Issues (13)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Commands/GenerateCommand.php (1 issue)

Labels
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace CSSPrites\Commands;
4
5
use CSSPrites\Generator\CSSGenerator;
6
use CSSPrites\Generator\HTMLGenerator;
7
use CSSPrites\ImagesCollection;
8
use Symfony\Component\Console\Input\InputInterface;
9
use Symfony\Component\Console\Input\InputOption;
10
use Symfony\Component\Console\Output\OutputInterface;
11
12
class GenerateCommand extends AbstractBaseCommand
13
{
14
    protected $startTime;
15
16
    protected function getOptions()
17
    {
18
        $options = [
19
            'input' => [
20
                'shortcut'    => 'i',
21
                'description' => 'Directory to parse',
22
                'default'     => getcwd(),
23
            ],
24
            'output' => [
25
                'shortcut'    => 'o',
26
                'description' => 'Output directory',
27
                'default'     => getcwd(),
28
            ],
29
            'mask' => [
30
                'shortcut'    => 'm',
31
                'description' => 'File mask',
32
                'default'     => '*.png',
33
            ],
34
            'overwrite' => [
35
                'shortcut'    => 'O',
36
                'description' => 'Overwrite files (sprite image, css & html) if they exists',
37
                'default'     => true,
38
            ],
39
            'driver' => [
40
                'shortcut'    => 'd',
41
                'description' => 'Image driver (gd, imagick or gmagick)',
42
                'default'     => 0,
43
                'choices'     => ['gd', 'imagick', 'gmagick'],
44
            ],
45
            'spaces' => [
46
                'shortcut'    => 's',
47
                'description' => 'Spaces between images in the sprite',
48
                'default'     => 4,
49
            ],
50
            'sprite' => [
51
                'shortcut'    => 'S',
52
                'description' => 'Final sprite image file name',
53
                'default'     => 'sprite.png',
54
            ],
55
            'background' => [
56
                'shortcut'    => 'b',
57
                'description' => 'Sprite background color (hex color, null for transparency)',
58
                'default'     => null,
59
            ],
60
            'selector' => [
61
                'shortcut'    => 'c',
62
                'description' => 'CSS class selector',
63
                'default'     => 'sprite',
64
            ],
65
        ];
66
67
        foreach ($options as $name => $option) {
68
            $question = $option['description'];
69
70
            if (array_key_exists('default', $option)) {
71
                if (is_string($option['default'])) {
72
                    $question .= ' (default to "'.$option['default'].'")';
73
                } elseif (is_int($option['default'])) {
74
                    $question .= ' (default to '.$option['default'].')';
75
                } elseif (is_bool($option['default'])) {
76
                    $question .= ' (default to '.($option['default'] ? 'true' : 'false').')';
77
                } elseif (is_null($option['default'])) {
78
                    $question .= ' (default to null)';
79
                }
80
            }
81
82
            $options[$name]['question'] = $question;
83
        }
84
85
        return $options;
86
    }
87
88
    protected function configure()
89
    {
90
        $this->setName('generate')->setDescription('Create a new sprite');
91
92
        foreach ($this->getOptions() as $name => $option) {
93
            $this->addOption($name, $option['shortcut'], InputOption::VALUE_REQUIRED, $option['question']);
94
        }
95
    }
96
97
    protected function execute(InputInterface $input, OutputInterface $output)
98
    {
99
        $this->startTime = microtime(true);
100
        $this->dialog    = $this->getHelperSet()->get('dialog');
101
        $this->input     = $input;
102
        $this->output    = $output;
103
104
        $this->populateConfiguration();
105
106
        $config    = $this->getContainer()->get('configuration');
107
        $slugifier = $this->getContainer()->get('slugifier');
108
109
        $css  = new CSSGenerator($slugifier);
110
        $css->configure($config->get('css'));
111
        $css->setImage($config->get('sprite.filename'));
112
113
        $html  = new HTMLGenerator($slugifier);
114
        $html->configure($config->get('html'));
115
        $html->setCSSGenerator($css);
116
117
        $collection = new ImagesCollection(
118
            $this->getContainer()->get('image.processor'),
119
            $config->get('input.directory'),
120
            $config->get('input.mask'),
121
            $config->get('sprite.filename')
122
        );
123
124
        $this->output->writeln('<comment>Generating Sprite...</comment>');
125
        $sprite = $this->getContainer()->get('sprite.processor.'.$config->get('sprite.processor', 'simplebinpacking'))
126
            ->configure($config->get('sprite'))
127
            ->setImages($collection)
128
            ->process();
129
130
        foreach ($collection->get() as $image) {
0 ignored issues
show
The expression $collection->get() of type object<CSSPrites\Image>|...bject<CSSPrites\Image>> is not guaranteed to be traversable. How about adding an additional type check?

