ByTIC /
framework
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
|||||||||||
| 2 | ||||||||||||
| 3 | namespace Nip; |
|||||||||||
| 4 | ||||||||||||
| 5 | use ByTIC\RequestDetective\RequestDetective; |
|||||||||||
| 6 | use Nip\Http\Request\Http; |
|||||||||||
| 7 | use Nip\Http\Request\Traits\ArrayAccessTrait; |
|||||||||||
| 8 | use Nip\Http\Request\Traits\InteractsWithMca; |
|||||||||||
| 9 | use Nip\Http\Request\Traits\InteractsWithUri; |
|||||||||||
| 10 | use Nip\Http\Request\Traits\PsrBridgeTrait; |
|||||||||||
| 11 | use Psr\Http\Message\ServerRequestInterface; |
|||||||||||
| 12 | ||||||||||||
| 13 | /** |
|||||||||||
| 14 | * Class Request |
|||||||||||
| 15 | * @package Nip |
|||||||||||
| 16 | */ |
|||||||||||
| 17 | class Request extends \Symfony\Component\HttpFoundation\Request implements \ArrayAccess, ServerRequestInterface |
|||||||||||
| 18 | { |
|||||||||||
| 19 | use PsrBridgeTrait; |
|||||||||||
| 20 | use InteractsWithUri; |
|||||||||||
| 21 | use InteractsWithMca; |
|||||||||||
| 22 | use ArrayAccessTrait; |
|||||||||||
| 23 | ||||||||||||
| 24 | /** |
|||||||||||
| 25 | * @var Http |
|||||||||||
| 26 | */ |
|||||||||||
| 27 | protected $http; |
|||||||||||
| 28 | ||||||||||||
| 29 | ||||||||||||
| 30 | /** |
|||||||||||
| 31 | * Singleton |
|||||||||||
| 32 | * |
|||||||||||
| 33 | * @param null $newInstance |
|||||||||||
| 34 | * @return static |
|||||||||||
| 35 | */ |
|||||||||||
| 36 | public static function instance($newInstance = null) |
|||||||||||
| 37 | { |
|||||||||||
| 38 | static $instance; |
|||||||||||
| 39 | ||||||||||||
| 40 | if ($newInstance instanceof self) { |
|||||||||||
| 41 | $instance = $newInstance; |
|||||||||||
| 42 | } |
|||||||||||
| 43 | ||||||||||||
| 44 | if (!($instance instanceof self)) { |
|||||||||||
| 45 | $instance = new self(); |
|||||||||||
| 46 | } |
|||||||||||
| 47 | ||||||||||||
| 48 | return $instance; |
|||||||||||
| 49 | } |
|||||||||||
| 50 | ||||||||||||
| 51 | /** |
|||||||||||
| 52 | * @param $name |
|||||||||||
| 53 | * @return mixed |
|||||||||||
| 54 | */ |
|||||||||||
| 55 | public function __get($name) |
|||||||||||
| 56 | { |
|||||||||||
| 57 | return $this->get($name); |
|||||||||||
| 58 | } |
|||||||||||
| 59 | ||||||||||||
| 60 | /** |
|||||||||||
| 61 | * Set an action parameter |
|||||||||||
| 62 | * |
|||||||||||
| 63 | * A $value of null will unset the $key if it exists |
|||||||||||
| 64 | * |
|||||||||||
| 65 | * @param string $key |
|||||||||||
| 66 | * @param mixed $value |
|||||||||||
| 67 | * @return self |
|||||||||||
| 68 | */ |
|||||||||||
| 69 | 1 | public function setAttribute($key, $value) |
||||||||||
| 70 | { |
|||||||||||
| 71 | 1 | $this->attributes->set($key, $value); |
||||||||||
| 72 | ||||||||||||
| 73 | 1 | return $this; |
||||||||||
| 74 | } |
|||||||||||
| 75 | ||||||||||||
| 76 | /** |
|||||||||||
| 77 | * @param array $params |
|||||||||||
| 78 | * @return $this |
|||||||||||
| 79 | */ |
|||||||||||
| 80 | public function setParams(array $params) |
|||||||||||
| 81 | { |
|||||||||||
| 82 | foreach ($params as $param => $value) { |
|||||||||||
| 83 | $this->{$param} = $value; |
|||||||||||
| 84 | } |
|||||||||||
| 85 | ||||||||||||
| 86 | return $this; |
|||||||||||
| 87 | } |
|||||||||||
| 88 | ||||||||||||
| 89 | /** |
|||||||||||
| 90 | * Returns Http object |
|||||||||||
| 91 | * @return Http |
|||||||||||
| 92 | */ |
|||||||||||
| 93 | 8 | public function getHttp() |
||||||||||
| 94 | { |
|||||||||||
| 95 | 8 | if (!$this->http) { |
