Issues in ObjectFacade.php (master) - Issues in master - Dgame/php-object - Measure and Improve Code Quality continuously with Scrutinizer

Issues (4)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/ObjectFacade.php (1 issue)

Labels

Documentation 1

Severity

Informational 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

namespace Dgame\Object;

use function Dgame\Ensurance\enforce;
use Dgame\Variants\Variants;
use ReflectionClass;
use ReflectionMethod;
use ReflectionProperty;

/**
 * Class ObjectFacade
 * @package Dgame\Object
 */
class ObjectFacade
{
    /**
     * @var object
     */
    private $object;
    /**
     * @var ReflectionClass
     */
    private $reflection;

    /**
     * ObjectFacade constructor.
     *
     * @param object $object
     */
    public function __construct($object)
    {
        enforce(is_object($object))->orThrow('That is not a valid object');

        $this->object = $object;
    }

    /**
     * @return object
     */
    final public function getObject()
    {
        return $this->object;
    }

    /**
     * @return ReflectionClass
     */
    final public function getReflection(): ReflectionClass
    {
        if ($this->reflection === null) {
            $this->reflection = new ReflectionClass($this->object);
        }

        return $this->reflection;
    }

    /**
     * @param string $name
     * @param mixed  $value
     *
     * @return bool
     */
    final public function setValue(string $name, $value): bool
    {
        foreach (Variants::ofArguments($name)->withCamelSnakeCase() as $attribute) {
            if ($this->setValueByProperty($attribute, $value) || $this->setValueByMethod($attribute, $value)) {
                return true;
            }
        }

        return $this->tryMagicSet($name, $value);
    }

    /**
     * @param string $name
     * @param mixed $value
     *
     * @return bool
     */
    private function tryMagicSet(string $name, $value): bool
    {
        if ($this->hasMethod('__set')) {
            $this->invokeMethod('__set', $name, $value);

            return true;
        }

        return false;
    }

    /**
     * @param string $name
     *
     * @return mixed|null
     */
    final public function getValue(string $name)
    {
        foreach (Variants::ofArguments($name)->withCamelSnakeCase() as $attribute) {
            $property = $this->getPropertyByName($attribute);
            if ($property !== null && $property->isPublic()) {
                return $property->getValue($this->object);
            }

            $method = $this->getGetterMethod($name);
            if ($method !== null && Validator::new($this)->isValidGetterMethod($method)) {
                return $method->invoke($this->object);
            }
        }

        return $this->invokeMethod('__get', $name);
    }

    /**
     * @param string $name
     * @param mixed $value
     *
     * @return bool
     */
    final public function setValueByProperty(string $name, $value): bool
    {
        $property = $this->getPropertyByName($name);
        if ($property !== null && $property->isPublic()) {
            $property->setValue($this->object, $value);

            return true;
        }

        return false;
    }

    /**
     * @param string $name
     * @param mixed $value
     *
     * @return bool
     */
    final public function setValueByMethod(string $name, $value): bool
    {
        $method = $this->getSetterMethod($name);
        if ($method !== null && Validator::new($this)->isValidSetterMethod($method, $value)) {
            $method->invoke($this->object, $value);

            return true;
        }

        return false;
    }

    /**
     * @param string $name
     *
     * @return mixed|null
     */
    final public function getValueByMethod(string $name)
    {
        $method = $this->getGetterMethod($name);
        if ($method !== null && Validator::new($this)->isValidGetterMethod($method)) {
            return $method->invoke($this->object);
        }

        return null;
    }

    /**
     * @param string $name
     *
     * @return mixed|null
     */
    final public function getValueByProperty(string $name)
    {
        $property = $this->getPropertyByName($name);
        if ($property !== null && $property->isPublic()) {
            return $property->getValue($this->object);
        }

        return null;
    }

    /**
     * @param string $name
     *
     * @return null|ReflectionMethod
     */
    final public function getSetterMethod(string $name): ?ReflectionMethod
    {
        return $this->getMethodByName($name) ?? $this->getMethod($name, ['set', 'append']);
    }

    /**
     * @param string $name
     *
     * @return null|ReflectionMethod
     */
    final public function getGetterMethod(string $name): ?ReflectionMethod
    {
        return $this->getMethodByName($name) ?? $this->getMethod($name, ['get']);
    }

