Test Failed
Push — master ( a0b87a...51cb17 )
by Alex
05:49
created

ODataController   A

Complexity

Total Complexity 11

Size/Duplication

Total Lines 95
Duplicated Lines 0 %

Coupling/Cohesion

Components 0
Dependencies 10

Test Coverage

Coverage 0%

Importance

Changes 0
Metric Value
wmc 11
lcom 0
cbo 10
dl 0
loc 95
ccs 0
cts 22
cp 0
rs 10
c 0
b 0
f 0

3 Methods

Rating   Name   Duplication   Size   Complexity  
D index() 0 67 9
A isDumping() 0 5 1
A isDryRun() 0 5 1
1
<?php
2
3
namespace AlgoWeb\PODataLaravel\Controllers;
4
5
use AlgoWeb\PODataLaravel\Serialisers\IronicSerialiser;
6
use Carbon\Carbon;
7
use Illuminate\Http\Request;
8
use Illuminate\Http\Response;
9
use AlgoWeb\PODataLaravel\Controllers\Controller as BaseController;
10
use Illuminate\Support\Facades\App;
11
use Illuminate\Support\Facades\DB;
12
use Illuminate\Support\Facades\Storage;
13
use POData\OperationContext\ServiceHost as ServiceHost;
14
use POData\SimpleDataService as DataService;
15
use POData\OperationContext\Web\Illuminate\IlluminateOperationContext as OperationContextAdapter;
16
use voku\helper\AntiXSS;
17
18
class ODataController extends BaseController
19
{
20
    /**
21
     * Display a listing of the resource.
22
     *
23
     * @return \Illuminate\Http\Response
24
     */
25
    public function index(Request $request)
26
    {
27
        $dump = $this->isDumping();
28
        $dryRun = $this->isDryRun();
29
        $commitCall = $dryRun ? 'rollBack' : 'commit';
30
31
        try {
32
            DB::beginTransaction();
33
            $context = new OperationContextAdapter($request);
34
            $host = new ServiceHost($context, $request);
35
            $host->setServiceUri('/odata.svc/');
36
37
            $query = App::make('odataquery');
38
            $meta = App::make('metadata');
39
40
            $service = new DataService($query, $meta, $host);
41
            $cereal = new IronicSerialiser($service, null);
42
            $service = new DataService($query, $meta, $host, $cereal);
43
            $service->handleRequest();
44
45
            $odataResponse = $context->outgoingResponse();
46
47
            if (true === $dump) {
48
                // iff XTest header is set, containing class and method name
49
                // dump outgoing odataResponse, metadata, and incoming request
50
                $xTest = $request->header('XTest');
51
                $date = Carbon::now(0);
52
                $timeString = $date->toTimeString();
53
                $xTest = (null !== $xTest) ? $xTest
54
                    : $request->method() . ';' . str_replace('/', '-', $request->path()) . ';' . $timeString . ';';
55
                if (null != $xTest) {
56
                    $reflectionClass = new \ReflectionClass('Illuminate\Http\Request');
57
                    $reflectionProperty = $reflectionClass->getProperty('userResolver');
58
                    $reflectionProperty->setAccessible(true);
59
                    $reflectionProperty->setValue($request, null);
60
                    $reflectionProperty = $reflectionClass->getProperty('routeResolver');
61
                    $reflectionProperty->setAccessible(true);
62
                    $reflectionProperty->setValue($request, null);
63
                    $cerealRequest = serialize($request);
64
                    $cerealMeta = serialize($meta);
65
                    $cerealResponse = serialize($odataResponse);
66
                    Storage::put($xTest . 'request', $cerealRequest);
67
                    Storage::put($xTest . 'metadata', $cerealMeta);
68
                    Storage::put($xTest . 'response', $cerealResponse);
69
                }
70
            }
71
72
            $content = $odataResponse->getStream();
73
74
            $headers = $odataResponse->getHeaders();
75
            $responseCode = $headers[\POData\Common\ODataConstants::HTTPRESPONSE_HEADER_STATUS_CODE];
76
            $responseCode = isset($responseCode) ? intval($responseCode) : 200;
77
            $response = new Response($content, $responseCode);
0 ignored issues
show
Security Cross-Site Scripting introduced by
$content can contain request data and is used in output context(s) leading to a potential security vulnerability.