||||||||||
| 96 | 8 | $this->http = new Http(); |
||||||||||
| 97 | 8 | $this->http->setRequest($this); |
||||||||||
| 98 | } |
|||||||||||
| 99 | ||||||||||||
| 100 | 8 | return $this->http; |
||||||||||
| 101 | } |
|||||||||||
| 102 | ||||||||||||
| 103 | /** |
|||||||||||
| 104 | * @return bool |
|||||||||||
| 105 | */ |
|||||||||||
| 106 | public function isCLI() |
|||||||||||
|
0 ignored issues
–
show
isCLI uses the super-global variable $_SERVER which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
Loading history...
|
||||||||||||
| 107 | { |
|||||||||||
| 108 | if (defined('STDIN')) { |
|||||||||||
| 109 | return true; |
|||||||||||
| 110 | } |
|||||||||||
| 111 | ||||||||||||
| 112 | if (php_sapi_name() === 'cli') { |
|||||||||||
| 113 | return true; |
|||||||||||
| 114 | } |
|||||||||||
| 115 | ||||||||||||
| 116 | if (array_key_exists('SHELL', $_ENV)) { |
|||||||||||
| 117 | return true; |
|||||||||||
| 118 | } |
|||||||||||
| 119 | ||||||||||||
| 120 | if (empty($_SERVER['REMOTE_ADDR']) and !isset($_SERVER['HTTP_USER_AGENT']) and count($_SERVER['argv']) > 0) { |
|||||||||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
Using logical operators such as
and instead of && is generally not recommended.
PHP has two types of connecting operators (logical operators, and boolean operators):
The difference between these is the order in which they are executed. In most cases,
you would want to use a boolean operator like Let’s take a look at a few examples: // Logical operators have lower precedence:
$f = false or true;
// is executed like this:
($f = false) or true;
// Boolean operators have higher precedence:
$f = false || true;
// is executed like this:
$f = (false || true);
Logical Operators are used for Control-FlowOne case where you explicitly want to use logical operators is for control-flow such as this: $x === 5
or die('$x must be 5.');
// Instead of
if ($x !== 5) {
die('$x must be 5.');
}
Since // The following is currently a parse error.
$x === 5
or throw new RuntimeException('$x must be 5.');
These limitations lead to logical operators rarely being of use in current PHP code. Loading history...
|
||||||||||||
| 121 | return true; |
|||||||||||
| 122 | } |
|||||||||||
| 123 | ||||||||||||
| 124 | if (!array_key_exists('REQUEST_METHOD', $_SERVER)) { |
|||||||||||
| 125 | return true; |
|||||||||||
| 126 | } |
|||||||||||
| 127 | ||||||||||||
| 128 | return false; |
|||||||||||
| 129 | } |
|||||||||||
| 130 | ||||||||||||
| 131 | /** |
|||||||||||
| 132 | * Checks if requested URI matches $url parameter, |
|||||||||||
| 133 | * and redirects to $url if not |
|||||||||||
| 134 | * |
|||||||||||
| 135 | * @param string $url |
|||||||||||
| 136 | * @param int $code |
|||||||||||
| 137 | */ |
|||||||||||
| 138 | public function checkURL($url, $code = 302) |
|||||||||||
|
0 ignored issues
–
show
checkURL uses the super-global variable $_SERVER which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
Loading history...
|
||||||||||||
| 139 | { |
|||||||||||
| 140 | $components = parse_url($url); |
|||||||||||
| 141 | $request = parse_url($_SERVER['REQUEST_URI']); |
|||||||||||
| 142 | ||||||||||||
| 143 | if ($components['path'] != $request['path']) { |
|||||||||||
| 144 | $redirect = $url . ($request['query'] ? '?' . $request['query'] : ''); |
|||||||||||
| 145 | ||||||||||||
| 146 | header("Location: " . $redirect, true, $code); |
|||||||||||
| 147 | exit(); |
|||||||||||
|
0 ignored issues
–
show
The method
checkURL() contains an exit expression.
An exit expression should only be used in rare cases. For example, if you write a short command line script. In most cases however, using an Loading history...
|
||||||||||||
| 148 | } |
|||||||||||
| 149 | } |
|||||||||||
| 150 | ||||||||||||
| 151 | /** |
|||||||||||
| 152 | * @param $url |
|||||||||||
| 153 | */ |
|||||||||||
| 154 | public function redirect($url) |
|||||||||||
| 155 | { |
|||||||||||
| 156 | header("Location: " . $url); |
|||||||||||
| 157 | exit(); |
|||||||||||
|
0 ignored issues
–
show
The method
redirect() contains an exit expression.
An exit expression should only be used in rare cases. For example, if you write a short command line script. In most cases however, using an Loading history...
|
||||||||||||
| 158 | } |
|||||||||||
| 159 | ||||||||||||
| 160 | /** |
|||||||||||
| 161 | * @param bool $action |
|||||||||||
| 162 | * @param bool $controller |
|||||||||||
| 163 | * @param bool $module |
|||||||||||
| 164 | * @param array $params |
|||||||||||
| 165 | * @return $this |
|||||||||||
| 166 | */ |
|||||||||||
| 167 | 1 | public function duplicateWithParams($action = false, $controller = false, $module = false, $params = []) |
||||||||||
| 168 | { |
|||||||||||
| 169 | /** @var self $newRequest */ |
|||||||||||
| 170 | 1 | $newRequest = $this->duplicate(); |
||||||||||
| 171 | 1 | $newRequest->setActionName($action); |
||||||||||
|
0 ignored issues
–
show
$action is of type boolean, but the function expects a string.
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
Loading history...
|
||||||||||||
| 172 | 1 | $newRequest->setControllerName($controller); |
||||||||||
|
0 ignored issues
–
show
$controller is of type boolean, but the function expects a string.
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
Loading history...
|
||||||||||||
| 173 | 1 | $newRequest->setModuleName($module); |
||||||||||
|
0 ignored issues
–
show
$module is of type boolean, but the function expects a string.
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
Loading history...
|
||||||||||||
| 174 | 1 | $newRequest->attributes->add($params); |
||||||||||
| 175 | ||||||||||||
| 176 | 1 | return $newRequest; |
||||||||||
| 177 | } |
|||||||||||
| 178 | ||||||||||||
| 179 | /** |
|||||||||||
| 180 | * @return bool |
|||||||||||
| 181 | */ |
|||||||||||
| 182 | 1 | public function isMalicious() |
||||||||||
| 183 | { |
|||||||||||
| 184 | 1 | return RequestDetective::isMalicious($this); |
||||||||||
| 185 | } |
|||||||||||
| 186 | ||||||||||||
| 187 | /** |
|||||||||||
| 188 | * Get the current encoded path info for the request. |
|||||||||||
| 189 | * |
|||||||||||
| 190 | * @return string |
|||||||||||
| 191 | */ |
|||||||||||
| 192 | public function decodedPath() |
|||||||||||
| 193 | { |
|||||||||||
| 194 | return rawurldecode($this->path()); |
|||||||||||
| 195 | } |
|||||||||||
| 196 | ||||||||||||
| 197 | /** |
|||||||||||
| 198 | * Get the current path info for the request. |
|||||||||||
| 199 | * |
|||||||||||
| 200 | * @return string |
|||||||||||
| 201 | */ |
|||||||||||
| 202 | public function path() |
|||||||||||
| 203 | { |
|||||||||||
| 204 | $pattern = trim($this->getPathInfo(), '/'); |
|||||||||||
| 205 | return $pattern == '' ? '/' : '/' . $pattern; |
|||||||||||
| 206 | } |
|||||||||||
| 207 | } |
|||||||||||
| 208 |
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: