Completed
Pull Request — master (#103)
by Alex
07:51
created

ODataController::index()   D

Complexity

Conditions 9
Paths 354

Size

Total Lines 67
Code Lines 50

Duplication

Lines 0
Ratio 0 %

Code Coverage

Tests 0
CRAP Score 90

Importance

Changes 0
Metric Value
dl 0
loc 67
ccs 0
cts 18
cp 0
rs 4.4438
c 0
b 0
f 0
cc 9
eloc 50
nc 354
nop 1
crap 90

How to fix   Long Method   

Long Method

Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.

For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.

Commonly applied refactorings include:

1
<?php
2
3
namespace AlgoWeb\PODataLaravel\Controllers;
4
5
use AlgoWeb\PODataLaravel\Serialisers\IronicSerialiser;
6
use Carbon\Carbon;
7
use Illuminate\Http\Request;
8
use Illuminate\Http\Response;
9
use AlgoWeb\PODataLaravel\Controllers\Controller as BaseController;
10
use Illuminate\Support\Facades\App;
11
use Illuminate\Support\Facades\DB;
12
use Illuminate\Support\Facades\Storage;
13
use POData\OperationContext\ServiceHost as ServiceHost;
14
use POData\SimpleDataService as DataService;
15
use POData\OperationContext\Web\Illuminate\IlluminateOperationContext as OperationContextAdapter;
16
use voku\helper\AntiXSS;
17
18
class ODataController extends BaseController
19
{
20
    /**
21
     * Display a listing of the resource.
22
     *
23
     * @return \Illuminate\Http\Response
24
     */
25
    public function index(Request $request)
26
    {
27
        $dump = $this->getIsDumping();
28
        $dryRun = $this->getIsDryRun();
29
        $commitCall = $dryRun ? 'rollBack' : 'commit';
30
31
        try {
32
            DB::beginTransaction();
33
            $context = new OperationContextAdapter($request);
34
            $host = new ServiceHost($context, $request);
35
            $host->setServiceUri('/odata.svc/');
36
37
            $query = App::make('odataquery');
38
            $meta = App::make('metadata');
39
40
            $service = new DataService($query, $meta, $host);
41
            $cereal = new IronicSerialiser($service, null);
42
            $service = new DataService($query, $meta, $host, $cereal);
43
            $service->handleRequest();
44
45
            $odataResponse = $context->outgoingResponse();
46
47
            if (true === $dump) {
48
                // iff XTest header is set, containing class and method name
49
                // dump outgoing odataResponse, metadata, and incoming request
50
                $xTest = $request->header('XTest');
51
                $date = Carbon::now(0);
52
                $timeString = $date->toTimeString();
53
                $xTest = (null !== $xTest) ? $xTest
54
                    : $request->method() . ';' . str_replace('/', '-', $request->path()) . ';' . $timeString . ';';
55
                if (null != $xTest) {
56
                    $reflectionClass = new \ReflectionClass('Illuminate\Http\Request');
57
                    $reflectionProperty = $reflectionClass->getProperty('userResolver');
58
                    $reflectionProperty->setAccessible(true);
59
                    $reflectionProperty->setValue($request, null);
60
                    $reflectionProperty = $reflectionClass->getProperty('routeResolver');
61
                    $reflectionProperty->setAccessible(true);
62
                    $reflectionProperty->setValue($request, null);
63
                    $cerealRequest = serialize($request);
64
                    $cerealMeta = serialize($meta);
65
                    $cerealResponse = serialize($odataResponse);
66
                    Storage::put($xTest . 'request', $cerealRequest);
67
                    Storage::put($xTest . 'metadata', $cerealMeta);
68
                    Storage::put($xTest . 'response', $cerealResponse);
69
                }
70
            }
71
72
            $content = $odataResponse->getStream();
73
74
            $headers = $odataResponse->getHeaders();
75
            $responseCode = $headers[\POData\Common\ODataConstants::HTTPRESPONSE_HEADER_STATUS_CODE];
76
            $responseCode = isset($responseCode) ? intval($responseCode) : 200;
77
            $response = new Response($content, $responseCode);
0 ignored issues
show
Security Cross-Site Scripting introduced by
$content can contain request data and is used in output context(s) leading to a potential security vulnerability.

