 
     * @throws \Exception
     */
    protected function reactOnEndScanning(ScanningEndedEvent $event)
    {
    }

    /**
     * Is current app parent
     *
     * @param array $app
     * 
     * @return bool
     */
    private function isParent($app): bool
    {
        return isset($this->parenthood[$app['appSenderClass']]);
    }
    
    /**
     * Is current app child for $parentApp
     *
     * @param array $parentApp
     * @param array $subApp
     * 
     * @return bool
     */
    private function isSubApp($parentApp, $subApp): bool
    {
        if (!isset($this->parenthood[$parentApp['appSenderClass']])) {
            return false;
        }
        if (!isset($this->parenthood[$parentApp['appSenderClass']][$subApp['appSenderClass']])) { 
            return false;
        }
        if (strpos($subApp['appPath'], $parentApp['appPath']) === 0) {
            return true;
        }
        return false;
    }
}<?php
/**
 * TextReport class file.
 */

namespace AppVersionDetector\Report;

use AppVersionDetector\Core\OutdatedDetection\OutdatedEvent;
use AppVersionDetector\Core\VersionDetection\DetectionEvent;
use AppVersionDetector\Event\ScanningEndedEvent;
use AppVersionDetector\Event\ScanningStartedEvent;
use AppVersionDetector\Event\ScanningDirStartedEvent;
use AppVersionDetector\Event\ScanningDirEndedEvent;

/**
 * Class TextReport.
 */
class TextReport extends AbstractFileBasedReport
{
    /**
     * Reacts on a detection event.
     *
     * @param DetectionEvent $event
     */
    protected function reactOnDetection(DetectionEvent $event)
    {
        $this->write("{$event->getName()} (ver: {$event->getVersion()}) has been detected at {$event->getPath()->getPathname()}");
    }

    /**
     * Reacts on start-scanning event.
     *
     * @param ScanningStartedEvent $event
     */
    protected function reactOnStartScanning(ScanningStartedEvent $event)
    {
        $this->write("Scanner version: {$event->getScannerVersion()}");
    }

    /**
     * Reacts on start-dir-scanning event.
     *
     * @param ScanningDirStartedEvent $event
     */
    protected function reactOnStartDirScanning(ScanningDirStartedEvent $event)
    {
        $this->write("Started scanning against {$event->getDirectory()->getPath()} at " . date('r'));
    }
    
    /**
     * Reacts on the end-dir-scanning event.
     *
     * @param ScanningDirEndedEvent $event
     */
    protected function reactOnEndDirScanning(ScanningDirEndedEvent $event)
    {
    }
    
    
    /**
     * Reacts on an outdated software detected.
     *
     * @param OutdatedEvent $event
     */
    protected function reactOnOutdatedDetected(OutdatedEvent $event)
    {
        $this->write("{$event->getName()} (ver: {$event->getVersion()}) is outdated (type: {$event->getType()}).");
    }

    /**
     * Writes a message to console.
     *
     * @param $message
     */
    protected function write($message)
    {
        file_put_contents($this->targetFile, $message . PHP_EOL, FILE_APPEND);
    }

    /**
     * Reacts on the end-scanning event.
     *
     * @param ScanningEndedEvent $event
     */
    protected function reactOnEndScanning(ScanningEndedEvent $event)
    {
    }
}<?php
/**
 * ScanningStartedEvent class file.
 */

namespace AppVersionDetector\Event;


use AppVersionDetector\Core\AbstractEvent;

/**
 * Class ScanningStartedEvent.
 */
class ScanningStartedEvent extends AbstractEvent
{
    /**
     * @var string
     */
    private $scannerVersion;
    
    /**
     * @var string
     */
    private $scan_id;

    /**
     * ScanningStartedEvent constructor.
     *
     * @param object $sender
     * @param string $scannerVersion
     * @param string $scanId
     */
    public function __construct($sender, $scannerVersion, $scanId)
    {
        $this->setSender($sender);
        $this->scannerVersion   = $scannerVersion;
        $this->scan_id          = $scanId;
    }

    /**
     * @return string
     */
    public function getScannerVersion(): string
    {
        return $this->scannerVersion;
    }

    /**
     * @return string
     */
    public function getScanId(): string
    {
        return $this->scan_id;
    }
}
<?php
/**
 * ScanningEndedEvent class file.
 */

namespace AppVersionDetector\Event;

use AppVersionDetector\Core\AbstractEvent;

/**
 * Class ScanningEndedEvent.
 */
class ScanningEndedEvent extends AbstractEvent
{
    /**
     * @var string
     */
    private $scanId;

    /**
     * ScanningEndedEvent constructor.
     *
     * @param object $sender
     * @param $scanId
     */
    public function __construct($sender, $scanId)
    {
        $this->setSender($sender);
        $this->scanId = $scanId;
    }

    /**
     * @return string
     */
    public function getScanId(): string
    {
        return $this->scanId;
    }
}
<?php
/**
 * ScanningDirStartedEvent class file.
 */

namespace AppVersionDetector\Event;

use AppVersionDetector\Application\Directory;
use AppVersionDetector\Core\AbstractEvent;

/**
 * Class ScanningDirStartedEvent.
 */
class ScanningDirStartedEvent extends AbstractEvent
{
    /**
     * @var string
     */
    private $scannerVersion;
    
    /**
     * @var string
     */
    private $directory;
    
    /**
     * ScanningDirStartedEvent constructor.
     *
     * @param object $sender
     * @param string $scannerVersion
     * @param string $directory
     */
    public function __construct($sender, $scannerVersion, Directory $directory)
    {
        $this->setSender($sender);
        $this->scannerVersion   = $scannerVersion;
        $this->directory        = $directory;
    }

    /**
     * @return string
     */
    public function getScannerVersion(): string
    {
        return $this->scannerVersion;
    }

    /**
     * @return string
     */
    public function getDirectory(): Directory
    {
        return $this->directory;
    }
    
    /**
     * @return int
     */
    public function getDirectoryOwner(): int
    {
        return $this->directory->getOwner();
    }
    
    /**
     * @return string
     */
    public function getDirectoryDomain(): string
    {
        return $this->directory->getDomain();
    }
}
<?php
/**
 * EventManager class file.
 */

namespace AppVersionDetector\Event;

use AppVersionDetector\Core\AbstractEvent;
use AppVersionDetector\Core\ListenerInterface;
use AppVersionDetector\Core\PublisherInterface;
use SplObjectStorage;

/**
 * Class EventManager.
 */
class EventManager implements PublisherInterface
{
    /**
     * @var ListenerInterface[][] list of listeners
     */
    private $listeners;

    /**
     * Subscribe a listener on events.
     *
     * Usage example:
     * $eventManger->subscribe(SomeEvent::class, $listener);
     *
     * @param string $eventType
     * @param ListenerInterface $listener
     */
    public function subscribe($eventType, ListenerInterface $listener)
    {
        $this->listeners[$eventType][] = $listener;
    }

    /**
     * An event sender publish an event using this method.
     *
     * @param AbstractEvent $event
     */
    public function update(AbstractEvent $event)
    {
        foreach ($this->getListeners($event) as $listener) {
            $listener->notify($event);
        }
    }

    /**
     * Returns a list of listeners for a particular event class.
     *
     * @param AbstractEvent $event
     * @return SplObjectStorage|ListenerInterface[]
     */
    private function getListeners(AbstractEvent $event)
    {
        $listeners = new SplObjectStorage();

        foreach ($this->listeners as $eventType => $eventListeners) {
            if ($event instanceof $eventType) {
                array_walk($eventListeners, function ($event) use ($listeners) {
                    $listeners[$event] = null;
                });
            }
        }

        return $listeners;
    }
}<?php
/**
 * ScanningDirEndedEvent class file.
 */

namespace AppVersionDetector\Event;

use AppVersionDetector\Core\AbstractEvent;

/**
 * Class ScanningDirEndedEvent.
 */
class ScanningDirEndedEvent extends AbstractEvent
{
    /**
     * ScanningDirEndedEvent constructor.
     *
     * @param object $sender
     */
    public function __construct($sender)
    {
        $this->setSender($sender);
    }
}
<?php
/**
 * AppException class file.
 */

namespace AppVersionDetector\Application;

use Exception;
use Throwable;

/**
 * Class ConfigException.
 */
class AppException extends Exception
{
    const EXCEPTION_UNKNOWN = 1;
    const EXCEPTION_CONFIG  = 2;

    public function __construct(string $message = "", int $code = 0, ?Throwable $previous = null)
    {
        $code = !$code ? self::EXCEPTION_UNKNOWN : $code;
        parent::__construct($message, $code, $previous);
    }
}<?php

namespace AppVersionDetector\Application;

/*
 * Abstract class for parse cli command
 */
abstract class CliParse
{
    /**
     * @var Config Config for fill
     */
    protected $config = null;
    
    /**
     * @var array List of options. Example of one element: ['short' => 'v', 'long' => 'version,ver', 'needValue' => false]
     */
    protected $opts     = [];
    
    /**
     * @var array Current of options from $argv
     */
    private $options    = [];
    
    /**
     * @var array Arguments left after getopt() processing
     */
    private $freeAgrs   = [];
    