9 paths for user data to reach this point

  1. Path: Fetching key HTTP_HOST from $_SERVER in src/POData/OperationContext/SimpleRequestAdapter.php on line 23
  1. Fetching key HTTP_HOST from $_SERVER
    in vendor/src/POData/OperationContext/SimpleRequestAdapter.php on line 23
  2. SimpleRequestAdapter::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  3. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  4. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  5. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  6. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  7. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  8. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  9. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  10. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  11. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  12. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  13. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  14. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  15. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  16. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  17. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  18. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  19. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  20. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  2. Path: $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned in ServerBag.php on line 62
  1. $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned
    in vendor/ServerBag.php on line 62
  2. ParameterBag::$parameters is assigned
    in vendor/ServerBag.php on line 77
  3. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  4. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  5. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  6. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  7. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  8. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  9. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  10. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  11. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  12. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  13. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  14. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  15. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  16. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  17. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  18. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  19. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  20. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  21. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  22. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  23. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  24. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  25. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  26. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  27. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  28. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  29. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  30. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  3. Path: Read from $_POST, and $_POST is passed to Request::createRequestFromFactory() in Request.php on line 317
  1. Read from $_POST, and $_POST is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 317
  2. $request is passed to Request::__construct()
    in vendor/Request.php on line 2052
  3. $request is passed to Request::initialize()
    in vendor/Request.php on line 258
  4. $request is passed to ParameterBag::__construct()
    in vendor/Request.php on line 276
  5. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  6. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  7. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  8. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  9. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  10. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  11. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  12. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  13. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  14. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  15. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  16. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  17. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  18. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  19. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  20. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  21. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  22. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  23. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  24. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  25. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  26. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  27. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  28. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  29. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  30. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  31. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  32. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  33. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  4. Path: Read from $_SERVER, and $server is assigned in Request.php on line 307
  1. Read from $_SERVER, and $server is assigned
    in vendor/Request.php on line 307
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 317
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2052
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 258
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 281
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  9. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  10. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  11. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  12. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  13. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  14. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  15. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  16. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  17. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  18. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  19. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  20. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  21. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  22. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  23. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  24. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  25. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  26. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  27. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  28. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  29. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  30. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  31. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  32. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  33. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  34. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  5. Path: Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned in Request.php on line 310
  1. Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned
    in vendor/Request.php on line 310
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 317
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2052
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 258
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 281
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  9. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  10. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  11. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  12. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  13. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  14. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  15. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  16. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  17. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  18. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  19. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  20. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  21. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  22. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  23. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  24. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  25. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  26. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  27. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  28. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  29. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  30. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  31. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  32. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  33. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  34. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  6. Path: Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned in Request.php on line 313
  1. Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned
    in vendor/Request.php on line 313
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 317
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2052
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 258
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 281
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  9. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  10. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  11. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  12. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  13. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  14. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  15. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  16. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  17. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  18. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  19. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  20. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  21. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  22. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  23. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  24. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  25. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  26. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  27. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  28. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  29. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  30. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  31. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  32. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  33. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  34. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  7. Path: $server['HTTP_HOST'] seems to return tainted data, and $server is assigned in Request.php on line 383
  1. $server['HTTP_HOST'] seems to return tainted data, and $server is assigned
    in vendor/Request.php on line 383
  2. $server is assigned
    in vendor/Request.php on line 431
  3. $server is assigned
    in vendor/Request.php on line 432
  4. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 434
  5. $server is passed to Request::__construct()
    in vendor/Request.php on line 2052
  6. $server is passed to Request::initialize()
    in vendor/Request.php on line 258
  7. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 281
  8. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  9. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  10. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  11. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  12. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  13. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  14. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  15. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  16. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  17. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  18. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  19. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  20. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  21. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  22. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  23. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  24. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  25. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  26. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  27. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  28. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  29. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  30. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  31. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  32. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  33. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  34. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  35. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  36. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  8. Path: $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 43
  1. $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 43
  2. $headers is assigned
    in vendor/ServerBag.php on line 44
  3. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 282
  4. $values is assigned
    in vendor/HeaderBag.php on line 31
  5. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 32
  6. (array) $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 143
  7. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 146
  8. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 67
  9. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 115
  10. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1822
  11. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1853
  12. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 99
  13. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  14. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  15. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  16. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  17. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  18. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  19. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  20. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  21. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  22. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  23. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  24. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  25. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  26. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  27. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  28. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  29. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  30. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  31. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  32. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  33. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  34. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  35. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  36. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  37. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  38. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  39. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  40. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72
  9. Path: $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 44
  1. $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 44
  2. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 282
  3. $values is assigned
    in vendor/HeaderBag.php on line 31
  4. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 32
  5. (array) $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 143
  6. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 146
  7. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 67
  8. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 115
  9. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1822
  10. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1853
  11. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 99
  12. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  13. ParameterBag::get() returns tainted data
    in vendor/Request.php on line 1022
  14. Request::getPort() returns tainted data, and $port is assigned
    in vendor/Request.php on line 1085
  15. Request::getHttpHost() returns tainted data
    in vendor/Request.php on line 1118
  16. Request::getSchemeAndHttpHost() returns tainted data
    in vendor/Request.php on line 1134
  17. Request::getUri() returns tainted data, and $this->getUri() is passed through preg_replace(), and preg_replace('/\\?.*/', '', $this->getUri()) is passed through rtrim()
    in vendor/src/Illuminate/Http/Request.php on line 99
  18. Request::url() returns tainted data
    in vendor/src/Illuminate/Http/Request.php on line 113
  19. Request::fullUrl() returns tainted data, and IncomingIlluminateRequest::$rawUrl is assigned
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 73
  20. Tainted property IncomingIlluminateRequest::$rawUrl is read
    in vendor/src/POData/OperationContext/Web/Illuminate/IncomingIlluminateRequest.php on line 75
  21. IncomingIlluminateRequest::getRawUrl() returns tainted data, and ServiceHost::$absoluteRequestUriAsString is assigned
    in vendor/src/POData/OperationContext/ServiceHost.php on line 120
  22. Tainted property ServiceHost::$absoluteRequestUriAsString is read, and $this->absoluteRequestUriAsString is passed to Url::__construct()
    in vendor/src/POData/OperationContext/ServiceHost.php on line 123
  23. Url::$urlAsString is assigned
    in vendor/src/POData/Common/Url.php on line 53
  24. Tainted property Url::$urlAsString is read
    in vendor/src/POData/Common/Url.php on line 63
  25. Url::getUrlAsString() returns tainted data, and CynicSerialiser::$absoluteServiceUri is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 492
  26. Tainted property CynicSerialiser::$absoluteServiceUri is read, and $this->absoluteServiceUri is passed through rtrim(), and ODataURL::$url is assigned
    in vendor/src/POData/ObjectModel/CynicSerialiser.php on line 327
  27. Tainted property ODataURL::$url is read, and $url->url is passed to JsonWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 105
  28. $value is passed to JsonWriter::writeCore()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 124
  29. $text is passed to IndentedTextWriter::writeValue()
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 217
  30. $value is passed to IndentedTextWriter::write()
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 59
  31. IndentedTextWriter::$result is assigned
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 143
  32. Tainted property IndentedTextWriter::$result is read
    in vendor/src/POData/Writers/Json/IndentedTextWriter.php on line 122
  33. IndentedTextWriter::getResult() returns tainted data
    in vendor/src/POData/Writers/Json/JsonWriter.php on line 258
  34. JsonWriter::getJsonOutput() returns tainted data
    in vendor/src/POData/Writers/Json/JsonODataV1Writer.php on line 431
  35. JsonODataV1Writer::serializeException() returns tainted data, and $responseBody is assigned
    in vendor/src/POData/Common/ErrorHandler.php on line 62
  36. $responseBody is passed to OutgoingResponse::setStream()
    in vendor/src/POData/Common/ErrorHandler.php on line 65
  37. OutgoingResponse::$stream is assigned
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 197
  38. Tainted property OutgoingResponse::$stream is read
    in vendor/src/POData/OperationContext/Web/OutgoingResponse.php on line 187
  39. OutgoingResponse::getStream() returns tainted data, and $content is assigned
    in src/Controllers/ODataController.php on line 72