    /**
     * @param string $name
     * @param array  $prefixe
     *
     * @return null|ReflectionMethod
     */
    final public function getMethod(string $name, array $prefixe): ?ReflectionMethod
    {
        foreach ($prefixe as $prefix) {
            $method = $this->getMethodByName($prefix . ucfirst($name));
            if ($method !== null) {
                return $method;
            }
        }

        return null;
    }

    /**
     * @param string $name
     * @param array  ...$args
     *
     * @return mixed|null
     */

    final public function invokeMethod(string $name, ...$args)
    {
        $method = $this->getMethodByName($name);
        if ($method !== null && Validator::new($this)->areValidMethodArguments($method, ...$args)) {
            return $method->invokeArgs($this->object, $args);
        }

        return null;
    }

    /**
     * @param string $name
     *
     * @return null|ReflectionMethod
     */
    final public function getMethodByName(string $name): ?ReflectionMethod
    {
        return $this->hasMethod($name) ? $this->getReflection()->getMethod($name) : null;
    }

    /**
     * @param string $name
     *
     * @return null|ReflectionProperty
     */
    final public function getPropertyByName(string $name): ?ReflectionProperty
    {
        return $this->hasProperty($name) ? $this->getReflection()->getProperty($name) : null;
    }

    /**
     * @param string $name
     *
     * @return bool
     */
    final public function hasProperty(string $name): bool
    {
        return $this->getReflection()->hasProperty($name);
    }

    /**
     * @param string $name
     *
     * @return bool
     */
    final public function isSet(string $name): bool
    {
        return $this->hasProperty($name) || $this->invokeMethod('__isset', $name) === true;
    }

    /**
     * @param string $name
     *
     * @return bool
     */
    final public function hasMethod(string $name): bool
    {
        return $this->getReflection()->hasMethod($name);
    }
}