    /**
     * Construct
     *
     * @param array $argv
     * @param Config $config
     * @throws ConfigParamException
     */
    public function __construct($argv, Config $config)
    {
        $this->config   = $config;
        $cliLongOpts    = [];
        $cliShortOpts   = [];
        foreach ($this->opts as $params) {
            $postfix = $params['needValue'] === 0 ? '::' : ($params['needValue'] ? ':' : '');
            if ($params['long']) {
                $cliLongOpts = array_merge($cliLongOpts, $this->getMultiOpts($params['long'], $postfix));
            }
            if ($params['short']) {
                $cliShortOpts = array_merge($cliShortOpts, $this->getMultiOpts($params['short'], $postfix));
            }
        }
        $this->parseOptions($argv, $cliShortOpts, $cliLongOpts);
        $this->parse();
    }
    
    /**
     * Parse comand line params
     */
    abstract protected function parse();

    /**
     * Checking if the parameter was used in the cli line
     *
     * @param string $paramKey
     * @return bool
     * @throws ConfigParamException
     */
    protected function issetParam($paramKey)
    {
        if (!isset($this->opts[$paramKey])) {
            throw new ConfigParamException('An invalid option requested.');
        }
        if ($this->getExistingOpt($this->opts[$paramKey]['long'])) {
            return true;
        }
        elseif ($this->getExistingOpt($this->opts[$paramKey]['short'])) {
            return true;
        }
        return false;
    }

    /**
     * Checking if the parameter was used in the cli line
     *
     * @param string $paramKey
     * @return bool
     * @throws ConfigParamException
     */
    protected function getParamValue($paramKey, $default = null)
    {
        if (!isset($this->opts[$paramKey])) {
            throw new ConfigParamException('An invalid option requested.');
        }
        $existingLongOpt = $this->getExistingOpt($this->opts[$paramKey]['long']);
        if ($existingLongOpt) {
            return $this->options[$existingLongOpt];
        }
        $existingShortOpt = $this->getExistingOpt($this->opts[$paramKey]['short']);
        if ($existingShortOpt) {
            return $this->options[$existingShortOpt];
        }
        return $default;
    }

    /**
     * Return free arguments after using getopt()
     *
     * @return array
     */
    protected function getFreeAgrs()
    {
        return $this->freeAgrs;
    }
    
    
    /**
     * Parse by getopt() and fill vars: $this->options $this->freeAgrs
     * 
     * @return void
     */
    private function parseOptions($argv, $cliShortOpts, $cliLongOpts)
    {
        if (count($argv) <= 1) {
            return;
        }
        $this->options  = getopt(implode('', $cliShortOpts), $cliLongOpts);
        //$this->freeAgrs = array_slice($argv, $optind); // getopt(,,$optind) only for PHP7.1 and upper
        
        for($i = 1; $i < count($argv); $i++) {
            if (strpos($argv[$i], '-') !== 0) {
                $this->freeAgrs = array_slice($argv, $i);
                break;
            }
        }
    }

    /**
     * Clean cli parameter
     *
     * @param string $optName Paramenter may be with ":" postfix
     * @return array
     */
    private function getCleanOptName($optName)
    {
        return str_replace(':', '', $optName);
    }
    
    /**
     * Return options with or without ":" postfix
     *
     * @param array $optString String with one or more options separated by ","
     * @param bool $addPostfix True if need add postfix
     * @return array Array list of options
     */
    private function getMultiOpts($optString, $addPostfix = false)
    {
        $opts = explode(',', $optString);
        $opts = array_map(function($value) use ($addPostfix) {
            return $value . $addPostfix;
        }, $opts);
        return $opts;
    }
    
    /**
     * Return existing options from string. 
     *
     * @param string $optsString String with one or more options separated by ","
     * @return string|bool Name of finded options in getopt()
     */
    private function getExistingOpt($optsString)
    {
        $opts = $this->getMultiOpts($optsString);
        foreach ($opts as $opt) {
            if (isset($this->options[$opt])) { 
                return $opt;
            }
        }
        return false;
    }
}<?php
/**
 * ErrorHandler class file.
 */

namespace AppVersionDetector\Application\Error;

use AppVersionDetector\Application\ConfigParamException;
use AppVersionDetector\Application\AppException;
use Throwable;

/**
 * Class ErrorHandler.
 */
class ErrorHandler
{
    const ERRNUM_CONFIG_PARAM_EXCEPTION = 1;
    const ERRNUM_APP_EXCEPTION          = 2;
    
    /**
     * Handle an error.
     *
     * @param int $errno
     * @param string $errstr
     */
    public function handleError(string $errno, string $errstr)
    {
        // Respect the @ error-suppression operator. PHP 8 keeps a non-zero
        // error_reporting() inside @-suppressed calls, so check the masked
        // bit for the current error rather than `=== 0`.
        if (!(error_reporting() & (int)$errno)) {
            return false;
        }
        $this->appDie($errno, 'An unknown error occurred!'  . ' Error code: [' . $errno . '] Message: ' . $errstr . PHP_EOL);
    }

    /**
     * Handles an exception.
     *
     * @param Throwable $exception
     */
    public function handleException(Throwable $exception)
    {
        if ($exception instanceOf ConfigParamException) {
            $message = 'Configuration error: ' . $exception->getMessage() . PHP_EOL;
            $message .= 'Usage example: php app-version-detector.phar OPTIONS SCAN_DIR' . PHP_EOL;
            $this->appDie(self::ERRNUM_CONFIG_PARAM_EXCEPTION, $message);
        }
        elseif ($exception instanceOf AppException) {
            $message = 'Application error: ' . $exception->getMessage() . '. Code: ' . $exception->getCode() . PHP_EOL;
            $this->appDie(self::ERRNUM_APP_EXCEPTION, $message);
        }
        else {
            $this->appDie($exception->getCode(), 'An unknown error occurred! Code: ' . $exception->getCode() . ' Message: ' . $exception->getMessage() . PHP_EOL);
        }
    }

    /**
     * Die process
     * 
     * @param int $errno
     * @param string $errstr
    */    
    private function appDie(int $errno, string $errstr)
    {
        fwrite(STDERR, $errstr);
        exit($errno);
    }
}<?php

namespace AppVersionDetector\Application;

/**
 * Class file with static stats data
 */
class Stats 
{
    /**
     * @var bool Accumulate stats or not
     */
    private static $accumulateStats     = false;

    /**
     * @var int The value of memory with which we begin
     */
    private static $memoryUsageStart    = 0;

    /**
     * @var int The value of memory with which we end
     */
    private static $memoryUsageEnd      = 0;

    /**
     * @var int Peak usage memory
     */
    private static $memoryUsagePeak     = 0;
    
    /**
     * @var int Count of readed files
     */
    private static $countFilesReaded    = 0;

    /**
     * @var int Count of opened directories
     */
    private static $countDirsOpened     = 0;

    /**
     * @var int Count of iterated files in diretory
     */
    private static $countFilesIteration = 0;


    /**
     * Set on for accumulate stats
     *
     * @return void
     */
    public static function onAccumulateStats()
    {
        self::$accumulateStats = true;
    }

    /**
     * Set off for accumulate stats
     *
     * @return void
     */
    public static function offAccumulateStats()
    {
        self::$accumulateStats = false;
    }
    
    /**
     * Do we accumulate stats
     *
     * @return bool
     */
    public static function isAccumulateStats()
    {
        return self::$accumulateStats;
    }

    /**
     * To record the current value of the used memory
     *
     * @return void
     */
    public static function setCurrentMemoryUsageStart()
    {
        if (!self::$accumulateStats) {
            return;
        }
        self::$memoryUsageStart = memory_get_usage(true);
    }

    /**
     * Return the amount of memory used at the beginning
     *
     * @return int
     */
    public static function getMemoryUsageStart()
    {
        return self::$memoryUsageStart;
    }
    
    /**
     * To record the peak value of the used memory
     *
     * @return int
     */
    public static function setCurrentMemoryUsagePeak()
    {
        if (!self::$accumulateStats) {
            return;
        }
        self::$memoryUsagePeak = memory_get_usage(true);
    }
    
    /**
     * Return the amount of memory used in the peak
     *
     * @return int
     */
    public static function getMemoryUsagePeak()
    {
        
        return self::$memoryUsagePeak;
    }
    
    /**
     * To record the current value of the used memory. 
     *
     * @return void
     */
    public static function setCurrentMemoryUsageEnd()
    {
        if (!self::$accumulateStats) {
            return;
        }
        self::$memoryUsageEnd = memory_get_peak_usage(true);
    }
    
    /**
     *  Return the amount of memory used in the end
     *
     * @return int
     */
    public static function getMemoryUsageEnd()
    {
        return self::$memoryUsageEnd;
    }
    
    /**
     * Increment file readed counter 
     *
     * @return void
     */
    public static function incrementCountFilesReaded()
    {
        self::$countFilesReaded++;
    }
    
    /**
     * Return file readed counter 
     *
     * @return int
     */
    public static function getCountFilesReaded()
    {
        return self::$countFilesReaded;
    }

    /**
     * Increment dir opened counter 
     *
     * @return void
     */
    public static function incrementCountDirsOpened()
    {
        self::$countDirsOpened++;
    }
    
    /**
     * Return dir opened counter 
     *
     * @return int
     */
    public static function getCountDirsOpened()
    {
        return self::$countDirsOpened;
    }

    /**
     * Increment file iteration counter 
     *
     * @return void
     */
    public static function incrementCountFilesIteration()
    {
        self::$countFilesIteration++;
    }
    
