This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Copyright 2016 - 2018, Cake Development Corporation (http://cakedc.com) |
||
4 | * |
||
5 | * Licensed under The MIT License |
||
6 | * Redistributions of files must retain the above copyright notice. |
||
7 | * |
||
8 | * @copyright Copyright 2016 - 2018, Cake Development Corporation (http://cakedc.com) |
||
9 | * @license MIT License (http://www.opensource.org/licenses/mit-license.php) |
||
10 | */ |
||
11 | |||
12 | namespace CakeDC\Api\Service\Renderer; |
||
13 | |||
14 | use CakeDC\Api\Exception\ValidationException; |
||
15 | use CakeDC\Api\Service\Action\Result; |
||
16 | use Cake\Collection\Collection; |
||
17 | use Cake\Core\Configure; |
||
18 | use Cake\Datasource\EntityInterface; |
||
19 | use Cake\Datasource\ResultSetInterface; |
||
20 | use Cake\I18n\FrozenTime; |
||
21 | use Cake\Utility\Xml; |
||
22 | use Exception; |
||
23 | |||
24 | /** |
||
25 | * Class XmlRenderer |
||
26 | * XML content negotiation Renderer. |
||
27 | * |
||
28 | * @package CakeDC\Api\Service\Renderer |
||
29 | */ |
||
30 | class XmlRenderer extends BaseRenderer |
||
31 | { |
||
32 | |||
33 | /** |
||
34 | * Builds the HTTP response. |
||
35 | * |
||
36 | * @param Result $result The result object returned by the Service. |
||
37 | * @return bool |
||
38 | */ |
||
39 | 1 | public function response(Result $result = null) |
|
40 | { |
||
41 | 1 | $response = $this->_service->getResponse(); |
|
42 | 1 | $xml = $this->_format($result->getData()); |
|
0 ignored issues
–
show
|
|||
43 | 1 | $this->_service->setResponse($response->withStringBody($this->_encode($xml))->withType('application/xml') |
|
44 | 1 | ->withStatus($result->getCode())); |
|
45 | |||
46 | 1 | return true; |
|
47 | } |
||
48 | |||
49 | /** |
||
50 | * Processes an exception thrown while processing the request. |
||
51 | * |
||
52 | * @param Exception $exception The exception object. |
||
53 | * @return void |
||
54 | */ |
||
55 | 1 | public function error(Exception $exception) |
|
56 | { |
||
57 | 1 | $response = $this->_service->getResponse(); |
|
58 | $data = [ |
||
59 | 'error' => [ |
||
60 | 1 | 'code' => $exception->getCode(), |
|
61 | 1 | 'message' => $this->_buildMessage($exception) |
|
62 | 1 | ] |
|
63 | 1 | ]; |
|
64 | 1 | if (Configure::read('debug') > 0) { |
|
65 | $data['error']['trace'] = $this->_stackTrace($exception); |
||
66 | } |
||
67 | 1 | if ($exception instanceof ValidationException) { |
|
68 | $data['error']['validation'] = $exception->getValidationErrors(); |
||
69 | } |
||
70 | 1 | $this->_service->setResponse($response->withStringBody($this->_encode($data))->withType('application/xml')); |
|
71 | 1 | } |
|
72 | |||
73 | /** |
||
74 | * Formats a response as an XML structure. |
||
75 | * |
||
76 | * @param mixed $content The content to process. |
||
77 | * @return string |
||
78 | */ |
||
79 | 1 | protected function _format($content = null) |
|
80 | { |
||
81 | 1 | if (is_array($content) || $content instanceof Collection || $content instanceof ResultSetInterface) { |
|
82 | $data = $this->_array($content); |
||
0 ignored issues
–
show
It seems like
$content defined by parameter $content on line 79 can also be of type object<Cake\Collection\Collection> or object<Cake\Datasource\ResultSetInterface> ; however, CakeDC\Api\Service\Renderer\XmlRenderer::_array() does only seem to accept array , maybe add an additional type check?
This check looks at variables that have been passed in as parameters and are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. ![]() |
|||
83 | 1 | } elseif (is_object($content)) { |
|
84 | $data = $this->_object($content); |
||
85 | } else { |
||
86 | 1 | $data = ['value' => $content]; |
|
87 | } |
||
88 | |||
89 | 1 | return ['data' => $data]; |
|
90 | } |
||
91 | |||
92 | /** |
||
93 | * Formats an object as an XML node. |
||
94 | * |
||
95 | * @param object $data The object to process. |
||
96 | * @return string |
||
97 | */ |
||
98 | protected function _object($data) |
||
99 | { |
||
100 | $xml = []; |
||
101 | if ($data instanceof EntityInterface) { |
||
102 | $data = $data->toArray(); |
||
103 | } |
||
104 | foreach ($data as $name => $value) { |
||
105 | if (is_object($value) && $value instanceof \DateTime) { |
||
106 | $property = []; |
||
107 | $property['@'] = $value->format(\DateTime::ISO8601); |
||
108 | } elseif (is_object($value) && $value instanceof FrozenTime) { |
||
109 | $property = []; |
||
110 | $property['@'] = $value->toIso8601String(); |
||
111 | } elseif (is_object($value)) { |
||
112 | $property = $this->_object($value); |
||
113 | } elseif (is_array($value)) { |
||
114 | $property = $this->_array($value); |
||
115 | } else { |
||
116 | $property = []; |
||
117 | $property['@'] = $value !== null ? $value : ''; |
||
118 | } |
||
119 | $property['@name'] = $name; |
||
120 | $xml['property'][] = $property; |
||
121 | } |
||
122 | |||
123 | return ['object' => $xml]; |
||
124 | } |
||
125 | |||
126 | /** |
||
127 | * Formats an array as an XML node. |
||
128 | * |
||
129 | * @param array $data The array to process. |
||
130 | * @return string |
||
131 | */ |
||
132 | protected function _array($data) |
||
133 | { |
||
134 | $xml = []; |
||
135 | $items = []; |
||
136 | if ($data instanceof Collection) { |
||
137 | $data = $data->toArray(); |
||
138 | } |
||
139 | foreach ($data as $name => $value) { |
||
140 | $item = []; |
||
141 | $item['@key'] = $name; |
||
142 | if (is_object($value)) { |
||
143 | $item = $this->_object($value); |
||
144 | } else { |
||
145 | if (is_array($value)) { |
||
146 | $item = $this->_array($value); |
||
147 | } else { |
||
148 | $item = []; |
||
149 | $item['@'] = $value !== null ? $value : ''; |
||
150 | } |
||
151 | } |
||
152 | $item['@key'] = $name; |
||
153 | $items[] = $item; |
||
154 | } |
||
155 | $xml['array']['row'] = $items; |
||
156 | |||
157 | return $xml; |
||
158 | } |
||
159 | |||
160 | /** |
||
161 | * Encoded object as xml. |
||
162 | * |
||
163 | * @param mixed $data Encoded data. |
||
164 | * @return string |
||
165 | */ |
||
166 | 2 | protected function _encode($data) |
|
167 | { |
||
168 | 2 | $xmlObject = Xml::fromArray($data, ['format' => 'tags']); |
|
169 | |||
170 | 2 | return $xmlObject->asXML(); |
|
0 ignored issues
–
show
The method
asXML does only exist in SimpleXMLElement , but not in DOMDocument .
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
![]() |
|||
171 | } |
||
172 | } |
||
173 |
If a variable is not always an object, we recommend to add an additional type check to ensure your method call is safe: