Issues in API.class.php (master) - Issues in master - 1n9i9c7om/ClashOfClans-API-PHP - Measure and Improve Code Quality continuously with Scrutinizer

Issues (93)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

ClashAPI/API.class.php (10 issues)

Labels

Severity

Minor 10

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
require_once "League.class.php";
require_once "Location.class.php";
require_once "Clan.class.php";
require_once "Member.class.php";
require_once "Warlog.class.php";
require_once "LogEntry.class.php";
require_once "Player.class.php";

/**
 * Class to get JSON-decoded arrays containing information provided by SuperCell's official Clash of Clans API located at https://developer.clashofclans.com
 */

class ClashOfClans
{
	private $_apiKey = "Change_This_To_Your_Token";
	
	/**
	 * Send a Request to SuperCell's Servers and contains the authorization-Token.
	 *
	 * @param string $url
	 * @return string; response from API (json)

	 */
	protected function sendRequest($url)
	{
		$ch = curl_init(); 
		curl_setopt($ch, CURLOPT_URL, $url);
		curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
		curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
		curl_setopt($ch, CURLOPT_HTTPHEADER, array(
  			'authorization: Bearer '.$this->_apiKey // 
		));
		$output = curl_exec($ch);
		curl_close($ch); 
		return $output;
	}

	/**
	 * Search all clans by name
	 *
	 * @param $searchString, the clan name, e.g. foxforcefürth
	 * @return object, search results.

	 */
	public function searchClanByName($searchString)
	{
		$json = $this->sendRequest("https://api.clashofclans.com/v1/clans?name=".urlencode($searchString));
		return json_decode($json);
	}

	/** 
	 * Search for clans by using multiple parameters
	 * 
	 * @param array
	 * @return object
	 */
	public function searchClan($parameters)
	{
		/*
		Array can have these indexes: 
		* name (string)
		* warFrequency (string, {"always", "moreThanOncePerWeek", "oncePerWeek", "lessThanOncePerWeek", "never", "unknown"})
		* locationId (integer)
		* minMembers (integer)
		* maxMembers (integer)
		* minClanPoints (integer)
		* minClanLevel (integer)
		* limit (integer)
		* after (integer)
		* before (integer)
		For more information, take a look at the official documentation: https://developer.clashofclans.com/#/documentation
		*/

		$json = $this->sendRequest("https://api.clashofclans.com/v1/clans?".http_build_query($parameters));
		return json_decode($json);
	}

	/**
	 * Get Player.
	 */
	public function getPlayer($tag)
	{
		$json = $this->sendRequest("https://api.clashofclans.com/v1/players/" . urlencode($tag));
		return json_decode($json);
	}

	/**
	 * Get information of a clan
	 *
	 * @param $tag, clantag. (e.g. #22UCCU0J)
	 * @return object, clan information.

	 */
	public function getClanByTag($tag) //#22UCCU0J = foxforcefürth
	{
		$json = $this->sendRequest("https://api.clashofclans.com/v1/clans/".urlencode($tag));
		return json_decode($json);
	}

	/**
	 * Get information about the membersof a clan
	 *
	 * @param $tag, clantag. (e.g. #22UCCU0J)
	 * @return object, member information.

	 */
	public function getClanMembersByTag($tag)
	{
		$json = $this->sendRequest("https://api.clashofclans.com/v1/clans/".urlencode($tag)."/members");
		return json_decode($json);
	}

	/**
	 * Get a list of all locations supported by SuperCell's Clan-System
	 *
	 * @return object, all locations.

	 */
	public function getLocationList()
	{
		$json = $this->sendRequest("https://api.clashofclans.com/v1/locations");
		return json_decode($json);
	}

	/**
	 * Get information about a location by providing it's id.
	 *
	 * @param $locationId
	 * @return object, location info.

	 */
	public function getLocationInfo($locationId) //32000094 = Germany
	{
		$json = $this->sendRequest("https://api.clashofclans.com/v1/locations/".$locationId);
		return json_decode($json);
	}

	/**
	 * Get information about all leages.
	 *
	 * @return object, league info.

	 */
	public function getLeagueList()
	{
		$json = $this->sendRequest("https://api.clashofclans.com/v1/leagues");
		return json_decode($json);
	}

	/**
	 * Get ranklist information about players or clans
	 *
	 * @param $locationId (tip: 32000006 is "International")
	 * @param (optional) $clans
	 * @return object, location info.

	 */
	public function getRankList($locationId, $clans = false) //if clans is not set to true, return player ranklist
	{
		if ($clans)
		{
			$json = $this->sendRequest("https://api.clashofclans.com/v1/locations/".$locationId."/rankings/clans");
		}
		else
		{
			$json = $this->sendRequest("https://api.clashofclans.com/v1/locations/".$locationId."/rankings/players");
		}
		return json_decode($json);
	}
	
	/**
	 * Get whether the war log of a specific clan is public or not 
	 *
	 * @param $tag, clan tag
	 * @return bool, warlog public yes/no.

