From f2dc8ba18285a6d14b47cebcae36afe550b003e4 Mon Sep 17 00:00:00 2001
From: Alex Vanderbist <alex.vanderbist@gmail.com>
Date: Mon, 8 Mar 2021 14:54:32 +0100
Subject: [PATCH] Backport security for old PHP versions (#334)

---
 .../MakeViewVariableOptionalSolution.php       | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/Solutions/MakeViewVariableOptionalSolution.php b/src/Solutions/MakeViewVariableOptionalSolution.php
index 5e4164de..f33b650d 100644
--- a/src/Solutions/MakeViewVariableOptionalSolution.php
+++ b/src/Solutions/MakeViewVariableOptionalSolution.php
@@ -4,6 +4,7 @@
 
 use Facade\IgnitionContracts\RunnableSolution;
 use Illuminate\Support\Facades\Blade;
+use Illuminate\Support\Str;
 
 class MakeViewVariableOptionalSolution implements RunnableSolution
 {
@@ -72,6 +73,10 @@ public function run(array $parameters = [])
 
     public function makeOptional(array $parameters = [])
     {
+        if (!$this->isSafePath($parameters['viewFile'])) {
+            return false;
+        }
+
         $originalContents = file_get_contents($parameters['viewFile']);
         $newContents = str_replace('$'.$parameters['variableName'], '$'.$parameters['variableName']." ?? ''", $originalContents);
 
@@ -87,6 +92,19 @@ public function makeOptional(array $parameters = [])
         return $newContents;
     }
 
+    protected function isSafePath(string $path): bool
+    {
+        if (!Str::startsWith($path, ['/', './'])) {
+            return false;
+        }
+
+        if (!Str::endsWith($path, '.blade.php')) {
+            return false;
+        }
+
+        return true;
+    }
+
     protected function generateExpectedTokens(array $originalTokens, string $variableName): array
     {
         $expectedTokens = [];