1		<?php
2
3		namespace Dgame\Object;
4
5		use function Dgame\Ensurance\enforce;
6		use Dgame\Variants\Variants;
7		use ReflectionClass;
8		use ReflectionMethod;
9		use ReflectionProperty;
10
11		/**
12		* Class ObjectFacade
13		* @package Dgame\Object
14		*/
15		class ObjectFacade
16		{
17		/**
18		* @var object
19		*/
20		private $object;
21		/**
22		* @var ReflectionClass
23		*/
24		private $reflection;
25
26		/**
27		* ObjectFacade constructor.
28		*
29		* @param object $object
30		*/
31	10	public function __construct($object)
32		{
33	10	enforce(is_object($object))->orThrow('That is not a valid object');
34
35	10	$this->object = $object;
36	10	}
37
38		/**
39		* @return object
40		*/
41	3	final public function getObject()
42		{
43	3	return $this->object;
44		}
45
46		/**
47		* @return ReflectionClass
48		*/
49	10	final public function getReflection(): ReflectionClass
50		{
51	10	if ($this->reflection === null) {
52	10	$this->reflection = new ReflectionClass($this->object);
53		}
54
55	10	return $this->reflection;
56		}
57
58		/**
59		* @param string $name
60		* @param mixed $value
61		*
62		* @return bool
63		*/
64	2	final public function setValue(string $name, $value): bool
65		{
66	2	foreach (Variants::ofArguments($name)->withCamelSnakeCase() as $attribute) {
67	2	if ($this->setValueByProperty($attribute, $value) \|\| $this->setValueByMethod($attribute, $value)) {
68	2	return true;
69		}
70		}
71
72		return $this->tryMagicSet($name, $value);
73		}
74
75		/**
76		* @param string $name
77		* @param mixed $value
78		*
79		* @return bool
80		*/
81		private function tryMagicSet(string $name, $value): bool
82		{
83		if ($this->hasMethod('__set')) {
84		$this->invokeMethod('__set', $name, $value);
85
86		return true;
87		}
88
89		return false;
90		}
91
92		/**
93		* @param string $name
94		*
95		* @return mixed\|null
96		*/
97	2	final public function getValue(string $name)
98		{
99	2	foreach (Variants::ofArguments($name)->withCamelSnakeCase() as $attribute) {
100	2	$property = $this->getPropertyByName($attribute);
101	2	if ($property !== null && $property->isPublic()) {
102	1	return $property->getValue($this->object);
103		}
104
105	1	$method = $this->getGetterMethod($name);
106	1	if ($method !== null && Validator::new($this)->isValidGetterMethod($method)) {
107	1	return $method->invoke($this->object);
108		}
109		}
110
111		return $this->invokeMethod('__get', $name);
112		}
113
114		/**
115		* @param string $name
116		* @param mixed $value
117		*
118		* @return bool
119		*/
120	2	final public function setValueByProperty(string $name, $value): bool
121		{
122	2	$property = $this->getPropertyByName($name);
123	2	if ($property !== null && $property->isPublic()) {
124	1	$property->setValue($this->object, $value);
125
126	1	return true;
127		}
128
129	1	return false;
130		}
131
132		/**
133		* @param string $name
134		* @param mixed $value
135		*
136		* @return bool
137		*/
138	1	final public function setValueByMethod(string $name, $value): bool
139		{
140	1	$method = $this->getSetterMethod($name);
141	1	if ($method !== null && Validator::new($this)->isValidSetterMethod($method, $value)) {
142	1	$method->invoke($this->object, $value);
143
144	1	return true;
145		}
146
147	1	return false;
148		}
149
150		/**
151		* @param string $name
152		*
153		* @return mixed\|null
154		*/
155	2	final public function getValueByMethod(string $name)
156		{
157	2	$method = $this->getGetterMethod($name);
158	2	if ($method !== null && Validator::new($this)->isValidGetterMethod($method)) {
159	2	return $method->invoke($this->object);
160		}
161
162	1	return null;
163		}
164
165		/**
166		* @param string $name
167		*
168		* @return mixed\|null
169		*/
170	2	final public function getValueByProperty(string $name)
171		{
172	2	$property = $this->getPropertyByName($name);
173	2	if ($property !== null && $property->isPublic()) {
174	2	return $property->getValue($this->object);
175		}
176
177	1	return null;
178		}
179
180		/**
181		* @param string $name
182		*
183		* @return null\|ReflectionMethod
184		*/
185	2	final public function getSetterMethod(string $name): ?ReflectionMethod
186		{
187	2	return $this->getMethodByName($name) ?? $this->getMethod($name, ['set', 'append']);
188		}
189
190		/**
191		* @param string $name
192		*
193		* @return null\|ReflectionMethod
194		*/
195	3	final public function getGetterMethod(string $name): ?ReflectionMethod
196		{
197	3	return $this->getMethodByName($name) ?? $this->getMethod($name, ['get']);
198		}
199
200		/**
201		* @param string $name
202		* @param array $prefixe
203		*
204		* @return null\|ReflectionMethod
205		*/
206	4	final public function getMethod(string $name, array $prefixe): ?ReflectionMethod
207		{
208	4	foreach ($prefixe as $prefix) {
209	4	$method = $this->getMethodByName($prefix . ucfirst($name));
210	4	if ($method !== null) {
211	4	return $method;
212		}
213		}
214
215	1	return null;
216		}
217
218		/**
219		* @param string $name
220		* @param array ...$args
221		*
222		* @return mixed\|null
223		*/
		0 ignored issues – show Documentation introduced 2017-04-30 20:50 UTC by Report Bug Copy Issue Report Show Similar Issues like this Consider making the type for parameter `$args` a bit more specific; maybe use `array[]`. Loading history...
224		final public function invokeMethod(string $name, ...$args)
225		{
226		$method = $this->getMethodByName($name);
227		if ($method !== null && Validator::new($this)->areValidMethodArguments($method, ...$args)) {
228		return $method->invokeArgs($this->object, $args);
229		}
230
231		return null;
232		}
233
234		/**
235		* @param string $name
236		*
237		* @return null\|ReflectionMethod
238		*/
239	5	final public function getMethodByName(string $name): ?ReflectionMethod
240		{
241	5	return $this->hasMethod($name) ? $this->getReflection()->getMethod($name) : null;
242		}
243
244		/**
245		* @param string $name
246		*
247		* @return null\|ReflectionProperty
248		*/
249	4	final public function getPropertyByName(string $name): ?ReflectionProperty
250		{
251	4	return $this->hasProperty($name) ? $this->getReflection()->getProperty($name) : null;
252		}
253
254		/**
255		* @param string $name
256		*
257		* @return bool
258		*/
259	5	final public function hasProperty(string $name): bool
260		{
261	5	return $this->getReflection()->hasProperty($name);
262		}
263
264		/**
265		* @param string $name
266		*
267		* @return bool
268		*/
269	6	final public function isSet(string $name): bool
270		{
271	6	return $this->hasProperty($name) \|\| $this->invokeMethod('__isset', $name) === true;
272		}
273
274		/**
275		* @param string $name
276		*
277		* @return bool
278		*/
279		final public function hasMethod(string $name): bool
280		{
281		return $this->getReflection()->hasMethod($name);
282		}
283		}
284

Dgame / php-object

Issues (4)

Security Analysis no request data

src/ObjectFacade.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like