Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
   public static function getFiles($directory, $ext) {
      $array_dir  = [];
      $array_file = [];

      if (is_dir($directory)) {
         if ($dh = opendir($directory)) {
            while (($file = readdir($dh)) !== false) {
               $filename  = $file;
               $filetype  = filetype($directory. $file);
               $filedate  = Html::convDate(date ("Y-m-d", filemtime($directory.$file)));
               $basename  = explode('.', basename($filename));
               $extension = array_pop($basename);
               if ($filename == ".." OR $filename == ".") {
                  echo "";
               } else {
                  if ($filetype == 'file' && $extension == $ext) {
                     if ($ext == PLUGIN_ORDER_SIGNATURE_EXTENSION) {
                        $name = array_shift($basename);
                        if (strtolower($name) == strtolower($_SESSION["glpiname"])) {
                           $array_file[] = [$filename, $filedate, $extension];
                        }
                     } else {
                        $array_file[] = [$filename, $filedate, $extension];
                     }

                  } else if ($filetype == "dir") {
                     $array_dir[] = $filename;
                  }
               }
            }
            closedir($dh);
         }
      }

      rsort($array_file);

      return $array_file;
   }