GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (917)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Request.php (9 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Nip;
4
5
use ByTIC\RequestDetective\RequestDetective;
6
use Nip\Http\Request\Http;
7
use Nip\Http\Request\Traits\ArrayAccessTrait;
8
use Nip\Http\Request\Traits\InteractsWithMca;
9
use Nip\Http\Request\Traits\InteractsWithUri;
10
use Nip\Http\Request\Traits\PsrBridgeTrait;
11
use Psr\Http\Message\ServerRequestInterface;
12
13
/**
14
 * Class Request
15
 * @package Nip
16
 */
17
class Request extends \Symfony\Component\HttpFoundation\Request implements \ArrayAccess, ServerRequestInterface
18
{
19
    use PsrBridgeTrait;
20
    use InteractsWithUri;
21
    use InteractsWithMca;
22
    use ArrayAccessTrait;
23
24
    /**
25
     * @var Http
26
     */
27
    protected $http;
28
29
30
    /**
31
     * Singleton
32
     *
33
     * @param null $newInstance
34
     * @return static
35
     */
36
    public static function instance($newInstance = null)
37
    {
38
        static $instance;
39
40
        if ($newInstance instanceof self) {
41
            $instance = $newInstance;
42
        }
43
44
        if (!($instance instanceof self)) {
45
            $instance = new self();
46
        }
47
48
        return $instance;
49
    }
50
51
    /**
52
     * @param $name
53
     * @return mixed
54
     */
55
    public function __get($name)
56
    {
57
        return $this->get($name);
58
    }
59
60
    /**
61
     * Set an action parameter
62
     *
63
     * A $value of null will unset the $key if it exists
64
     *
65
     * @param string $key
66
     * @param mixed $value
67
     * @return self
68
     */
69 1
    public function setAttribute($key, $value)
70
    {
71 1
        $this->attributes->set($key, $value);
72
73 1
        return $this;
74
    }
75
76
    /**
77
     * @param array $params
78
     * @return $this
79
     */
80
    public function setParams(array $params)
81
    {
82
        foreach ($params as $param => $value) {
83
            $this->{$param} = $value;
84
        }
85
86
        return $this;
87
    }
88
89
    /**
90
     * Returns Http object
91
     * @return Http
92
     */
93 8
    public function getHttp()
94
    {
95 8
        if (!$this->http) {
96 8
            $this->http = new Http();
97 8
            $this->http->setRequest($this);
98
        }
99
100 8
        return $this->http;
101
    }
102
103
    /**
104
     * @return bool
105
     */
106
    public function isCLI()
0 ignored issues
show
isCLI uses the super-global variable $_ENV which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
isCLI uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
107
    {
108
        if (defined('STDIN')) {
109
            return true;
110
        }
111
112
        if (php_sapi_name() === 'cli') {
113
            return true;
114
        }
115
116
        if (array_key_exists('SHELL', $_ENV)) {
117
            return true;
118
        }
119
120
        if (empty($_SERVER['REMOTE_ADDR']) and !isset($_SERVER['HTTP_USER_AGENT']) and count($_SERVER['argv']) > 0) {
0 ignored issues
show
Comprehensibility Best Practice introduced by
Using logical operators such as and instead of && is generally not recommended.

PHP has two types of connecting operators (logical operators, and boolean operators):

  Logical Operators Boolean Operator
AND - meaning and &&
OR - meaning or ||

The difference between these is the order in which they are executed. In most cases, you would want to use a boolean operator like &&, or ||.

Let’s take a look at a few examples:

// Logical operators have lower precedence:
$f = false or true;

// is executed like this:
($f = false) or true;


// Boolean operators have higher precedence:
$f = false || true;

// is executed like this:
$f = (false || true);

Logical Operators are used for Control-Flow

One case where you explicitly want to use logical operators is for control-flow such as this:

$x === 5
    or die('$x must be 5.');

// Instead of
if ($x !== 5) {
    die('$x must be 5.');
}

Since die introduces problems of its own, f.e. it makes our code hardly testable, and prevents any kind of more sophisticated error handling; you probably do not want to use this in real-world code. Unfortunately, logical operators cannot be combined with throw at this point:

// The following is currently a parse error.
$x === 5
    or throw new RuntimeException('$x must be 5.');

These limitations lead to logical operators rarely being of use in current PHP code.

Loading history...
121
            return true;
122
        }
123
124
        if (!array_key_exists('REQUEST_METHOD', $_SERVER)) {
125
            return true;
126
        }
127
128
        return false;
129
    }
130
131
    /**
132
     * Checks if requested URI matches $url parameter,
133
     * and redirects to $url if not
134
     *
135
     * @param string $url
136
     * @param int $code
137
     */
138
    public function checkURL($url, $code = 302)
0 ignored issues
show
checkURL uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
139
    {
140
        $components = parse_url($url);
141
        $request = parse_url($_SERVER['REQUEST_URI']);
142
143
        if ($components['path'] != $request['path']) {
144
            $redirect = $url . ($request['query'] ? '?' . $request['query'] : '');
145
146
            header("Location: " . $redirect, true, $code);
147
            exit();
0 ignored issues
show
Coding Style Compatibility introduced by
The method checkURL() contains an exit expression.

An exit expression should only be used in rare cases. For example, if you write a short command line script.

In most cases however, using an exit expression makes the code untestable and often causes incompatibilities with other libraries. Thus, unless you are absolutely sure it is required here, we recommend to refactor your code to avoid its usage.

Loading history...
148
        }
149
    }
150
151
    /**
152
     * @param $url
153
     */
154
    public function redirect($url)
155
    {
156
        header("Location: " . $url);
157
        exit();
0 ignored issues
show
Coding Style Compatibility introduced by
The method redirect() contains an exit expression.

An exit expression should only be used in rare cases. For example, if you write a short command line script.

In most cases however, using an exit expression makes the code untestable and often causes incompatibilities with other libraries. Thus, unless you are absolutely sure it is required here, we recommend to refactor your code to avoid its usage.

Loading history...
158
    }
159
160
    /**
161
     * @param bool $action
162
     * @param bool $controller
163
     * @param bool $module
164
     * @param array $params
165
     * @return $this
166
     */
167 1
    public function duplicateWithParams($action = false, $controller = false, $module = false, $params = [])
168
    {
169
        /** @var self $newRequest */
170 1
        $newRequest = $this->duplicate();
171 1
        $newRequest->setActionName($action);
0 ignored issues
show
$action is of type boolean, but the function expects a string.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
172 1
        $newRequest->setControllerName($controller);
0 ignored issues
show
$controller is of type boolean, but the function expects a string.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
173 1
        $newRequest->setModuleName($module);
0 ignored issues
show
$module is of type boolean, but the function expects a string.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
174 1
        $newRequest->attributes->add($params);
175
176 1
        return $newRequest;
177
    }
178
179
    /**
180
     * @return bool
181
     */
182 1
    public function isMalicious()
183
    {
184 1
        return RequestDetective::isMalicious($this);
185
    }
186
187
    /**
188
     * Get the current encoded path info for the request.
189
     *
190
     * @return string
191
     */
192
    public function decodedPath()
193
    {
194
        return rawurldecode($this->path());
195
    }
196
197
    /**
198
     * Get the current path info for the request.
199
     *
200
     * @return string
201
     */
202
    public function path()
203
    {
204
        $pattern = trim($this->getPathInfo(), '/');
205
        return $pattern == '' ? '/' : '/' . $pattern;
206
    }
207
}
208