    /**
     * Return file iteration counter 
     *
     * @return int
     */
    public static function getCountFilesIteration()
    {
        return self::$countFilesIteration;
    }
}<?php

namespace AppVersionDetector\Application;

/**
 * Helper class
 */
class Helper
{
    /**
     * Name of the directory an npm-compatible installer puts packages in.
     *
     * Shared by the two sides of Node.js support: Scanner never descends into
     * it, and the Node.js detectors read package versions out of it directly.
     *
     * @var string
     */
    const NODE_MODULES_DIR = 'node_modules';

    /**
     * Read part of file end return this data
     *
     * @param string $filepath
     * @param int $bytes
     * @param int $start
     * @param int|null $requireUid When set, the data is returned only if the opened
     *                 descriptor is owned by this uid. The ownership check is done
     *                 via fstat on the same fd that is read, so a path swap between
     *                 an external check and this open cannot redirect the read.
     * @return string
     */
    public static function getPartOfFile($filepath, $bytes, $start = 0, $requireUid = null)
    {
        // PHP 8 makes fread($fp, 0) a ValueError, but the legacy
        // file_get_contents-based contract treated 0-byte reads as ''. Preserve
        // that to avoid surprising callers that pass a computed length.
        if ($bytes <= 0) {
            return '';
        }
        $expected = self::statSafeRegularFile($filepath);
        if ($expected === false) {
            return '';
        }
        // Open then fstat the descriptor so a path swap (regular file ->
        // symlink to /etc/shadow) between the lstat above and the open below
        // is caught: fopen would follow the symlink to a different inode, and
        // the dev/ino check rejects it before any bytes are read.
        $fp = @fopen($filepath, 'rb');
        if ($fp === false) {
            return '';
        }
        try {
            $actual = @fstat($fp);
            if ($actual === false
                || ($actual['mode'] & 0170000) !== 0100000
                || $actual['dev'] !== $expected['dev']
                || $actual['ino'] !== $expected['ino']
                || ($requireUid !== null && (int)$actual['uid'] !== (int)$requireUid)
            ) {
                return '';
            }
            if ($start !== 0) {
                $whence = $start < 0 ? SEEK_END : SEEK_SET;
                if (fseek($fp, $start, $whence) !== 0) {
                    return '';
                }
            }
            $data = fread($fp, $bytes);
            return $data === false ? '' : $data;
        } finally {
            fclose($fp);
        }
    }

    /**
     * Reject paths that would let a tenant trick the root scanner into reading
     * arbitrary files (symlinks) or blocking forever (FIFOs / devices). Only
     * plain regular files outside pseudo-filesystems are allowed. Returns the
     * lstat array on success so the caller can verify the opened descriptor
     * still points at the same inode.
     */
    private static function statSafeRegularFile($filepath)
    {
        if (!is_string($filepath) || $filepath === '') {
            return false;
        }
        foreach (['/proc/', '/sys/', '/dev/'] as $prefix) {
            if (strncmp($filepath, $prefix, strlen($prefix)) === 0) {
                return false;
            }
        }
        $st = @lstat($filepath);
        if ($st === false || ($st['mode'] & 0170000) !== 0100000) {
            return false;
        }
        return $st;
    }

    /**
     * Try to read version from file $filepath with reading $len bytes and extract version with $regexp
     * @param $filepath
     * @param $len
     * @param $regexp
     * @param $start
     * @return mixed|string
     */
    public static function tryGetVersion($filepath, $len, $regexp, $start = 0)
    {
        if (file_exists($filepath) && is_file($filepath)) {
            Stats::incrementCountFilesReaded();
            $tmp_content = Helper::getPartOfFile($filepath, $len, $start);
            if (preg_match($regexp, $tmp_content, $tmp_ver)) {
                return $tmp_ver;
            }
        }
        return '';
    }
}<?php

namespace AppVersionDetector\Application;

use Exception;
use SQLite3;

/**
 * Class Migraitor.
 */
class Migraitor
{
    public function migrate(Config $config)
    {
        if ($config->get(AVDConfig::PARAM_SQLITE_DB_REPORT)) {
            $this->migrateSqliteDB($config->get(AVDConfig::PARAM_SQLITE_DB_REPORT));
        }
        $this->migrateSqliteDB('/var/imunify360/components_versions.sqlite3');
        $this->migrateSqliteDB('/var/lib/cloudlinux-app-version-detector/components_versions.sqlite3');
    }

    ////////////////////////////////////////////////////////////////////////////

    private function migrateSqliteDB($db_filepath)
    {
        if (!file_exists($db_filepath)) {
            return true;
        }
        $db_connection = $this->getConnection($db_filepath);
        if (!$db_connection) {
            return false;
        }
        $this->migrateSqliteDBAppUID($db_connection);
        $this->migrateSqliteDBAppRealPath($db_connection);
        $this->migrateSqliteDBAppDomain($db_connection);
        $this->migrateSqliteDBReportDurationMs($db_connection);
        $this->migrateSqliteDBAppStatus($db_connection);
        $this->migrateSqliteDBClearOutdatedData($db_connection);
    }

    private function migrateSqliteDBClearOutdatedData($db_connection)
    {
        $sql_count_outdated_data = 'SELECT count(*)
            FROM report
            WHERE id NOT IN (
	            SELECT max(id)
                FROM report
                GROUP BY dir
            )
        ';

        if (!$this->getOneValue($db_connection, $sql_count_outdated_data)) {
            return;
        }

        $db_connection->exec('PRAGMA foreign_keys=OFF');
        $db_connection->exec('BEGIN');
        $db_connection->exec('CREATE TABLE _report AS
            SELECT *
            FROM report
            WHERE id IN (
                SELECT max(id)
                FROM report
                GROUP BY dir
            )
        ');
        $db_connection->exec('CREATE TABLE _apps AS
            SELECT *
            FROM apps
            WHERE report_id IN (
                SELECT max(id)
                FROM report
                GROUP BY dir
            )
        ');
        $db_connection->exec('DELETE FROM apps');
        $db_connection->exec('DELETE FROM report');
        $db_connection->exec('INSERT INTO report  SELECT * FROM _report');
        $db_connection->exec('INSERT INTO apps    SELECT * FROM _apps');
        $db_connection->exec('DROP TABLE _apps');
        $db_connection->exec('DROP TABLE _report');
        $db_connection->exec('COMMIT');
        $db_connection->exec('PRAGMA foreign_keys=ON');
        $db_connection->exec('VACUUM');
    }

    private function migrateSqliteDBAppUID($db_connection)
    {
        if (!$this->haveColumn($db_connection, 'apps', 'app_uid')) {
            $this->addColumn($db_connection, 'apps', 'app_uid INTEGER DEFAULT NULL');
        }
    }

    private function migrateSqliteDBAppRealPath($db_connection)
    {
        if (!$this->haveColumn($db_connection, 'apps', 'real_path')) {
            $this->addColumn($db_connection, 'apps', 'real_path TEXT DEFAULT NULL');
        }
    }

    private function migrateSqliteDBAppDomain($db_connection)
    {
        if (!$this->haveColumn($db_connection, 'report', 'domain')) {
            $this->addColumn($db_connection, 'report', 'domain TEXT DEFAULT NULL');
        }
    }

    private function migrateSqliteDBReportDurationMs($db_connection)
    {
        if (!$this->haveColumn($db_connection, 'report', 'duration_ms')) {
            $this->addColumn($db_connection, 'report', 'duration_ms INTEGER DEFAULT NULL');
        }
    }

    private function migrateSqliteDBAppStatus($db_connection)
    {
        if (!$this->haveColumn($db_connection, 'apps', 'status')) {
            $this->addColumn($db_connection, 'apps', "status TEXT DEFAULT 'unknown'");
        }
    }

    private function getConnection($db_filepath)
    {
        return new \SQLite3($db_filepath);
    }

    private function haveColumn($db_connection, $table_name, $column_name)
    {
        $sql    = 'PRAGMA table_info("' . $table_name . '")';
        $stmt   = $db_connection->prepare($sql);
        $result = $stmt->execute();
        while ($row = $result->fetchArray(SQLITE3_ASSOC))
        {
            if ($row['name'] == $column_name) {
                return true;
            }
        }
        return false;
    }

    private function haveTable($db_connection, $table_name)
    {
        $sql = 'PRAGMA table_info("' . $table_name . '")';
        $stmt   = $db_connection->prepare($sql);
        $result = $stmt->execute();
        return (bool)$result->fetchArray();
    }

    private function addColumn($db_connection, $table_name, $column_params)
    {
        return @$db_connection->exec('ALTER TABLE ' . $table_name . ' ADD COLUMN ' . $column_params);
    }

    private function getOneValue($db_connection, $sql, $default = false)
    {
        $results = $db_connection->query($sql);
        $row = $results->fetchArray(SQLITE3_NUM);
        if (!$row) {
            return $default;
        }
        return $row[0];
    }
}
<?php
/**
 * DetectorBuilder class file.
 */

namespace AppVersionDetector\Application;

use AppVersionDetector\Core\VersionDetection\DependencyCollectionDetector;
use AppVersionDetector\Core\VersionDetection\DetectorInterface;
use AppVersionDetector\Core\VersionDetection\PlainCollectionDetector;
use AppVersionDetector\Core\VersionDetection\Detector\WpActivationResolver;