There are different options of fixing this problem.

  1. If you want to be on the safe side, you can add an additional type-check:

    $collection = json_decode($data, true);
    if ( ! is_array($collection)) {
        throw new \RuntimeException('$collection must be an array.');
    }
    
    foreach ($collection as $item) { /** ... */ }
    
  2. If you are sure that the expression is traversable, you might want to add a doc comment cast to improve IDE auto-completion and static analysis:

    /** @var array $collection */
    $collection = json_decode($data, true);
    
    foreach ($collection as $item) { /** .. */ }
    
  3. Mark the issue as a false-positive: Just hover the remove button, in the top-right corner of this issue for more options.

Loading history...
131
            $css->addLine(
132
                $image->getSimpleName(),
133
                -$image->getX(),
134
                -$image->getY(),
135
                $image->getWidth(),
136
                $image->getHeight()
137
            );
138
            $html->addLine($image->getSimpleName());
139
        }
140
141
        $this->output->writeln('<comment>Saving Sprite...</comment>');
142
        $sprite->save();
143
144
        $this->output->writeln('<comment>Saving CSS...</comment>');
145
        $css->save();
146
147
        $this->output->writeln('<comment>Saving HTML...</comment>');
148
        $html->save();
149
150
        $totalTime = microtime(true) - $this->startTime;
151
        $this->output->writeln('<info>Done in '.number_format($totalTime, 4, '.', '').' µs</info>');
152
    }
153
154
    protected function populateConfiguration()
155
    {
156
        $options = $this->getOptions();
157
        $config  = $this->getContainer()->get('configuration');
158
159
        // Input Directory
160
        $config->set('input.directory', $this->getInputDirectory($options['input']));
161
        if ($config->load($config->get('input.directory').'/cssprites.json')) {
162
            $this->output->writeln('<info>Config file "cssprites.json" found and loaded</info>');
163
            $this->output->writeln('');
164
165
            return true;
166
        }
167
168
        // Output Directory
169
        $options['output']['question'] = str_replace(getcwd(), $config->get('input.directory'), $options['output']['question']);
170
        $config->set('sprite.filepath', $this->getOutputDirectory($options['output'], $config->get('input.directory')));
171
        $config->set('css.filepath', $config->get('sprite.filepath'));
172
        $config->set('html.filepath', $config->get('sprite.filepath'));
173
174
        // File mask
175
        $config->set('input.mask', $this->getFileMask($options['mask']));
176
177
        // Get image driver
178
        $config->set('image.processor.driver', $this->getDriver($options['driver']));
179
180
        // Output filename
181
        $filename = $this->getOutputFilename($options['sprite']);
182
        $config->set('sprite.filename', $filename);
183
        $config->set('css.filename', substr($filename, 0, strrpos($filename, '.') + 1).'css');
184
        $config->set('html.filename', substr($filename, 0, strrpos($filename, '.') + 1).'html');
185
186
        // Overwrite
187
        $config->set('sprite.overwrite', $this->getOverwrite($options['overwrite']));
188
        $config->set('css.overwrite', $config->get('sprite.overwrite'));
189
        $config->set('html.overwrite', $config->get('sprite.overwrite'));
190
191
        // Sprite spaces
192
        $config->set('sprite.spaces', $this->getSpaces($options['spaces']));
193
194
        // Background
195
        $config->set('sprite.background', $this->getBackground());
196
197
        // CSS Selector
198
        $selector = $this->getCssSelector($options['selector']);
199
        $config->set('css.selector', $selector);
200
        $config->set('css.prefix', $selector);
201
202
        // Save config file
203
        $this->output->writeln('');
204
        if ($this->getSaveConfiguration()) {
205
            $config->save($config->get('input.directory').'/cssprites.json');
206
        }
207
208
        $this->output->writeln('');
209
210
        return true;
211
    }
212
213
    protected function getInputDirectory($option)
214
    {
215
        $directory = $this->getOptionOrAskAndValidate(
216
            'input',
217
            $option['question'],
218
            function ($directory) {
219
                $directory = is_null($directory) ? getcwd() : $directory;
220
221
                return realpath($directory);
222
            },
223
            $option['default']
224
        );
225
226
        $directory = realpath($directory);
227
        if ($directory === false) {
228
            throw new \Exception('Directory '.$directory.' doesn\'t exists.');
229
        }
230
231
        return $directory;
232
    }
233
234
    protected function getOutputDirectory($option, $default)
235
    {
236
        $directory = $this->getOptionOrAskAndValidate(
237
            'output',
238
            $option['question'],
239
            function ($directory) use ($default) {
240
                $directory = is_null($directory) ? $default : $directory;
241
242
                return $directory;
243
            },
244
            $default
245
        );
246
247
        $directory = realpath($directory);
248
        if ($directory === false) {
249
            throw new \Exception('Directory '.(string) $directory.' doesn\'t exists.');
250
        }
251
252
        return $directory;
253
    }
254
255
    protected function getFileMask($option)
256
    {
257
        return $this->getOptionOrAsk('mask', $option['question'], $option['default']);
258
    }
259
260
    protected function getDriver($option)
261
    {
262
        return $this->getOptionOrSelect('driver', $option['question'], $option['choices'], $option['default']);
263
    }
264
265
    /**
266
     * @return string
267
     */
268
    protected function getOutputFilename($option)
269
    {
270
        $filename = $this->getOptionOrAsk('sprite', $option['question'], $option['default']);
271
        $filename = strrpos($filename, '.') === false ? $filename.'.png' : $filename;
272
273
        return $filename;
274
    }
275
276
    protected function getOverwrite($option)
277
    {
278
        return $this->getOptionOrAskConfirmation('overwrite', $option['question'], $option['default']);
279
    }
280
281
    protected function getSpaces($option)
282
    {
283
        $spaces = $this->getOptionOrAskAndValidate(
284
            'spaces',
285
            $option['question'],
286
            function ($spaces) {
287
                $spaces = is_null($spaces) ? 4 : $spaces;
288
                $spaces = (int) $spaces;
289
                if ($spaces < 0) {
290
                    throw new \Exception('Invalid spaces (number >= 0)');
291
                }
292
293
                return $spaces;
294
            },
295
            $option['default']
296
        );
297
298
        return $spaces;
299
    }
300
301
    protected function getBackground()
302
    {
303
        $background = $this->input->getOption('background');
304
        $background = $background === 'null' ? null : $background;
305
306
        return $background;
307
    }
308
309
    protected function getCssSelector($option)
310
    {
311
        return $this->getOptionOrAsk('selector', $option['question'], $option['default']);
312
    }
313
314
    protected function getSaveConfiguration()
315
    {
316
        return $this->dialog->askConfirmation(
317
            $this->output,
318
            '<question>Save configuration to "cssprites.json" ? (y/n, default to n)</question> ',
319
            false
320
        );
321
    }
322
}
323