Used in output context

  1. Response::__construct() uses Response::setContent() ($content)
    in vendor/Response.php on line 201
  2. Response::setContent() uses property Response::$content for writing
    in vendor/Response.php on line 402
  3. Property Response::$content is used in echo
    in vendor/Response.php on line 361

Preventing Cross-Site-Scripting Attacks

Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user.

In order to prevent this, make sure to escape all user-provided data:

// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
78
            $response->setStatusCode($headers['Status']);
79
80
            foreach ($headers as $headerName => $headerValue) {
81
                if (!is_null($headerValue)) {
82
                    $response->headers->set($headerName, $headerValue);
83
                }
84
            }
85
            DB::$commitCall();
86
        } catch (\Exception $e) {
87
            DB::rollBack();
88
            throw $e;
89
        }
90
        return $response;
91
    }
92
93
    /**
94
     * @return bool
95
     */
96
    protected function isDumping()
97
    {
98
        $configDump = env('APP_DUMP_REQUESTS', false);
99
        return true === $configDump;
100
    }
101
102
    /**
103
     * Is application dry-running (ie, not committing) non-READ requests?
104
     *
105
     * @return bool
106
     */
107
    protected function isDryRun()
108
    {
109
        $configDump = env('APP_DRY_RUN', false);
110
        return true === $configDump;
111
    }
112
}
113