This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
|||||||||||
2 | ||||||||||||
3 | namespace Nip; |
|||||||||||
4 | ||||||||||||
5 | use ByTIC\RequestDetective\RequestDetective; |
|||||||||||
6 | use Nip\Http\Request\Http; |
|||||||||||
7 | use Nip\Http\Request\Traits\ArrayAccessTrait; |
|||||||||||
8 | use Nip\Http\Request\Traits\InteractsWithMca; |
|||||||||||
9 | use Nip\Http\Request\Traits\InteractsWithUri; |
|||||||||||
10 | use Nip\Http\Request\Traits\PsrBridgeTrait; |
|||||||||||
11 | use Psr\Http\Message\ServerRequestInterface; |
|||||||||||
12 | ||||||||||||
13 | /** |
|||||||||||
14 | * Class Request |
|||||||||||
15 | * @package Nip |
|||||||||||
16 | */ |
|||||||||||
17 | class Request extends \Symfony\Component\HttpFoundation\Request implements \ArrayAccess, ServerRequestInterface |
|||||||||||
18 | { |
|||||||||||
19 | use PsrBridgeTrait; |
|||||||||||
20 | use InteractsWithUri; |
|||||||||||
21 | use InteractsWithMca; |
|||||||||||
22 | use ArrayAccessTrait; |
|||||||||||
23 | ||||||||||||
24 | /** |
|||||||||||
25 | * @var Http |
|||||||||||
26 | */ |
|||||||||||
27 | protected $http; |
|||||||||||
28 | ||||||||||||
29 | ||||||||||||
30 | /** |
|||||||||||
31 | * Singleton |
|||||||||||
32 | * |
|||||||||||
33 | * @param null $newInstance |
|||||||||||
34 | * @return static |
|||||||||||
35 | */ |
|||||||||||
36 | public static function instance($newInstance = null) |
|||||||||||
37 | { |
|||||||||||
38 | static $instance; |
|||||||||||
39 | ||||||||||||
40 | if ($newInstance instanceof self) { |
|||||||||||
41 | $instance = $newInstance; |
|||||||||||
42 | } |
|||||||||||
43 | ||||||||||||
44 | if (!($instance instanceof self)) { |
|||||||||||
45 | $instance = new self(); |
|||||||||||
46 | } |
|||||||||||
47 | ||||||||||||
48 | return $instance; |
|||||||||||
49 | } |
|||||||||||
50 | ||||||||||||
51 | /** |
|||||||||||
52 | * @param $name |
|||||||||||
53 | * @return mixed |
|||||||||||
54 | */ |
|||||||||||
55 | public function __get($name) |
|||||||||||
56 | { |
|||||||||||
57 | return $this->get($name); |
|||||||||||
58 | } |
|||||||||||
59 | ||||||||||||
60 | /** |
|||||||||||
61 | * Set an action parameter |
|||||||||||
62 | * |
|||||||||||
63 | * A $value of null will unset the $key if it exists |
|||||||||||
64 | * |
|||||||||||
65 | * @param string $key |
|||||||||||
66 | * @param mixed $value |
|||||||||||
67 | * @return self |
|||||||||||
68 | */ |
|||||||||||
69 | 1 | public function setAttribute($key, $value) |
||||||||||
70 | { |
|||||||||||
71 | 1 | $this->attributes->set($key, $value); |
||||||||||
72 | ||||||||||||
73 | 1 | return $this; |
||||||||||
74 | } |
|||||||||||
75 | ||||||||||||
76 | /** |
|||||||||||
77 | * @param array $params |
|||||||||||
78 | * @return $this |
|||||||||||
79 | */ |
|||||||||||
80 | public function setParams(array $params) |
|||||||||||
81 | { |
|||||||||||
82 | foreach ($params as $param => $value) { |
|||||||||||
83 | $this->{$param} = $value; |
|||||||||||
84 | } |
|||||||||||
85 | ||||||||||||
86 | return $this; |
|||||||||||
87 | } |
|||||||||||
88 | ||||||||||||
89 | /** |
|||||||||||
90 | * Returns Http object |
|||||||||||
91 | * @return Http |
|||||||||||
92 | */ |
|||||||||||
93 | 8 | public function getHttp() |
||||||||||
94 | { |
|||||||||||
95 | 8 | if (!$this->http) { |
||||||||||
96 | 8 | $this->http = new Http(); |
||||||||||
97 | 8 | $this->http->setRequest($this); |
||||||||||
98 | } |
|||||||||||
99 | ||||||||||||
100 | 8 | return $this->http; |
||||||||||
101 | } |
|||||||||||
102 | ||||||||||||
103 | /** |
|||||||||||
104 | * @return bool |
|||||||||||
105 | */ |
|||||||||||
106 | public function isCLI() |
|||||||||||
0 ignored issues
–
show
isCLI uses the super-global variable $_SERVER which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
![]() |
||||||||||||
107 | { |
|||||||||||
108 | if (defined('STDIN')) { |
|||||||||||
109 | return true; |
|||||||||||
110 | } |
|||||||||||
111 | ||||||||||||
112 | if (php_sapi_name() === 'cli') { |
|||||||||||
113 | return true; |
|||||||||||
114 | } |
|||||||||||
115 | ||||||||||||
116 | if (array_key_exists('SHELL', $_ENV)) { |
|||||||||||
117 | return true; |
|||||||||||
118 | } |
|||||||||||
119 | ||||||||||||
120 | if (empty($_SERVER['REMOTE_ADDR']) and !isset($_SERVER['HTTP_USER_AGENT']) and count($_SERVER['argv']) > 0) { |
|||||||||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
Using logical operators such as
and instead of && is generally not recommended.
