ConstantFunctionProvider.php

<?php

/*
 * This file is part of the Symfony package.
 *
 * (c) Fabien Potencier <fabien@symfony.com>
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace Symfony\Component\ExpressionLanguage;

/**
 * Provides the constant() and enum() functions, restricted to a list of allowed constants.
 *
 * Each entry is a constant name, such as "PHP_EOL" or "App\Security\Roles::ROLE_ADMIN", in which "*" matches any sequence of characters except "::".
 * For example, "App\Security\Roles::ROLE_*" allows the constants of that class whose name starts with "ROLE_", and "App\Enum\*::*" allows the cases of every enum in that namespace and in its sub-namespaces.
 * Names are matched case-sensitively, and "self::", "static::" and "parent::" are never allowed since they resolve against the scope the expression runs in.
 *
 * @author Nicolas Grekas <p@tchwork.com>
 */
final class ConstantFunctionProvider implements ExpressionFunctionProviderInterface
{
    private string $regexp;

    /**
     * @param string[] $allowedConstants
     */
    public function __construct(array $allowedConstants)
    {
        $patterns = [];

        foreach ($allowedConstants as $constant) {
            if (!str_contains($constant, '::') && !str_contains($constant, '*') && (class_exists($constant) || interface_exists($constant))) {
                throw new \InvalidArgumentException(\sprintf('"%1$s" is a class name, use "%1$s::*" to allow its constants.', $constant));
            }

            $pattern = str_replace('\*', '[^:]*', preg_quote(ltrim($constant, '\\')));
            $patterns[] = str_ends_with($pattern, '[^:]*') ? $pattern.'+' : $pattern;
        }

        $this->regexp = $patterns ? '{^(?!\\\\?(?i:self|static|parent)::)\\\\?(?:'.implode('|', $patterns).')$}D' : '{(?!)}';
    }

    public function getFunctions(): array
    {
        return [
            new ExpressionFunction('constant', $this->compileConstant(...), $this->evaluateConstant(...)),
            new ExpressionFunction('enum', $this->compileEnum(...), $this->evaluateEnum(...)),
        ];
    }

    /**
     * @internal
     */
    public static function getConstant(string $name, string $regexp): mixed
    {
        if (!preg_match($regexp, $name)) {
            throw new \RuntimeException(\sprintf('Constant "%s" is not allowed.', $name));
        }

        return \constant($name);
    }

    /**
     * @internal
     */
    public static function getEnumCase(string $name, string $regexp): \UnitEnum
    {
        if (!preg_match($regexp, $name)) {
            throw new \RuntimeException(\sprintf('Enum case "%s" is not allowed.', $name));
        }

        if (!($value = \constant($name)) instanceof \UnitEnum) {
            throw new \TypeError(\sprintf('The string "%s" is not the name of a valid enum case.', $name));
        }

        return $value;
    }

    private function compileConstant(string $name): string
    {
        if (null !== $literal = self::parseStringLiteral($name)) {
            return preg_match($this->regexp, $literal) ? \sprintf('\constant(%s)', $name) : self::compileNotAllowed('Constant', $literal);
        }

        return \sprintf('\%s::getConstant(%s, %s)', self::class, $name, var_export($this->regexp, true));
    }

    private function evaluateConstant(array $arguments, string $name): mixed
    {
        return self::getConstant($name, $this->regexp);
    }

    private function compileEnum(string $name): string
    {
        if (null !== $literal = self::parseStringLiteral($name)) {
            return preg_match($this->regexp, $literal) ? \sprintf('(\constant(%1$s) instanceof \UnitEnum ? \constant(%1$s) : throw new \TypeError(%2$s))', $name, var_export(\sprintf('The string "%s" is not the name of a valid enum case.', $literal), true)) : self::compileNotAllowed('Enum case', $literal);
        }

        return \sprintf('\%s::getEnumCase(%s, %s)', self::class, $name, var_export($this->regexp, true));
    }

    private function evaluateEnum(array $arguments, string $name): \UnitEnum
    {
        return self::getEnumCase($name, $this->regexp);
    }

    /**
     * Returns the value of a string literal generated by Compiler::string(), or null for any other code.
     */
    private static function parseStringLiteral(string $code): ?string
    {
        return preg_match('{^"((?:[^"$\\\\]++|\\\\\\\\)*+)"$}D', $code, $m) ? str_replace('\\\\', '\\', $m[1]) : null;
    }

    private static function compileNotAllowed(string $kind, string $name): string
    {
        return \sprintf('(throw new \RuntimeException(%s))', var_export(\sprintf('%s "%s" is not allowed.', $kind, $name), true));
    }
}