	 */
	public function isWarlogPublic($tag)
	{
		$json = $this->sendRequest("https://api.clashofclans.com/v1/clans/".urlencode($tag)."/warlog");
		$logInfo = json_decode($json);
		if(property_exists($logInfo, "reason"))
		{
			if($logInfo->reason == "accessDenied")
			{
				return false;
			}
		}
		return true;
	}
	
	/**
	 * Get a clan's warlog by specifying it's clantag
	 *
	 * @param $tag, clan tag
	 * @param (optional) $parameters array, other parameters (before, after, limit)
	 * @return object, warlog. Dummy warlog when warlog not public.

	 */
	public function getWarlog($tag, $parameters = "")
	{
		if($this->isWarlogPublic($tag))
		{
			$json = $this->sendRequest("https://api.clashofclans.com/v1/clans/".urlencode($tag)."/warlog?".http_build_query($parameters));
			return json_decode($json);
		}
		else
		{
			//dummy warlog:
			return json_decode('{
			  "items": [
				{
				  "result": "win",
				  "endTime": "20160803T103621.000Z",
				  "teamSize": 0,
				  "clan": {
					"tag": "#22UCCU0J",
					"name": "foxforce",
					"badgeUrls": {
					  "small": "https://api-assets.clashofclans.com/badges/70/5tEhjxjRbdef_mG_PGehpowUmLJU4qPnY7zQJPv1Lj0.png",
					  "large": "https://api-assets.clashofclans.com/badges/512/5tEhjxjRbdef_mG_PGehpowUmLJU4qPnY7zQJPv1Lj0.png",
					  "medium": "https://api-assets.clashofclans.com/badges/200/5tEhjxjRbdef_mG_PGehpowUmLJU4qPnY7zQJPv1Lj0.png"
					},
					"clanLevel": 0,
					"attacks": 0,
					"stars": 0,
					"destructionPercentage": 0,
					"expEarned": 0
				  },
				  "opponent": {
					"tag": "#22UCCU0J",
					"name": "foxforce",
					"badgeUrls": {
					  "small": "https://api-assets.clashofclans.com/badges/70/LGoHdPrA6OiVcKYzDcIiF7SV8kWW1qd-EhWkvGPsARM.png",
					  "large": "https://api-assets.clashofclans.com/badges/512/LGoHdPrA6OiVcKYzDcIiF7SV8kWW1qd-EhWkvGPsARM.png",
					  "medium": "https://api-assets.clashofclans.com/badges/200/LGoHdPrA6OiVcKYzDcIiF7SV8kWW1qd-EhWkvGPsARM.png"
					},
					"clanLevel": 0,
					"stars": 0,
					"destructionPercentage": 0
				  }
				}
			  ],
			  "paging": {
				"cursors": {
				  "after": "0"
				}
			  }
			}');
		}
	}
};