PHP has two types of connecting operators (logical operators, and boolean operators):
The difference between these is the order in which they are executed. In most cases,
you would want to use a boolean operator like Let’s take a look at a few examples: // Logical operators have lower precedence:
$f = false or true;
// is executed like this:
($f = false) or true;
// Boolean operators have higher precedence:
$f = false || true;
// is executed like this:
$f = (false || true);
Logical Operators are used for Control-FlowOne case where you explicitly want to use logical operators is for control-flow such as this: $x === 5
or die('$x must be 5.');
// Instead of
if ($x !== 5) {
die('$x must be 5.');
}
Since // The following is currently a parse error.
$x === 5
or throw new RuntimeException('$x must be 5.');
These limitations lead to logical operators rarely being of use in current PHP code. ![]() |
||||||||||||
121 | return true; |
|||||||||||
122 | } |
|||||||||||
123 | ||||||||||||
124 | if (!array_key_exists('REQUEST_METHOD', $_SERVER)) { |
|||||||||||
125 | return true; |
|||||||||||
126 | } |
|||||||||||
127 | ||||||||||||
128 | return false; |
|||||||||||
129 | } |
|||||||||||
130 | ||||||||||||
131 | /** |
|||||||||||
132 | * Checks if requested URI matches $url parameter, |
|||||||||||
133 | * and redirects to $url if not |
|||||||||||
134 | * |
|||||||||||
135 | * @param string $url |
|||||||||||
136 | * @param int $code |
|||||||||||
137 | */ |
|||||||||||
138 | public function checkURL($url, $code = 302) |
|||||||||||
0 ignored issues
–
show
checkURL uses the super-global variable $_SERVER which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
![]() |
||||||||||||
139 | { |
|||||||||||
140 | $components = parse_url($url); |
|||||||||||
141 | $request = parse_url($_SERVER['REQUEST_URI']); |
|||||||||||
142 | ||||||||||||
143 | if ($components['path'] != $request['path']) { |
|||||||||||
144 | $redirect = $url . ($request['query'] ? '?' . $request['query'] : ''); |
|||||||||||
145 | ||||||||||||
146 | header("Location: " . $redirect, true, $code); |
|||||||||||
147 | exit(); |
|||||||||||
0 ignored issues
–
show
The method
checkURL() contains an exit expression.
An exit expression should only be used in rare cases. For example, if you write a short command line script. In most cases however, using an ![]() |
||||||||||||
148 | } |
|||||||||||
149 | } |
|||||||||||
150 | ||||||||||||
151 | /** |
|||||||||||
152 | * @param $url |
|||||||||||
153 | */ |
|||||||||||
154 | public function redirect($url) |
|||||||||||
155 | { |
|||||||||||
156 | header("Location: " . $url); |
|||||||||||
157 | exit(); |
|||||||||||
0 ignored issues
–
show
The method
redirect() contains an exit expression.
An exit expression should only be used in rare cases. For example, if you write a short command line script. In most cases however, using an ![]() |
||||||||||||
158 | } |
|||||||||||
159 | ||||||||||||
160 | /** |
|||||||||||
161 | * @param bool $action |
|||||||||||
162 | * @param bool $controller |
|||||||||||
163 | * @param bool $module |
|||||||||||
164 | * @param array $params |
|||||||||||
165 | * @return $this |
|||||||||||
166 | */ |
|||||||||||
167 | 1 | public function duplicateWithParams($action = false, $controller = false, $module = false, $params = []) |
||||||||||
168 | { |
|||||||||||
169 | /** @var self $newRequest */ |
|||||||||||
170 | 1 | $newRequest = $this->duplicate(); |
||||||||||
171 | 1 | $newRequest->setActionName($action); |
||||||||||
0 ignored issues
–
show
$action is of type boolean , but the function expects a string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
||||||||||||
172 | 1 | $newRequest->setControllerName($controller); |
||||||||||
0 ignored issues
–
show
$controller is of type boolean , but the function expects a string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
||||||||||||
173 | 1 | $newRequest->setModuleName($module); |
||||||||||
0 ignored issues
–
show
$module is of type boolean , but the function expects a string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
||||||||||||
174 | 1 | $newRequest->attributes->add($params); |
||||||||||
175 | ||||||||||||
176 | 1 | return $newRequest; |
||||||||||
177 | } |
|||||||||||
178 | ||||||||||||
179 | /** |
|||||||||||
180 | * @return bool |
|||||||||||
181 | */ |
|||||||||||
182 | 1 | public function isMalicious() |
||||||||||
183 | { |
|||||||||||
184 | 1 | return RequestDetective::isMalicious($this); |
||||||||||
185 | } |
|||||||||||
186 | ||||||||||||
187 | /** |
|||||||||||
188 | * Get the current encoded path info for the request. |
|||||||||||
189 | * |
|||||||||||
190 | * @return string |
|||||||||||
191 | */ |
|||||||||||
192 | public function decodedPath() |
|||||||||||
193 | { |
|||||||||||
194 | return rawurldecode($this->path()); |
|||||||||||
195 | } |
|||||||||||
196 | ||||||||||||
197 | /** |
|||||||||||
198 | * Get the current path info for the request. |
|||||||||||
199 | * |
|||||||||||
200 | * @return string |
|||||||||||
201 | */ |
|||||||||||
202 | public function path() |
|||||||||||
203 | { |
|||||||||||
204 | $pattern = trim($this->getPathInfo(), '/'); |
|||||||||||
205 | return $pattern == '' ? '/' : '/' . $pattern; |
|||||||||||
206 | } |
|||||||||||
207 | } |
|||||||||||
208 |
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: