Issues (850)

Security Analysis    4 potential vulnerabilities

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection (1)
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection (2)
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting (1)
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

geolocation/class-getpaid-maxmind-geolocation.php (2 issues)

Labels
Severity
1
<?php
2
/**
3
 * Maxmind Geolocation class
4
 *
5
 * Handles geolocation and updating the geolocation database.
6
 * This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com.
7
 *
8
 */
9
10
defined( 'ABSPATH' ) || exit;
11
12
/**
13
 * Uses MaxMind for Geolocation
14
 *
15
 * @since 1.0.19
16
 */
17
class GetPaid_MaxMind_Geolocation {
18
19
	/**
20
	 * The service responsible for interacting with the MaxMind database.
21
	 *
22
	 * @var GetPaid_MaxMind_Database_Service
23
	 */
24
	private $database_service;
25
26
	/**
27
	 * Initialize the integration.
28
	 */
29
	public function __construct() {
30
31
		/**
32
		 * Supports overriding the database service to be used.
33
		 *
34
		 * @since 1.0.19
35
		 * @return mixed|null The geolocation database service.
36
		 */
37
		$this->database_service = apply_filters( 'getpaid_maxmind_geolocation_database_service', null );
38
		if ( null === $this->database_service ) {
39
			$this->database_service = new GetPaid_MaxMind_Database_Service( $this->get_database_prefix() );
40
		}
41
42
		// Bind to the scheduled updater action.
43
		add_action( 'getpaid_update_geoip_databases', array( $this, 'update_database' ) );
44
45
		// Bind to the geolocation filter for MaxMind database lookups.
46
		add_filter( 'getpaid_get_geolocation', array( $this, 'get_geolocation' ), 10, 2 );
47
48
		// Handle maxmind key updates.
49
		add_filter( 'wpinv_settings_sanitize_maxmind_license_key', array( $this, 'handle_key_updates' ) );
50
51
	}
52
53
	/**
54
	 * Get database service.
55
	 *
56
	 * @return GetPaid_MaxMind_Database_Service|null
57
	 */
58
	public function get_database_service() {
59
		return $this->database_service;
60
	}
61
62
	/**
63
	 * Checks to make sure that the license key is valid.
64
	 *
65
	 * @param string $license_key The new license key.
66
	 * @return string
67
	 */
68
	public function handle_key_updates( $license_key ) {
69
70
		// Trim whitespaces and strip slashes.
71
		$license_key = trim( $license_key );
72
73
		// Abort if the license key is empty or unchanged.
74
		if ( empty( $license_key ) ) {
75
			return $license_key;
76
		}
77
78
		// Abort if a database exists and the license key is unchaged.
79
		if ( file_exists( $this->database_service->get_database_path() && $license_key == wpinv_get_option( 'maxmind_license_key' ) ) ) {
0 ignored issues
show
$this->database_service-...('maxmind_license_key') of type boolean is incompatible with the type string expected by parameter $filename of file_exists(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

79
		if ( file_exists( /** @scrutinizer ignore-type */ $this->database_service->get_database_path() && $license_key == wpinv_get_option( 'maxmind_license_key' ) ) ) {
Loading history...
80
			return $license_key;
81
		}
82
83
		// Check the license key by attempting to download the Geolocation database.
84
		$tmp_database_path = $this->database_service->download_database( $license_key );
85
		if ( is_wp_error( $tmp_database_path ) ) {
86
			getpaid_admin()->show_error( $tmp_database_path->get_error_message() );
87
			return $license_key;
88
		}
89
90
		$this->update_database( /** @scrutinizer ignore-type */ $tmp_database_path );
91
92
		return $license_key;
93
	}
94
95
	/**
96
	 * Updates the database used for geolocation queries.
97
	 *
98
	 * @param string $tmp_database_path Temporary database path.
99
	 */
100
	public function update_database( $tmp_database_path = null ) {
101
102
		// Allow us to easily interact with the filesystem.
103
		require_once ABSPATH . 'wp-admin/includes/file.php';
104
		WP_Filesystem();
105
		global $wp_filesystem;
106
107
		// Remove any existing archives to comply with the MaxMind TOS.
108
		$target_database_path = $this->database_service->get_database_path();
109
110
		// If there's no database path, we can't store the database.
111
		if ( empty( $target_database_path ) ) {
112
			return;
113
		}
114
115
		if ( $wp_filesystem->exists( $target_database_path ) ) {
116
			$wp_filesystem->delete( $target_database_path );
117
		}
118
119
		// We can't download a database if there's no license key configured.
120
		$license_key = wpinv_get_option( 'maxmind_license_key' );
121
		if ( empty( $license_key ) ) {
122
			return;
123
		}
124
125
		if ( empty( $tmp_database_path ) ) {
126
			$tmp_database_path = $this->database_service->download_database( $license_key );
127
		}
128
129
		if ( is_wp_error( $tmp_database_path ) ) {
130
			wpinv_error_log( $tmp_database_path->get_error_message() );
131
			return;
132
		}
133
134
		// Move the new database into position.
135
		$wp_filesystem->move( $tmp_database_path, $target_database_path, true );
136
		$wp_filesystem->delete( dirname( $tmp_database_path ) );
0 ignored issues
show
It seems like $tmp_database_path can also be of type WP_Error; however, parameter $path of dirname() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

136
		$wp_filesystem->delete( dirname( /** @scrutinizer ignore-type */ $tmp_database_path ) );
Loading history...
137
	}
138
139
	/**
140
	 * Performs a geolocation lookup against the MaxMind database for the given IP address.
141
	 *
142
	 * @param array  $data       Geolocation data.
143
	 * @param string $ip_address The IP address to geolocate.
144
	 * @return array Geolocation including country code, state, city and postcode based on an IP address.
145
	 */
146
	public function get_geolocation( $data, $ip_address ) {
147
148
		if ( ! empty( $data['country'] ) || empty( $ip_address ) ) {
149
			return $data;
150
		}
151
152
		$country_code = $this->database_service->get_iso_country_code_for_ip( $ip_address );
153
154
		return array(
155
			'country'  => $country_code,
156
			'state'    => '',
157
			'city'     => '',
158
			'postcode' => '',
159
		);
160
161
	}
162
163
	/**
164
	 * Fetches the prefix for the MaxMind database file.
165
	 *
166
	 * @return string
167
	 */
168
	private function get_database_prefix() {
169
170
		$prefix = get_option( 'wpinv_maxmind_database_prefix' );
171
172
		if ( empty( $prefix ) ) {
173
			$prefix = md5( uniqid( 'wpinv' ) );
174
			update_option( 'wpinv_maxmind_database_prefix', $prefix );
175
		}
176
177
		return $prefix;
178
	}
179
180
}
181