/**
 * Class DetectorBuilder.
 *
 * @package AppVersionDetector\Application
 */
class DetectorBuilder
{
    /**
     * @var FeatureFlags
     */
    private $featureFlags;

    /**
     * @param FeatureFlags|null $featureFlags Defaults to the agent sidecar reader.
     */
    public function __construct(FeatureFlags $featureFlags = null)
    {
        $this->featureFlags = $featureFlags ?: new FeatureFlags();
    }

    /**
     * @return DetectorInterface
     */
    public function build(WpActivationResolver $activationResolver = null)
    {
        $detector = new PlainCollectionDetector();

        // Drupal
        $drupalDependencyDetector = new DependencyCollectionDetector();
        $drupalDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\DrupalCoreDetector());
        $drupalDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\DrupalPluginDetector());
        $detector->add($drupalDependencyDetector);

        // Joomla
        $joomlaDependencyDetector = new DependencyCollectionDetector();
        $joomlaDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\JoomlaCoreDetector());
        $joomlaDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\JoomlaPluginDetector());
        $detector->add($joomlaDependencyDetector);

        // WordPress
        // One WpContentDirResolver shared by the plugin / theme / mu-plugin
        // detectors: its per-install cache is what limits the DEF-38597
        // wp-config.php parse to once per install per scan.
        $contentDirResolver = new \AppVersionDetector\Core\VersionDetection\Detector\WpContentDirResolver();
        $wpDependencyDetector = new DependencyCollectionDetector();
        $wpDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\WpCoreDetector());
        $wpDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\WpPluginDetector($activationResolver, $contentDirResolver));
        $wpDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\WpThemeDetector($activationResolver, $contentDirResolver));
        $wpDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\WpMuPluginDetector($activationResolver, $contentDirResolver));
        $detector->add($wpDependencyDetector);

        // Magento
        $magentoDependencyDetector = new DependencyCollectionDetector();
        $magentoDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\MagentoCoreDetector());
        $detector->add($magentoDependencyDetector);

        // IPB
        $ipbDependencyDetector = new DependencyCollectionDetector();
        $ipbDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\IPBCoreDetector());
        $detector->add($ipbDependencyDetector);

        // MODX
        $modxDependencyDetector = new DependencyCollectionDetector();
        $modxDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\ModxCoreDetector());
        $detector->add($modxDependencyDetector);

        // PHPBB3
        $phpbb3DependencyDetector = new DependencyCollectionDetector();
        $phpbb3DependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\PHPBB3CoreDetector());
        $detector->add($phpbb3DependencyDetector);

        // OsCommerce
        $oscomDependencyDetector = new DependencyCollectionDetector();
        $oscomDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\OsCommerceCoreDetector());
        $detector->add($oscomDependencyDetector);

        // Bitrix
        $bitrixDependencyDetector = new DependencyCollectionDetector();
        $bitrixDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\BitrixCoreDetector());
        $detector->add($bitrixDependencyDetector);

        // CommonScript
        $csDetector = new \AppVersionDetector\Core\VersionDetection\Detector\CommonScriptDetector();
        $detector->add($csDetector);

        // Node.js -- opt-in behind the agent feature flag, so the first rollout
        // can be widened per group and switched off without an AVD release.
        // One stateless PackageJsonReader shared by both detectors: it owns
        // the manifest reading plus the name and containment rules, so both
        // sides apply the same checks.
        if ($this->featureFlags->isEnabled(FeatureFlags::NODEJS_DETECTION_ENABLED)) {
            $packageJsonReader = new \AppVersionDetector\Core\VersionDetection\Detector\PackageJsonReader();
            $nodejsDependencyDetector = new DependencyCollectionDetector();
            $nodejsDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\NodeJsAppDetector($packageJsonReader));
            $nodejsDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\NodeJsPackageDetector($packageJsonReader));
            $detector->add($nodejsDependencyDetector);
        }

        // OpenCart
        $opencartDependencyDetector = new DependencyCollectionDetector();
        $opencartDependencyDetector->add(new \AppVersionDetector\Core\VersionDetection\Detector\OpenCartCoreDetector());
        $detector->add($opencartDependencyDetector);

        return $detector;
    }
}<?php

namespace AppVersionDetector\Application;

class FileOwners
{
    private $cache = [];
    
    public function getFileOwner($filepath)
    {
        if (!array_key_exists($filepath, $this->cache) && file_exists($filepath)) {
            $this->cache[$filepath] = @fileowner($filepath);
        }
        return $this->cache[$filepath];
    }
}<?php
/**
 * FeatureFlags class file.
 */

namespace AppVersionDetector\Application;

/**
 * Reader for the Imunify agent feature-flag sidecar.
 *
 * The agent syncs feature flags from the correlation server and writes the
 * enabled flag names to /var/imunify360/feature_flags, one name per line --
 * the plain-text sidecar the correlation docs recommend for readers outside
 * the agent process. A flag is enabled iff its name is present; a disabled
 * flag is simply absent.
 *
 * The file is read once per process. Anything that makes it untrusted -- it
 * does not exist, it is not a regular file, it is a symlink, it is owned by
 * neither root nor the current user, or it is world-writable -- means
 * "no flags", never an error: a host without the Imunify agent has no file
 * at all and must scan exactly as before. Group-writable is accepted: the
 * agent writes the sidecar as 0660 root:_imunify, its own service group.
 */
class FeatureFlags
{
    const DEFAULT_PATH = '/var/imunify360/feature_flags';

    /** Opt-in for Node.js application and package detection. */
    const NODEJS_DETECTION_ENABLED = 'avd_nodejs_detection_enabled';

    /** Upper bound on the sidecar read; the real file is a few short lines. */
    const MAX_BYTES = 65536;

    /** @var string */
    private $path;

    /** @var string[]|null Enabled flag names, loaded on first use. */
    private $names = null;

    /**
     * @param string $path Sidecar path; overridable for tests only.
     */
    public function __construct(string $path = self::DEFAULT_PATH)
    {
        $this->path = $path;
    }

    /**
     * @param string $flag
     * @return bool
     */
    public function isEnabled(string $flag): bool
    {
        if ($this->names === null) {
            $this->names = $this->load();
        }
        return in_array($flag, $this->names, true);
    }

    /**
     * @return string[]
     */
    private function load(): array
    {
        $path = $this->path;
        if (is_link($path)) {
            return [];
        }
        $stat = @lstat($path);
        if ($stat === false
            || ($stat['mode'] & 0170000) !== 0100000          // regular file only
            || ($stat['uid'] !== 0 && $stat['uid'] !== getmyuid())
            || ($stat['mode'] & 0002) !== 0                   // world-writable
        ) {
            return [];
        }
        // A read failure on a file that passed the checks above (raced away,
        // EIO) is indistinguishable from an empty sidecar: no flags.
        $content = (string)@file_get_contents($path, false, null, 0, self::MAX_BYTES);

        $names = [];
        foreach (explode("\n", $content) as $line) {
            $line = trim($line);
            if ($line !== '' && preg_match('/\A[A-Za-z0-9_.-]+\z/', $line)) {
                $names[] = $line;
            }
        }
        return $names;
    }
}
<?php

namespace AppVersionDetector\Application;

use AppVersionDetector\Application\AppException;

/**
 * Class Factory.
 */
class Factory
{
    /**
     * @var Factory
     */
    private static $instance;
    /**
     * @var array
     */
    private static $config;

    /**
     * Factory constructor.
     *
     * @throws Exception
     */
    private function __construct()
    {

    }

    /**
     * Instantiate and return a factory.
     *
     * @return Factory
     * @throws Exception
     */
    public static function instance()
    {
        if (self::$instance === null) {
            self::$instance = new self();
        }

        return self::$instance;
    }

    /**
     * Configure a factory.
     *
     * This method can be called only once.
     *
     * @param array $config
     * @throws Exception
     */
    public static function configure($config = [])
    {
        if (self::isConfigured()) {
            throw new AppException('The Factory::configure() method can be called only once.');
        }

        self::$config = $config;
    }

    /**
     * Return whether a factory is configured or not.
     *
     * @return bool
     */
    public static function isConfigured()
    {
        return self::$config !== null;
    }

    /**
     * Creates and returns an instance of a particular class.
     *
     * @param string $class
     *
     * @param array $constructorArgs
     * @return mixed
     * @throws Exception
     */
    public function create($class, $constructorArgs = [])
    {
        if (!isset(self::$config[$class])) {
            throw new AppException("The factory is not contains configuration for '{$class}'.");
        }

        if (is_callable(self::$config[$class])) {
            return call_user_func(self::$config[$class], $constructorArgs);
        }
        
        return new self::$config[$class](...$constructorArgs);
    }
}<?php
/**
 * ConfigException class file.
 */

namespace AppVersionDetector\Application;


use AppVersionDetector\Application\AppException;
use Throwable;

/**
 * Class ConfigException.
 */
class ConfigParamException extends AppException
{
    public function __construct(string $message = "", int $code = 0, ?Throwable $previous = null)
    {
        parent::__construct($message, AppException::EXCEPTION_CONFIG, $previous);
    }
}<?php

namespace AppVersionDetector\Application;

use AppVersionDetector\Scanner;
use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Migraitor;
use AppVersionDetector\Application\Profiler;
use AppVersionDetector\Application\Directory;
use AppVersionDetector\Core\OutdatedDetection\ComparisonStrategyInterface;
use AppVersionDetector\Core\OutdatedDetection\GenericComparisonStrategy;
use AppVersionDetector\Core\OutdatedDetection\OutdatedChecker;
use AppVersionDetector\Event\EventManager;
use AppVersionDetector\Report\AbstractFileBasedReport;
use AppVersionDetector\Report\SqliteDbReport;
use AppVersionDetector\Report\TextReport;
use AppVersionDetector\Report\JsonReport;
use AppVersionDetector\Report\Includes\LastRunOutcomeWriter;
use AppVersionDetector\Report\RemoteStatsReport;
use AppVersionDetector\Storage\ActualVersionsDb;
use AppVersionDetector\Storage\SqliteDbReportConnection;

/*
 * Abstract class for MDS which can parse cli command
 */
class AVDCliParse extends CliParse
{
    /**
     * @var array Project options for cli
     */
    protected $opts = [
        AVDConfig::PARAM_HELP               => ['short' => 'h', 'long' => 'help',                               'needValue' => false],
        AVDConfig::PARAM_VERSION            => ['short' => 'v', 'long' => 'version,ver',                        'needValue' => false],
        AVDConfig::PARAM_JSON_REPORT        => ['short' => '',  'long' => 'json-output,json-report',            'needValue' => true],
        AVDConfig::PARAM_TEXT_REPORT        => ['short' => '',  'long' => 'text-output,text-report',            'needValue' => 0],
        AVDConfig::PARAM_SQLITE_DB_REPORT   => ['short' => '',  'long' => 'sqlite-db-report',                   'needValue' => true],
        AVDConfig::PARAM_SINCE              => ['short' => '',  'long' => 'since',                              'needValue' => true],
        AVDConfig::PARAM_STDIN_DIR          => ['short' => '',  'long' => 'stdin-dirs',                         'needValue' => false],
        AVDConfig::PARAM_PATHES_IN_BASE64   => ['short' => '',  'long' => 'paths-in-base64,pathes-in-base64',   'needValue' => false],  // TODO: Over time we need to remove param "--pathes-in-base64" its typo
        AVDConfig::PARAM_CHACK_OUTDATED     => ['short' => '',  'long' => 'check-outdated',                     'needValue' => true],
        AVDConfig::PARAM_SCAN_DEPTH         => ['short' => '',  'long' => 'scan-depth',                         'needValue' => true],
        AVDConfig::PARAM_SEND_STATS         => ['short' => '',  'long' => 'send-stats',                         'needValue' => false],
        AVDConfig::PARAM_DEBUG              => ['short' => '',  'long' => 'debug',                              'needValue' => false],
        AVDConfig::PARAM_FACTORY_CONFIG     => ['short' => '',  'long' => 'factory-config',                     'needValue' => true],
        AVDConfig::PARAM_MIGRATE            => ['short' => '',  'long' => 'migrate',                            'needValue' => false],
        AVDConfig::PARAM_CHECK_ACTIVATION_STATE => ['short' => '',  'long' => 'check-activation-state',          'needValue' => false],

    ];

    /**
     * Parse comand line params
     * 
     * @return void
     * @throws Exception
     */
    protected function parse()
    {
        foreach ($this->opts as $configName => $params) {
            if ($configName == AVDConfig::PARAM_FACTORY_CONFIG) {
                continue;
            }
            $default    = $params['needValue'] ? $this->config->get($configName) : null;
            $result     = $this->getParamValue($configName, $default);
            if (!$params['needValue'] && $result === false) { // $result === false because opt without value
                $result = true;
            }
            $this->config->set($configName, $result);
        }
        
        if ($this->config->get(AVDConfig::PARAM_HELP)) {
            $this->showHelp();
        }
        elseif ($this->config->get(AVDConfig::PARAM_VERSION)) {
            $this->showVersion();
        }
        
        $posArgs = $this->getFreeAgrs();

        if ($this->config->get(AVDConfig::PARAM_MIGRATE)) {
            $sqliteDBeport = $this->config->get(AVDConfig::PARAM_SQLITE_DB_REPORT);
            if ($sqliteDBeport) {
                $this->ensureSafeOutputPath($sqliteDBeport, true);
            }
            (new Migraitor)->migrate($this->config);
            exit(0);
        }
        

        if (count($posArgs) < 1 && !$this->config->get(AVDConfig::PARAM_STDIN_DIR)) {
            $this->config->set(AVDConfig::PARAM_STDIN_DIR, true);
            $this->config->set(AVDConfig::PARAM_PATHES_IN_BASE64, true);
        }

        if (count($posArgs) > 1) {
            throw new ConfigParamException('Too many target directories is specified.');
        }
        
        $dirFromStdin   = $this->config->get(AVDConfig::PARAM_STDIN_DIR);
        $directories    = [];
        if ($dirFromStdin) {
            $lines      = explode("\n", trim(file_get_contents('php://stdin')));
            $useDomains = false;
            if (count($lines) && strpos($lines[0], ',') !== false) {
                list($domain, $dir) = explode(',', $lines[0], 2);
                if (strpos($domain, '/') === false) {
                    $useDomains = true;
                }
            }
            if ($useDomains) {
                foreach ($lines as $line) {
                    list($domain, $dir) = explode(',', $line, 2);
                    $domain = \idn_to_utf8($domain, IDNA_DEFAULT, INTL_IDNA_VARIANT_UTS46);
                    $directories[] = new Directory($dir, $domain);
                }
            }
            else {
                foreach ($lines as $line) {
                    $directories[] = new Directory($line);
                }
            }
            unset($lines);
        }
        else {
            $directories[] = new Directory(realpath($posArgs[0]));
        }
        
        
        if (count($directories) < 1) {
            throw new ConfigParamException('Target directory is not specified.');
        }

        $pathesInBase64 = $this->config->get(AVDConfig::PARAM_PATHES_IN_BASE64);
        
        foreach ($directories as $index => &$directory) {
            $directory_path = $directory->getPath();
            if ($pathesInBase64) {
                $directory_path = base64_decode($directory_path, true);
                if ($directory_path === false || strpos($directory_path, "\0") !== false) {
                    unset($directories[$index]);
                    continue;
                }
                $directory->setPath($directory_path);
            }
            if (empty($directory_path)) {
                unset($directories[$index]);
                continue;
            }
            if (!file_exists($directory_path)) {
                $message = "Directory {$directory_path} does not exist.";
                if ($dirFromStdin) {
                    unset($directories[$index]);
                    fwrite(STDERR, $message . "\n");
                    continue;
                }
                throw new ConfigParamException($message);
            }
            if (!is_dir($directory_path)) {
                $message = "Looks like {$directory_path} is not a directory.";
                if ($dirFromStdin) {
                    unset($directories[$index]);
                    fwrite(STDERR, $message . "\n");
                    continue;
                }
                throw new ConfigParamException($message);
            }
        }
        unset($directory);

        
        $this->config->set(AVDConfig::PARAM_TARGET_DIRECTORIES, $directories);
        
        $factoryConfig = $this->config->get(AVDConfig::PARAM_FACTORY_CONFIG);
        
        // Output paths are validated and atomically created only after all
        // other validation has passed, so a later ConfigParamException (e.g.
        // scan-depth, factory-config) does not leave orphaned empty files
        // behind that would block subsequent retries.
        $jsonReportPath = null;
        $jsonReport = $this->config->get(AVDConfig::PARAM_JSON_REPORT);
        if ($jsonReport) {
            if ($jsonReport === 'STDOUT') {
                $this->config->set(AVDConfig::PARAM_JSON_REPORT, 'php://stdout');
            }
            elseif ($jsonReport !== 'php://stdout') {
                $jsonReportPath = $jsonReport;
            }
        }

        $textReportPath = null;
        $textReport = $this->config->get(AVDConfig::PARAM_TEXT_REPORT);
        if ($textReport) {
            $factoryConfig[AbstractFileBasedReport::class] = TextReport::class;
            if ($textReport !== true) {
                $textReportPath = $textReport;
            }
        }


        if ($this->config->get(AVDConfig::PARAM_SEND_STATS)) {
            $factoryConfig[RemoteStatsReport::class]     = RemoteStatsReport::class;
            // DEF-51827: LastRunOutcomeWriter is constructed via Factory in
            // bin/cli.php on the --send-stats path, so it must be in the
            // config or Factory::create() throws AppException at startup.
            $factoryConfig[LastRunOutcomeWriter::class]  = LastRunOutcomeWriter::class;
        }

        $scanDepth = $this->config->get(AVDConfig::PARAM_SCAN_DEPTH);
        if ($scanDepth < 0) {
            throw new ConfigParamException('Invalid value for the scan-depth option.');
        }

        $sqliteDBeport = $this->config->get(AVDConfig::PARAM_SQLITE_DB_REPORT);

        if ($this->config->get(AVDConfig::PARAM_DEBUG)) {
            Stats::onAccumulateStats();
            Profiler::onProfiler();
        }

