Algo-Web /
POData-Laravel
| Conditions | 1 |
| Paths | 1 |
| Total Lines | 4 |
| Code Lines | 2 |
| Lines | 0 |
| Ratio | 0 % |
| Tests | 0 |
| CRAP Score | 2 |
| Changes | 0 | ||
| Metric | Value |
|---|---|
| c | 0 |
| b | 0 |
| f | 0 |
| dl | 0 |
| loc | 4 |
| ccs | 0 |
| cts | 0 |
| cp | 0 |
| rs | 10 |
| cc | 1 |
| eloc | 2 |
| nc | 1 |
| nop | 0 |
| crap | 2 |
| 1 | <?php |
||
| 2 | |||
| 3 | namespace AlgoWeb\PODataLaravel\Controllers; |
||
| 4 | |||
| 5 | use Illuminate\Http\Request; |
||
| 6 | use Illuminate\Http\Response; |
||
| 7 | use AlgoWeb\PODataLaravel\Controllers\Controller as BaseController; |
||
| 8 | use Illuminate\Support\Facades\App; |
||
| 9 | use Illuminate\Support\Facades\Storage; |
||
| 10 | use POData\OperationContext\ServiceHost as ServiceHost; |
||
| 11 | use POData\SimpleDataService as DataService; |
||
| 12 | use POData\OperationContext\Web\Illuminate\IlluminateOperationContext as OperationContextAdapter; |
||
| 13 | use voku\helper\AntiXSS; |
||
| 14 | |||
| 15 | class ODataController extends BaseController |
||
| 16 | { |
||
| 17 | /** |
||
| 18 | * Display a listing of the resource. |
||
| 19 | * |
||
| 20 | * @return \Illuminate\Http\Response |
||
| 21 | */ |
||
| 22 | public function index(Request $request, $dump = false) |
||
| 23 | { |
||
| 24 | $dump = $dump || $this->getIsDumping(); |
||
| 25 | $antiXss = new AntiXSS(); |
||
|
0 ignored issues
–
show
|
|||
| 26 | $op = new OperationContextAdapter($request); |
||
| 27 | $host = new ServiceHost($op, $request); |
||
| 28 | $host->setServiceUri("/odata.svc/"); |
||
| 29 | |||
| 30 | $query = App::make('odataquery'); |
||
| 31 | $meta = App::make('metadata'); |
||
| 32 | |||
| 33 | $service = new DataService($query, $meta, $host); |
||
| 34 | $service->handleRequest(); |
||
| 35 | |||
| 36 | $odataResponse = $op->outgoingResponse(); |
||
| 37 | |||
| 38 | if (true === $dump) { |
||
| 39 | // iff XTest header is set, containing class and method name |
||
| 40 | // dump outgoing odataResponse, metadata, and incoming request |
||
| 41 | $xTest = $request->header('XTest'); |
||
| 42 | $xTest = (null !== $xTest) ? $xTest : $request->method() . ";" . str_replace("/", "-", $request->path()); |
||
| 43 | if (null != $xTest) { |
||
| 44 | $cerealRequest = serialize($request); |
||
| 45 | $cerealMeta = serialize($meta); |
||
| 46 | $cerealResponse = serialize($odataResponse); |
||
| 47 | Storage::put($xTest.'request', $cerealRequest); |
||
| 48 | Storage::put($xTest.'metadata', $cerealMeta); |
||
| 49 | Storage::put($xTest.'response', $cerealResponse); |
||
| 50 | } |
||
| 51 | } |
||
| 52 | |||
| 53 | $content = $odataResponse->getStream(); |
||
| 54 | //$content = $antiXss->xss_clean($content); |
||
|
0 ignored issues
–
show
64% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them.  Loading history...
|
|||
| 55 | $headers = $odataResponse->getHeaders(); |
||
| 56 | $responseCode = $headers[\POData\Common\ODataConstants::HTTPRESPONSE_HEADER_STATUS_CODE]; |
||
| 57 | $responseCode = isset($responseCode) ? intval($responseCode) : 200; |
||
| 58 | $response = new Response($content, $responseCode); |
||
|
0 ignored issues
–
show
$content can contain request data and is used in output context(s) leading to a potential security vulnerability.
9 paths for user data to reach this point
1. Path:
Fetching key
HTTP_HOST from $_SERVER
in src/POData/OperationContext/SimpleRequestAdapter.php on line 23
2. Path:
$this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned
in ServerBag.php on line 62
3. Path:
Read from
$_POST, and $_POST is passed to Request::createRequestFromFactory()
in Request.php on line 317
5. Path:
Fetching key
HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned
in Request.php on line 310
6. Path:
Fetching key
HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned
in Request.php on line 313
7. Path:
$server['HTTP_HOST'] seems to return tainted data, and $server is assigned
in Request.php on line 383
8. Path:
$this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned
in ServerBag.php on line 43
9. Path:
$this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned
in ServerBag.php on line 44
Used in output context
Preventing Cross-Site-Scripting AttacksCross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user. In order to prevent this, make sure to escape all user-provided data:
// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);
// for URLs
$sanitized = urlencode($tainted);
General Strategies to prevent injectionIn general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
throw new \InvalidArgumentException('This input is not allowed.');
}
For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted;
Loading history...
|
|||
| 59 | $response->setStatusCode($headers["Status"]); |
||
| 60 | |||
| 61 | foreach ($headers as $headerName => $headerValue) { |
||
| 62 | if (!is_null($headerValue)) { |
||
| 63 | $response->headers->set($headerName, $headerValue); |
||
| 64 | } |
||
| 65 | } |
||
| 66 | return $response; |
||
| 67 | } |
||
| 68 | |||
| 69 | /** |
||
| 70 | * @return mixed |
||
| 71 | */ |
||
| 72 | protected function getIsDumping() |
||
| 73 | { |
||
| 74 | return true === env('APP_DUMP_REQUESTS', false); |
||
| 75 | } |
||
| 76 | } |
||
| 77 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVarassignment in line 1 and the$higherassignment in line 2 are dead. The first because$myVaris never used and the second because$higheris always overwritten for every possible time line.