9 paths for user data to reach this point

  1. Path: Fetching key HTTP_HOST from $_SERVER in src/POData/OperationContext/SimpleRequestAdapter.php on line 23
  1. Fetching key HTTP_HOST from $_SERVER
    in vendor/src/POData/OperationContext/SimpleRequestAdapter.php on line 23
  2. SimpleRequestAdapter::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  3. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  4. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  5. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  6. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  7. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  8. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  9. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  10. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  11. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  12. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  13. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  14. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  15. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  16. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  17. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  18. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  19. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  20. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  2. Path: $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned in ServerBag.php on line 62
  1. $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned
    in vendor/ServerBag.php on line 62
  2. ParameterBag::$parameters is assigned
    in vendor/ServerBag.php on line 77
  3. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  4. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  5. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  6. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  7. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  8. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  9. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  10. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  11. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  12. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  13. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  14. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  15. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  16. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  17. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  18. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  19. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  20. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  21. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  22. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  23. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  24. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  25. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  26. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  27. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  28. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  29. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  30. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  3. Path: Read from $_POST, and $_POST is passed to Request::createRequestFromFactory() in Request.php on line 317
  1. Read from $_POST, and $_POST is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 317
  2. $request is passed to Request::__construct()
    in vendor/Request.php on line 2052
  3. $request is passed to Request::initialize()
    in vendor/Request.php on line 258
  4. $request is passed to ParameterBag::__construct()
    in vendor/Request.php on line 276
  5. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  6. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  7. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  8. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  9. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  10. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  11. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  12. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  13. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  14. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  15. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  16. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  17. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  18. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  19. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  20. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  21. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  22. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  23. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  24. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  25. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  26. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  27. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  28. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  29. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  30. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  31. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  32. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  33. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  4. Path: Read from $_SERVER, and $server is assigned in Request.php on line 307
  1. Read from $_SERVER, and $server is assigned
    in vendor/Request.php on line 307
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 317
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2052
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 258
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 281
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  9. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  10. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  11. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  12. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  13. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  14. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  15. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  16. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  17. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  18. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  19. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  20. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  21. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  22. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  23. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  24. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  25. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  26. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  27. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  28. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  29. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  30. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  31. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  32. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  33. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  34. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  5. Path: Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned in Request.php on line 310
  1. Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned
    in vendor/Request.php on line 310
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 317
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2052
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 258
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 281
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  9. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  10. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  11. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  12. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  13. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  14. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  15. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  16. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  17. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  18. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  19. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  20. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  21. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  22. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  23. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  24. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  25. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  26. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  27. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  28. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  29. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  30. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  31. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  32. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  33. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  34. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  6. Path: Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned in Request.php on line 313
  1. Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned
    in vendor/Request.php on line 313
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 317
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2052
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 258
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 281
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  9. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  10. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  11. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  12. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  13. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  14. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  15. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  16. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  17. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  18. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  19. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  20. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  21. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  22. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  23. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  24. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  25. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  26. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  27. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  28. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  29. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  30. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  31. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  32. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  33. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  34. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  7. Path: $server['HTTP_HOST'] seems to return tainted data, and $server is assigned in Request.php on line 383
  1. $server['HTTP_HOST'] seems to return tainted data, and $server is assigned
    in vendor/Request.php on line 383
  2. $server is assigned
    in vendor/Request.php on line 431
  3. $server is assigned
    in vendor/Request.php on line 432
  4. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 434
  5. $server is passed to Request::__construct()
    in vendor/Request.php on line 2052
  6. $server is passed to Request::initialize()
    in vendor/Request.php on line 258
  7. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 281
  8. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  9. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  10. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  11. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  12. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  13. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  14. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  15. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  16. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  17. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  18. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  19. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  20. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  21. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  22. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  23. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  24. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  25. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  26. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  27. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  28. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  29. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  30. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  31. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  32. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  33. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  34. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  35. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  36. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  8. Path: $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 43
  1. $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 43
  2. $headers is assigned
    in vendor/ServerBag.php on line 44
  3. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 282
  4. $values is assigned
    in vendor/HeaderBag.php on line 31
  5. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 32
  6. (array) $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 143
  7. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 146
  8. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 67
  9. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 115
  10. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1822
  11. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1853
  12. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 99
  13. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  14. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  15. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  16. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  17. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  18. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  19. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  20. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  21. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  22. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  23. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  24. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  25. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  26. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  27. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  28. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  29. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  30. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  31. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  32. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  33. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  34. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  35. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  36. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  37. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  38. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  39. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  40. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  9. Path: $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 44
  1. $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 44
  2. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 282
  3. $values is assigned
    in vendor/HeaderBag.php on line 31
  4. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 32
  5. (array) $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 143
  6. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 146
  7. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 67
  8. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 115
  9. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1822
  10. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1853
  11. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 99
  12. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  13. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  14. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  15. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  16. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  17. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  18. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  19. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  20. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  21. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  22. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  23. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  24. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  25. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  26. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  27. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  28. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  29. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  30. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  31. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  32. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  33. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  34. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  35. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  36. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  37. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  38. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  39. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72

Used in output context

  1. Response::__construct() uses Response::setContent() ($content)
    in vendor/Response.php on line 201
  2. Response::setContent() uses property Response::$content for writing
    in vendor/Response.php on line 402
  3. Property Response::$content is used in echo
    in vendor/Response.php on line 361

Preventing Cross-Site-Scripting Attacks

Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user.

In order to prevent this, make sure to escape all user-provided data:

// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
78
            $response->setStatusCode($headers['Status']);
79
80
            foreach ($headers as $headerName => $headerValue) {
81
                if (!is_null($headerValue)) {
82
                    $response->headers->set($headerName, $headerValue);
83
                }
84
            }
85
            DB::$commitCall();
86
        } catch (\Exception $e) {
87
            DB::rollBack();
88
            throw $e;
89
        }
90
        return $response;
91
    }
92
93
    /**
94
     * @return bool
95
     */
96
    protected function getIsDumping()
0 ignored issues
show
Coding Style introduced by
function getIsDumping() does not seem to conform to the naming convention (^(?:is|has|should|may|supports)).

This check examines a number of code elements and verifies that they conform to the given naming conventions.

You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods.

Loading history...
97
    {
98
        $configDump = env('APP_DUMP_REQUESTS', false);
99
        return true === $configDump;
100
    }
101
102
    /**
103
     * Is application dry-running (ie, not committing) non-READ requests?
104
     *
105
     * @return bool
106
     */
107
    protected function getIsDryRun()
0 ignored issues
show
Coding Style introduced by
function getIsDryRun() does not seem to conform to the naming convention (^(?:is|has|should|may|supports)).

This check examines a number of code elements and verifies that they conform to the given naming conventions.

You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods.

Loading history...
108
    {
109
        $configDump = env('APP_DRY_RUN', false);
110
        return true === $configDump;
111
    }
112
}
113