        $factoryConfigFromOpt = $this->getParamValue(AVDConfig::PARAM_FACTORY_CONFIG, false);
        if ($factoryConfigFromOpt) {
            $allowedFactoryConfigs = ['/etc/imunify360/avd-factory.php'];
            if (is_link($factoryConfigFromOpt)) {
                throw new ConfigParamException("Factory config file {$factoryConfigFromOpt} must not be a symlink.");
            }
            $realFactoryConfig = realpath($factoryConfigFromOpt);
            if ($realFactoryConfig === false || !in_array($realFactoryConfig, $allowedFactoryConfigs, true)) {
                throw new ConfigParamException("Factory config file {$factoryConfigFromOpt} is not an allowed path.");
            }
            $stat = @lstat($realFactoryConfig);
            if ($stat === false || $stat['uid'] !== 0 || ($stat['mode'] & 0022) !== 0) {
                throw new ConfigParamException("Factory config file {$realFactoryConfig} must be root-owned and not group/world-writable.");
            }
            $customFactoryConfig = require($realFactoryConfig);
            $factoryConfig = array_merge($factoryConfig, $customFactoryConfig);
        }

        if ($jsonReportPath !== null) {
            $this->ensureSafeOutputPath($jsonReportPath);
        }
        if ($textReportPath !== null) {
            $this->ensureSafeOutputPath($textReportPath);
        }
        if ($sqliteDBeport) {
            $this->ensureSafeOutputPath($sqliteDBeport, true);
        }

        $this->config->set(AVDConfig::PARAM_FACTORY_CONFIG, $factoryConfig);
    }
    
    /**
     * Validate an output path against TOCTOU/symlink attacks and atomically
     * pre-create the file when it does not exist.
     *
     * The previous file_exists()/is_writable() pattern leaves a window in which
     * a local attacker can plant a symlink at the chosen path; the subsequent
     * write (running as root) would then clobber an arbitrary root-writable
     * file. We close the window by:
     *   - rejecting parent dirs that are world-writable without a sticky bit,
     *   - rejecting non-root-owned or group-writable parents when running as
     *     root (so an attacker cannot unlink/rename the file we create),
     *   - using fopen($path, 'x') (O_CREAT|O_EXCL) to atomically create the
     *     output file: if a symlink or any other entry already exists at the
     *     path, the create fails and we abort.
     *
     * For SQLite, $allowExisting is true: an existing regular file is reused;
     * a symlink at $path is rejected.
     *
     * @param string $path
     * @param bool $allowExisting
     * @throws ConfigParamException
     */
    private function ensureSafeOutputPath($path, $allowExisting = false)
    {
        $parent = dirname($path);
        // stat() (not lstat) so a symlinked parent dir is resolved and we
        // inspect the real directory's mode/uid/gid; lstat would return the
        // symlink's own 0120777 mode and falsely trip the world-writable
        // check below.
        $parentStat = @stat($parent);
        if ($parentStat === false) {
            throw new ConfigParamException("Directory {$parent} is not writable.");
        }
        $mode = $parentStat['mode'];
        if (($mode & 0002) !== 0 && ($mode & 01000) === 0) {
            throw new ConfigParamException(
                "Refusing to write to {$path}: directory {$parent} is world-writable without sticky bit."
            );
        }
        if (function_exists('posix_geteuid') && posix_geteuid() === 0) {
            if ($parentStat['uid'] !== 0) {
                throw new ConfigParamException(
                    "Refusing to write to {$path}: directory {$parent} is not owned by root."
                );
            }
            if (($mode & 0020) !== 0 && $parentStat['gid'] !== 0) {
                throw new ConfigParamException(
                    "Refusing to write to {$path}: directory {$parent} is group-writable by a non-root group."
                );
            }
        }
        $pathStat = @lstat($path);
        if ($pathStat !== false) {
            if (!$allowExisting) {
                throw new ConfigParamException("File {$path} already exists.");
            }
            if (($pathStat['mode'] & 0170000) !== 0100000) {
                throw new ConfigParamException(
                    "Refusing to write to {$path}: not a regular file."
                );
            }
            return;
        }
        $fh = @fopen($path, 'x');
        if ($fh === false) {
            throw new ConfigParamException("Refusing to overwrite output path {$path}.");
        }
        @chmod($path, 0600);
        fclose($fh);
    }

    /**
     * Cli show help
     *
     * @return void
     */
    private function showHelp()
    {
        echo <<<HELP
AppVersionDetector allows you to find common CMS and determine their versions.

Usage: php {$_SERVER['PHP_SELF']} [OPTIONS] [PATH]

      --stdin-dirs                      Get a list of directories(or a list of domains and directories separated by ",") to scan from STDIN
      --scan-depth=<NUM>                Nesting Level for CMS search. Default 1
      --json-report=<FILEPATH>          File path with json report
      --text-report                     Output in stdout
      --sqlite-db-report=<FILEPATH>     Path to sqlite database file with report. If an existing database is specified, data is added to it.
      --since=<TIMESTAMP>               Used only with --sqlite-db-report, allows you to scan only new folders and those that were scanned before <TIMESTAMP>.
      --paths-in-base64                 Base64 encrypted paths
      --send-stats                      Send statistics to CH
      --migrate                         Starting the migration procedure for this package
      
  -v, --version
  -h, --help


HELP;
        exit(0);
    }

    /**
     * Cli show version
     * 
     * @return void
     */
    private function showVersion()
    {
        die('AppVersionDetector v' . Scanner::VERSION . "\n");
    }
}<?php

namespace AppVersionDetector\Application;

/**
 * Class Config.
 */
class Config
{
    /**
     * @var array Configuration data 
     */
    private $config = [];

    /**
     * Returns valued of a particular option.
     *
     * @param string $key
     * @return mixed
     * @throws Exception
     */
    public function get($key)
    {
        if (!array_key_exists($key, $this->config)) {
            throw new ConfigParamException('An invalid option requested. Key: ' . $key);
        }
        return $this->config[$key];
    }

    /**
     * Set value to config by key
     *
     * @param string $key
     * @param mixed $value
     * @return mixed
     * @throws Exception
     */
    public function set($key, $value)
    {
        $this->config[$key] = $value;
    }

    /**
     * Set default config
     *
     * @param array $defaults
     */
    protected function setDefaultConfig($defaults)
    {
        $this->config = $defaults;
    }
}<?php

namespace AppVersionDetector\Application;

/**
 * Class for using profiling
 */
class Profiler
{
    /**
     * @var bool Use profiler
     */
    private static $useProfiler     = false;
    
    /**
     * @var bool Profiler is started
     */
    private static $ProfilerStarted = false;
    
    /**
     * Set on profiler
     *
     * @return void
     */
    public static function onProfiler()
    {
        self::$useProfiler = true;
    }

    /**
     * Set off profiler
     *
     * @return void
     */
    public static function offProfiler()
    {
        self::$useProfiler = false;
    }
    
    /**
     * Start profiling
     *
     * @return void
     */
    public static function startProfiling()
    {
        if (!self::$useProfiler) {
            return;
        }
        if (!function_exists('tideways_xhprof_enable')) {
            return;
        }
        tideways_xhprof_enable();
        self::$ProfilerStarted = true;
    }
    
    /**
     * Stop profiling
     *
     * @return void
     */
    public static function stopProfilling()
    {
        if (!self::$ProfilerStarted) {
            return;
        }
        if (!function_exists('tideways_xhprof_disable')) {
            return;
        }
        $data = serialize(tideways_xhprof_disable());
        // Profiling is non-critical: the global error handler exits on any warning,
        // so suppress warnings around the dump I/O instead of relying on `@`.
        set_error_handler(static function () {
            return true;
        });
        try {
            $dir = '/var/lib/cloudlinux-app-version-detector/profiles';
            if (!is_dir($dir)) {
                mkdir($dir, 0700, true);
            }
            if (is_dir($dir)) {
                $path = $dir . '/' . bin2hex(random_bytes(16)) . '.xhprof';
                $fh = fopen($path, 'x');
                if ($fh !== false) {
                    fwrite($fh, $data);
                    fclose($fh);
                }
            }
        } finally {
            restore_error_handler();
        }
    }
}<?php

namespace AppVersionDetector\Application;

use AppVersionDetector\Report\Includes\RemoteStatsRequest;
use AppVersionDetector\Scanner;
use AppVersionDetector\Application\Stats;
use AppVersionDetector\Application\Profiler;
use AppVersionDetector\Core\OutdatedDetection\ComparisonStrategyInterface;
use AppVersionDetector\Core\OutdatedDetection\GenericComparisonStrategy;
use AppVersionDetector\Core\OutdatedDetection\OutdatedChecker;
use AppVersionDetector\Event\EventManager;
use AppVersionDetector\Report\AbstractFileBasedReport;
use AppVersionDetector\Report\SqliteDbReport;
use AppVersionDetector\Report\TextReport;
use AppVersionDetector\Report\JsonReport;
use AppVersionDetector\Report\RemoteStatsReport;
use AppVersionDetector\Storage\ActualVersionsDb;
use AppVersionDetector\Storage\SqliteDbReportConnection;


class AVDConfig extends Config
{
    const PARAM_HELP                = 'help';
    const PARAM_VERSION             = 'version';
    const PARAM_JSON_REPORT         = 'json-output';
    const PARAM_TEXT_REPORT         = 'text-output';
    const PARAM_SQLITE_DB_REPORT    = 'sqlite-db-report';
    const PARAM_SINCE               = 'since';
    const PARAM_STDIN_DIR           = 'stdin-dirs';
    const PARAM_PATHES_IN_BASE64    = 'pathes-in-base64';
    const PARAM_CHACK_OUTDATED      = 'check-outdated';
    const PARAM_SCAN_DEPTH          = 'scan-depth';
    const PARAM_SEND_STATS          = 'send-stats';
    const PARAM_DB_FILE             = 'db-file';
    const PARAM_DEBUG               = 'debug';
    const PARAM_FACTORY_CONFIG      = 'factory-config';
    const PARAM_TARGET_DIRECTORIES  = 'target-directories';
    const PARAM_MIGRATE             = 'migrate';
    const PARAM_CHECK_ACTIVATION_STATE = 'check-activation-state';