?>


1			<?php
2			require_once "League.class.php";
3			require_once "Location.class.php";
4			require_once "Clan.class.php";
5			require_once "Member.class.php";
6			require_once "Warlog.class.php";
7			require_once "LogEntry.class.php";
8			require_once "Player.class.php";
9
10			/**
11			* Class to get JSON-decoded arrays containing information provided by SuperCell's official Clash of Clans API located at https://developer.clashofclans.com
12			*/
13
14			class ClashOfClans
15			{
16			private $_apiKey = "Change_This_To_Your_Token";
17
18			/**
19			* Send a Request to SuperCell's Servers and contains the authorization-Token.
20			*
21			* @param string $url
22			* @return string; response from API (json)
			0 ignored issues – show Documentation introduced 2016-02-05 15:21 UTC by Report Bug Copy Issue Report Show Similar Issues like this The doc-type `string;` could not be parsed: Expected "\|" or "end of type", but got ";" at position 6. (view supported doc-types) This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. Loading history...
23			*/
24			protected function sendRequest($url)
25			{
26			$ch = curl_init();
27			curl_setopt($ch, CURLOPT_URL, $url);
28			curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
29			curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
30			curl_setopt($ch, CURLOPT_HTTPHEADER, array(
31			'authorization: Bearer '.$this->_apiKey //
32			));
33			$output = curl_exec($ch);
34			curl_close($ch);
35			return $output;
36			}
37
38			/**
39			* Search all clans by name
40			*
41			* @param $searchString, the clan name, e.g. foxforcefürth
42			* @return object, search results.
			0 ignored issues – show Documentation introduced 2016-08-03 12:07 UTC by Report Bug Copy Issue Report Show Similar Issues like this The doc-type `object,` could not be parsed: Expected "\|" or "end of type", but got "," at position 6. (view supported doc-types) This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. Loading history...
43			*/
44			public function searchClanByName($searchString)
45			{
46			$json = $this->sendRequest("https://api.clashofclans.com/v1/clans?name=".urlencode($searchString));
47			return json_decode($json);
48			}
49
50			/**
51			* Search for clans by using multiple parameters
52			*
53			* @param array
54			* @return object
55			*/
56			public function searchClan($parameters)
57			{
58			/*
59			Array can have these indexes:
60			* name (string)
61			* warFrequency (string, {"always", "moreThanOncePerWeek", "oncePerWeek", "lessThanOncePerWeek", "never", "unknown"})
62			* locationId (integer)
63			* minMembers (integer)
64			* maxMembers (integer)
65			* minClanPoints (integer)
66			* minClanLevel (integer)
67			* limit (integer)
68			* after (integer)
69			* before (integer)
70			For more information, take a look at the official documentation: https://developer.clashofclans.com/#/documentation
71			*/
72
73			$json = $this->sendRequest("https://api.clashofclans.com/v1/clans?".http_build_query($parameters));
74			return json_decode($json);
75			}
76
77			/**
78			* Get Player.
79			*/
80			public function getPlayer($tag)
81			{
82			$json = $this->sendRequest("https://api.clashofclans.com/v1/players/" . urlencode($tag));
83			return json_decode($json);
84			}
85
86			/**
87			* Get information of a clan
88			*
89			* @param $tag, clantag. (e.g. #22UCCU0J)
90			* @return object, clan information.
			0 ignored issues – show Documentation introduced 2016-08-03 12:07 UTC by Report Bug Copy Issue Report Show Similar Issues like this The doc-type `object,` could not be parsed: Expected "\|" or "end of type", but got "," at position 6. (view supported doc-types) This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. Loading history...
91			*/
92			public function getClanByTag($tag) //#22UCCU0J = foxforcefürth
93			{
94			$json = $this->sendRequest("https://api.clashofclans.com/v1/clans/".urlencode($tag));
95			return json_decode($json);
96			}
97
98			/**
99			* Get information about the membersof a clan
100			*
101			* @param $tag, clantag. (e.g. #22UCCU0J)
102			* @return object, member information.
			0 ignored issues – show Documentation introduced 2016-08-03 12:07 UTC by Report Bug Copy Issue Report Show Similar Issues like this The doc-type `object,` could not be parsed: Expected "\|" or "end of type", but got "," at position 6. (view supported doc-types) This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. Loading history...
103			*/
104			public function getClanMembersByTag($tag)
105			{
106			$json = $this->sendRequest("https://api.clashofclans.com/v1/clans/".urlencode($tag)."/members");
107			return json_decode($json);
108			}
109
110			/**
111			* Get a list of all locations supported by SuperCell's Clan-System
112			*
113			* @return object, all locations.
			0 ignored issues – show Documentation introduced 2016-08-03 12:07 UTC by Report Bug Copy Issue Report Show Similar Issues like this The doc-type `object,` could not be parsed: Expected "\|" or "end of type", but got "," at position 6. (view supported doc-types) This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. Loading history...
114			*/
115			public function getLocationList()
116			{
117			$json = $this->sendRequest("https://api.clashofclans.com/v1/locations");
118			return json_decode($json);
119			}
120
121			/**
122			* Get information about a location by providing it's id.
123			*
124			* @param $locationId
125			* @return object, location info.
			0 ignored issues – show Documentation introduced 2016-08-03 12:07 UTC by Report Bug Copy Issue Report Show Similar Issues like this The doc-type `object,` could not be parsed: Expected "\|" or "end of type", but got "," at position 6. (view supported doc-types) This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. Loading history...
126			*/
127			public function getLocationInfo($locationId) //32000094 = Germany
128			{
129			$json = $this->sendRequest("https://api.clashofclans.com/v1/locations/".$locationId);
130			return json_decode($json);
131			}
132
133			/**
134			* Get information about all leages.
135			*
136			* @return object, league info.
			0 ignored issues – show Documentation introduced 2016-08-03 12:07 UTC by Report Bug Copy Issue Report Show Similar Issues like this The doc-type `object,` could not be parsed: Expected "\|" or "end of type", but got "," at position 6. (view supported doc-types) This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. Loading history...
137			*/
138			public function getLeagueList()
139			{
140			$json = $this->sendRequest("https://api.clashofclans.com/v1/leagues");
141			return json_decode($json);
142			}
143
144			/**
145			* Get ranklist information about players or clans
146			*
147			* @param $locationId (tip: 32000006 is "International")
148			* @param (optional) $clans
149			* @return object, location info.
			0 ignored issues – show Documentation introduced 2016-08-03 12:07 UTC by Report Bug Copy Issue Report Show Similar Issues like this The doc-type `object,` could not be parsed: Expected "\|" or "end of type", but got "," at position 6. (view supported doc-types) This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. Loading history...
150			*/
151			public function getRankList($locationId, $clans = false) //if clans is not set to true, return player ranklist
152			{
153			if ($clans)
154			{
155			$json = $this->sendRequest("https://api.clashofclans.com/v1/locations/".$locationId."/rankings/clans");
156			}
157			else
158			{
159			$json = $this->sendRequest("https://api.clashofclans.com/v1/locations/".$locationId."/rankings/players");
160			}
161			return json_decode($json);
162			}
163
164			/**
165			* Get whether the war log of a specific clan is public or not
166			*
167			* @param $tag, clan tag
168			* @return bool, warlog public yes/no.
			0 ignored issues – show Documentation introduced 2016-08-03 12:07 UTC by Report Bug Copy Issue Report Show Similar Issues like this The doc-type `bool,` could not be parsed: Expected "\|" or "end of type", but got "," at position 4. (view supported doc-types) This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. Loading history...
169			*/
170			public function isWarlogPublic($tag)
171			{
172			$json = $this->sendRequest("https://api.clashofclans.com/v1/clans/".urlencode($tag)."/warlog");
173			$logInfo = json_decode($json);
174			if(property_exists($logInfo, "reason"))
175			{
176			if($logInfo->reason == "accessDenied")
177			{
178			return false;
179			}
180			}
181			return true;
182			}
183
184			/**
185			* Get a clan's warlog by specifying it's clantag
186			*
187			* @param $tag, clan tag
188			* @param (optional) $parameters array, other parameters (before, after, limit)
189			* @return object, warlog. Dummy warlog when warlog not public.
			0 ignored issues – show Documentation introduced 2016-08-03 12:07 UTC by Report Bug Copy Issue Report Show Similar Issues like this The doc-type `object,` could not be parsed: Expected "\|" or "end of type", but got "," at position 6. (view supported doc-types) This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. Loading history...
190			*/
191			public function getWarlog($tag, $parameters = "")
192			{
193			if($this->isWarlogPublic($tag))
194			{
195			$json = $this->sendRequest("https://api.clashofclans.com/v1/clans/".urlencode($tag)."/warlog?".http_build_query($parameters));
196			return json_decode($json);
197			}
198			else
199			{
200			//dummy warlog:
201			return json_decode('{
202			"items": [
203			{
204			"result": "win",
205			"endTime": "20160803T103621.000Z",
206			"teamSize": 0,
207			"clan": {
208			"tag": "#22UCCU0J",
209			"name": "foxforce",
210			"badgeUrls": {
211			"small": "https://api-assets.clashofclans.com/badges/70/5tEhjxjRbdef_mG_PGehpowUmLJU4qPnY7zQJPv1Lj0.png",
212			"large": "https://api-assets.clashofclans.com/badges/512/5tEhjxjRbdef_mG_PGehpowUmLJU4qPnY7zQJPv1Lj0.png",
213			"medium": "https://api-assets.clashofclans.com/badges/200/5tEhjxjRbdef_mG_PGehpowUmLJU4qPnY7zQJPv1Lj0.png"
214			},
215			"clanLevel": 0,
216			"attacks": 0,
217			"stars": 0,
218			"destructionPercentage": 0,
219			"expEarned": 0
220			},
221			"opponent": {
222			"tag": "#22UCCU0J",
223			"name": "foxforce",
224			"badgeUrls": {
225			"small": "https://api-assets.clashofclans.com/badges/70/LGoHdPrA6OiVcKYzDcIiF7SV8kWW1qd-EhWkvGPsARM.png",
226			"large": "https://api-assets.clashofclans.com/badges/512/LGoHdPrA6OiVcKYzDcIiF7SV8kWW1qd-EhWkvGPsARM.png",
227			"medium": "https://api-assets.clashofclans.com/badges/200/LGoHdPrA6OiVcKYzDcIiF7SV8kWW1qd-EhWkvGPsARM.png"
228			},
229			"clanLevel": 0,
230			"stars": 0,
231			"destructionPercentage": 0
232			}
233			}
234			],
235			"paging": {
236			"cursors": {
237			"after": "0"
238			}
239			}
240			}');
241			}
242			}
243			};
244
245			?>
246

1n9i9c7om / ClashOfClans-API-PHP

Issues (93)

Security Analysis no request data

ClashAPI/API.class.php (10 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like