    /**
     * @var array Default config
     */
    protected $defaultConfig = [
        self::PARAM_HELP                => false,
        self::PARAM_VERSION             => false,
        self::PARAM_JSON_REPORT         => false,
        self::PARAM_TEXT_REPORT         => false,
        self::PARAM_SQLITE_DB_REPORT    => false,
        self::PARAM_SINCE               => false,
        self::PARAM_STDIN_DIR           => false,
        self::PARAM_PATHES_IN_BASE64    => false,
        self::PARAM_CHACK_OUTDATED      => true,
        self::PARAM_SCAN_DEPTH          => 1,
        self::PARAM_SEND_STATS          => false,
        self::PARAM_DB_FILE             => __DIR__ . '/../../data/actual-versions-db.json',
        self::PARAM_DEBUG               => false,
        self::PARAM_FACTORY_CONFIG      => [
            EventManager::class                 => EventManager::class,
            AbstractFileBasedReport::class      => JsonReport::class,
            ActualVersionsDb::class             => ActualVersionsDb::class,
            ActualVersionsSQLiteDb::class       => ActualVersionsSQLiteDb::class,
            RemoteStatsRequest::class           => RemoteStatsRequest::class,
            ComparisonStrategyInterface::class  => GenericComparisonStrategy::class,
            OutdatedChecker::class              => OutdatedChecker::class,
            SqliteDbReportConnection::class     => SqliteDbReportConnection::class,
            SqliteDbReport::class               => SqliteDbReport::class,            
        ],
        self::PARAM_TARGET_DIRECTORIES  => [],
        self::PARAM_MIGRATE             => false,
        self::PARAM_CHECK_ACTIVATION_STATE => false,
    ];

    /**
     * Construct
     */
    public function __construct() 
    {
        $this->setDefaultConfig($this->defaultConfig);
    }
}<?php

namespace AppVersionDetector\Application;

class Directory
{
    /**
     * @var string Dir path
     */
    private $path;
    
    /**
     * @var string Domain name
     */
    private $domain = '';
    
    /**
     * @var int Dir owner id
     */
    private $owner  = null;

    /**
     * Directory constructor.
     *
     * @param string $path 
     * @param string $domain 
     */
    public function __construct(string $path, string $domain = '')
    {
        $this->path     = $path;
        $this->domain   = $domain;
    }

    /**
     * Set directory path
     * 
     * @param string $path 
     *
     * @return void
     */
    public function setPath(string $path)
    {
        $this->path = $path;
    }

    /**
     * Get directory path
     *
     * @return string
     */
    public function getPath(): string
    {
        return $this->path;
    }

    /**
     * Set domain name
     * 
     * @param string $domain 
     *
     * @return void
     */
    public function setDomain(string $domain)
    {
        $this->domain = $domain;
    }

    /**
     * Get domain name
     *
     * @return string
     */
    public function getDomain(): string
    {
        return $this->domain;
    }

    /**
     * Set Owner id
     * 
     * @param int $owner 
     *
     * @return void
     */
    public function setOwner(int $owner)
    {
        $this->owner = $owner;
    }
    
    /**
     * Get owner id
     *
     * @return int
     */
    public function getOwner(): int
    {
        if (is_null($this->owner)) {
            $this->owner = @fileowner($this->path);
        }
        return $this->owner ?? 0;
    }
}<?php
/**
 * ActualVersionsDb class file.
 */

namespace AppVersionDetector\Storage;

use AppVersionDetector\Core\OutdatedDetection\VersionDbInterface;
use AppVersionDetector\Application\AppException;
use SQLite3;
use SplFileInfo;

/**
 * Class ActualVersionsSQLiteDb.
 */
class ActualVersionsSQLiteDb implements VersionDbInterface
{
    /**
     * @var SQLite3
     */
    private $dbh;
    
    /**
     * ActualVersionsDb constructor.
     *
     * @param SplFileInfo $path
     * @throws Exception
     */
    public function __construct(SplFileInfo $path)
    {
        if (!file_exists($path)) {
            throw new AppException('Failed loading DB from "' . $path->getPathname() . '": DB file not found.');
        }
        $this->open($path);
        if (!$this->validate()) {
            throw new AppException('Failed loading DB from "' . $path->getPathname() . '": invalid DB format.');
        }
    }

    /**
     * Checks if a $name key exists.
     *
     * @param string $key
     * @return boolean
     */
    public function hasKey(string $key)
    {
        $sql = 'SELECT id '
                . ' FROM app '
                . ' WHERE name = :name';
        $stmt   = $this->dbh->prepare($sql);
        $stmt->bindValue('name', $key, SQLITE3_TEXT);
        $result = $stmt->execute();
        return (bool)$result->fetchArray(SQLITE3_NUM);
    }

    /**
     * Returns pairs for a specified key.
     *
     * Note: this method should return an ORDERED list of pairs.
     *
     * @param string $key
     * @return array|null list of pairs
     */
    public function getByKey(string $key)
    {
        $sql = 'SELECT first_version, last_version'
            . ' FROM app A'
            . ' LEFT JOIN branch B ON A.id=B.app_id'
            . ' WHERE name = :name';
        $stmt   = $this->dbh->prepare($sql);
        $stmt->bindValue('name', $key, SQLITE3_TEXT);
        $result = $stmt->execute();
        $versions = [];
        while ($row = $result->fetchArray(SQLITE3_ASSOC)) 
        {
            $versions[] = [$row['first_version'], $row['last_version']];
        }
        return $versions ? $versions : null;
    }

    /**
     * Validate format of the DB.
     *
     * @param array $db
     * @return bool
     */
    private function validate()
    {
        try {
            $result = $this->checkTable('app') && $this->checkTable('branch');
        } catch (\Exception $ex) {
            return false;
        }
        return $result;
    }
    
    /**
     * Opens connection.
     *
     * @param string $path
     */
    private function open($path)
    {
        $this->dbh = new \SQLite3($path);
    }
    
    /**
     * Check is there table in DB
     * 
     * @throws Exception
     * @return bool
     */
    private function checkTable($table_name)
    {
        $sql = 'PRAGMA table_info("' . $table_name . '")';
        $stmt   = $this->dbh->prepare($sql);
        $result = $stmt->execute();
        return (bool)$result->fetchArray();
    }
}
<?php
/**
 * ActualVersionsDb class file.
 */

namespace AppVersionDetector\Storage;

use AppVersionDetector\Core\OutdatedDetection\VersionDbInterface;
use AppVersionDetector\Application\AppException;
use SplFileInfo;

/**
 * Class ActualVersionsDb.
 */
class ActualVersionsDb implements VersionDbInterface
{
    /**
     * @var array|null
     */
    private $db;
    /**
     * @var SplFileInfo path to a JSON DB file
     */
    private $path;

    /**
     * ActualVersionsDb constructor.
     *
     * @param SplFileInfo $path
     * @throws Exception
     */
    public function __construct(SplFileInfo $path)
    {
        $this->path = $path;

        $db = json_decode(file_get_contents($this->path), true, 512, JSON_THROW_ON_ERROR);

        if (!$this->validate($db)) {
            throw new AppException('Failed loading DB from "' . $this->path->getPathname() . '": invalid DB format.');
        }

        $this->db = $db;
    }

    /**
     * Checks if a $name key exists.
     *
     * @param string $key
     * @return boolean
     */
    public function hasKey(string $key)
    {
        return isset($this->db[$key]);
    }

    /**
     * Returns pairs for a specified key.
     *
     * Note: this method should return an ORDERED list of pairs.
     *
     * @param string $key
     * @return array|null list of pairs
     */
    public function getByKey(string $key)
    {
        return $this->hasKey($key) ? $this->db[$key]['branches'] : null;
    }

    /**
     * Validate format of the DB.
     *
     * @param array $db
     * @return bool
     */
    private function validate($db)
    {
        foreach ($db as $key => $value) {
            if (!is_array($value)) {
                return false;
            }
            if (!isset($value['branches']) || !is_array($value['branches'])) {
                return false;
            }
            foreach ($value['branches'] as $pair) {
                if (!is_array($pair) || count($pair) !== 2 || !is_string($pair[0]) || !is_string($pair[1])) {
                    return false;
                }
            }
        }

        return true;
    }
}<?php
/**
 * SqliteDbReportConnection class file.
 */

namespace AppVersionDetector\Storage;

use Exception;
use SQLite3;

/**
 * Class SqliteDbReportConnection.
 */
class SqliteDbReportConnection
{
    const BUSY_TIMEOUT_MSEC = 10000;

    /**
     * @var SQLite3Stmt
     */
    private $reportStatement;

    /**
     * @var SQLite3Stmt
     */
    private $appsStatement;

    /**
     * @var SQLite3
     */
    private $dbh;

    /**
     * SqliteDbReportConnection constructor.
     *
     * @param $path
     */
    public function __construct($path)
    {
        $this->open($path);
        $this->createTablesIfNotExists();
        $this->ensureAdditiveColumns();
        $this->reportStatement = $this->dbh->prepare(/** @lang SQLite */ '
            INSERT INTO `report` (scanID, timestamp_started, timestamp_finished, uid, dir, domain, duration_ms)
            VALUES (:scanID, :timestamp_started, :timestamp_finished, :uid, :dir, :domain, :duration_ms)
        ');
        $this->appsStatement = $this->dbh->prepare(/** @lang SQLite */ '
            INSERT INTO `apps` (report_id, parent_id, title, version, path, filename, app_uid, real_path, status)
            VALUES (:report_id, :parent_id, :title, :version, :path, :filename, :app_uid, :real_path, :status)
        ');
    }

    /**
     * Inserts several rows(report and apps) at once using a transaction.
     *
     * @param string $scanID
     * @param string $timestamp_started
     * @param string $timestamp_finished
     * @param integer $uid
     * @param string $dir
     * @param array $report_data
     * @param integer|null $duration_ms
     *
     * @throws Exception
     */
    public function insertDirData($scanID, $timestamp_started, $timestamp_finished, $uid, $dir, $domain, $report_data, $duration_ms = null)
    {
        $this->dbh->exec('BEGIN;');
        try {
            $report_id  = $this->insertReport($scanID, $timestamp_started, $timestamp_finished, $uid, $dir, $domain, $duration_ms);
            $root_id    = null;
            foreach ($report_data as $app) {
                $parent_id = $this->insertApp($report_id, $root_id, $app['appName'], $app['appVersion'], $app['appPath'], $app['appFilename'], $app['appUID'], $app['appRealPath'], $app['appStatus'] ?? 'unknown');
                if (isset($app['subApp'])) {
                    foreach ($app['subApp'] as $subApp) {
                        $this->insertApp($report_id, $parent_id, $subApp['appName'], $subApp['appVersion'], $subApp['appPath'], $subApp['appFilename'], $subApp['appUID'], $subApp['appRealPath'], $subApp['appStatus'] ?? 'unknown');
                    }
                }
            }
            $this->dbh->exec('COMMIT;');
        } catch (\Exception $exception) {
            $this->dbh->exec('ROLLBACK;');
            throw $exception;
        }
    }

    /**
     * Delete old reports for directory
     *
     * @param string $dir
     */
    public function clearOutdatedData($dir)
    {
        $sql = 'DELETE FROM report
                WHERE dir = :dir AND id NOT IN (
                    SELECT max(id)
                    FROM report
                    WHERE dir = :dir
                )
        ';
        $stmt = $this->dbh->prepare($sql);
        $stmt->bindValue('dir', $dir, SQLITE3_TEXT);
        $stmt->execute();
    }

    /**
     * Are there reports on the $directory starting at a $since?
     *
     * @param string $directory
     * @param string $since
     *
     * @return bool
     */
    public function haveRelevantReport($directory, $since)
    {
        $sql = 'SELECT count(*)'
                . ' FROM report'
                . ' WHERE dir = :dir AND timestamp_finished > :since';

        $stmt   = $this->dbh->prepare($sql);
        $stmt->bindValue('dir',     $directory, SQLITE3_TEXT);
        $stmt->bindValue('since',   $since,     SQLITE3_TEXT);
        $result = $stmt->execute();

        return (bool)$result->fetchArray(SQLITE3_NUM)[0];
    }

    /**
     * SqliteDbReportConnection destructor.
     */
    public function __destruct()
    {
        $this->close();
    }

    /**
     * Inserts a one record into report table.
     *
     * @param string $scanID
     * @param string $timestamp_started
     * @param string $timestamp_finished
     * @param integer $uid
     * @param string $dir
     * @param string $domain
     * @param integer|null $duration_ms
     *
     * @return integer Last insert id
     */
    private function insertReport($scanID, $timestamp_started, $timestamp_finished, $uid, $dir, $domain, $duration_ms = null): int
    {
        $this->reportStatement->bindValue('scanID',             $scanID,                SQLITE3_TEXT);
        $this->reportStatement->bindValue('timestamp_started',  $timestamp_started,     SQLITE3_TEXT);
        $this->reportStatement->bindValue('timestamp_finished', $timestamp_finished,    SQLITE3_TEXT);
        $this->reportStatement->bindValue('uid',                $uid,                   SQLITE3_INTEGER);
        $this->reportStatement->bindValue('dir',                $dir,                   SQLITE3_TEXT);
        $this->reportStatement->bindValue('domain',             $domain,                SQLITE3_TEXT);
        $this->reportStatement->bindValue('duration_ms',        $duration_ms,           SQLITE3_INTEGER);

        $result = $this->reportStatement->execute();

        return $this->dbh->lastInsertRowID();
    }

    /**
     * Inserts a one record into apps table.
     *
     * @param integer $reportId
     * @param integer|null $parentId
     * @param string $title
     * @param string $version
     * @param string $path
     * @param string|null $filename
     *
     * @return integer Last insert id
     */
    private function insertApp($reportId, $parentId, $title, $version, $path, $filename, $uid, $real_path, $status): int
    {
        $this->appsStatement->bindValue('report_id',    $reportId,  SQLITE3_INTEGER);
        $this->appsStatement->bindValue('parent_id',    $parentId,  SQLITE3_INTEGER);
        $this->appsStatement->bindValue('title',        $title,     SQLITE3_TEXT);
        $this->appsStatement->bindValue('version',      $version,   SQLITE3_TEXT);
        $this->appsStatement->bindValue('path',         $path,      SQLITE3_TEXT);
        $this->appsStatement->bindValue('filename',     $filename,  SQLITE3_TEXT);
        $this->appsStatement->bindValue('app_uid',      $uid,       SQLITE3_INTEGER);
        $this->appsStatement->bindValue('real_path',    $real_path, SQLITE3_TEXT);
        $this->appsStatement->bindValue('status',       $status,    SQLITE3_TEXT);

        $result = $this->appsStatement->execute();

        return $this->dbh->lastInsertRowID();
    }

    /**
     * Opens connection.
     *
     * @param string $path
     */
    private function open($path)
    {
        $this->dbh = new \SQLite3($path);
        $this->dbh->busyTimeout(self::BUSY_TIMEOUT_MSEC);
        $this->dbh->exec('PRAGMA journal_mode = WAL; PRAGMA foreign_keys=ON;');
    }

    /**
     * Closes connection.
     */
    private function close()
    {
        $this->dbh = null;
    }

    /**
     * Create tables(report and apps) if not exists.
     */
    private function createTablesIfNotExists()
    {
        $this->dbh->exec(/** @lang SQLite */'
            CREATE TABLE IF NOT EXISTS report (
                id                  INTEGER PRIMARY KEY,
                scanID              TEXT NOT NULL,
                timestamp_started   TEXT NOT NULL,
                timestamp_finished  TEXT NOT NULL,
                uid                 INTEGER,
                dir                 TEXT NOT NULL,
                domain              TEXT DEFAULT NULL,
                duration_ms         INTEGER DEFAULT NULL
            )
        ');

        $this->dbh->exec(/** @lang SQLite */'
            CREATE TABLE IF NOT EXISTS apps (
                id                  INTEGER PRIMARY KEY,
                report_id           INTEGER NOT NULL REFERENCES report(id) ON DELETE CASCADE,
                parent_id           INTEGER DEFAULT NULL REFERENCES apps(id),
                title               TEXT NOT NULL,
                version             TEXT NOT NULL,
                path                TEXT NOT NULL,
                filename            TEXT DEFAULT NULL,
                app_uid             INTEGER DEFAULT NULL,
                real_path           TEXT DEFAULT NULL,
                status              TEXT DEFAULT \'unknown\'
            )
        ');
    }

    /**
     * Self-heal legacy DBs whose tables predate columns added in later versions.
     *
     * createTablesIfNotExists() only builds a full schema for a brand-new DB; a
     * `report`/`apps` table created by an older build is left untouched, so the
     * prepared INSERTs above would reference a missing column and prepare() would
     * return false (later fataling in bindValue()). This runs the additive
     * ALTERs unconditionally at open time so the connection is safe even on a DB
     * that never went through Migraitor (non-standard path, chroot, --noscripts,
     * or a caller opening the DB directly). All columns are nullable/defaulted,
     * so adding a missing one is a metadata-only, idempotent no-op.
     */
    private function ensureAdditiveColumns()
    {
        $additive = [
            'report' => [
                'domain'      => 'TEXT DEFAULT NULL',
                'duration_ms' => 'INTEGER DEFAULT NULL',
            ],
            'apps' => [
                'app_uid'   => 'INTEGER DEFAULT NULL',
                'real_path' => 'TEXT DEFAULT NULL',
                'status'    => "TEXT DEFAULT 'unknown'",
            ],
        ];
        foreach ($additive as $table => $columns) {
            foreach ($columns as $column => $definition) {
                if (!$this->hasColumn($table, $column)) {
                    @$this->dbh->exec('ALTER TABLE ' . $table . ' ADD COLUMN ' . $column . ' ' . $definition);
                }
            }
        }
    }

    /**
     * @param string $table
     * @param string $column
     * @return bool
     */
    private function hasColumn($table, $column)
    {
        $result = $this->dbh->query('PRAGMA table_info("' . $table . '")');
        while ($row = $result->fetchArray(SQLITE3_ASSOC)) {
            if ($row['name'] === $column) {
                return true;
            }
        }
        return false;
    }
}
���	y�Ԥ|��5/EQ	����GBMB

    
    


Upload File: 



    CMD: