Issues (2687)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Eccube/Service/CsvExportService.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/*
3
 * This file is part of EC-CUBE
4
 *
5
 * Copyright(c) 2000-2015 LOCKON CO.,LTD. All Rights Reserved.
6
 *
7
 * http://www.lockon.co.jp/
8
 *
9
 * This program is free software; you can redistribute it and/or
10
 * modify it under the terms of the GNU General Public License
11
 * as published by the Free Software Foundation; either version 2
12
 * of the License, or (at your option) any later version.
13
 *
14
 * This program is distributed in the hope that it will be useful,
15
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17
 * GNU General Public License for more details.
18
 *
19
 * You should have received a copy of the GNU General Public License
20
 * along with this program; if not, write to the Free Software
21
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
22
 */
23
24
25
namespace Eccube\Service;
26
27
use Eccube\Common\Constant;
28
use Eccube\Util\EntityUtil;
29
use Symfony\Component\Form\FormFactory;
30
use Symfony\Component\HttpFoundation\Request;
31
use Doctrine\Common\Collections\ArrayCollection;
32
33
class CsvExportService
34
{
35
    /**
36
     * @var
37
     */
38
    protected $fp;
39
40
    /**
41
     * @var
42
     */
43
    protected $closed = false;
44
45
    /**
46
     * @var \Closure
47
     */
48
    protected $convertEncodingCallBack;
49
50
    /**
51
     * @var \Doctrine\ORM\EntityManager
52
     */
53
    protected $em;
54
55
    /**
56
     * @var \Doctrine\ORM\QueryBuilder;
57
     */
58
    protected $qb;
59
60
    /**
61
     * @var array
62
     */
63
    protected $config;
64
65
    /**
66
     * @var \Eccube\Entity\Master\CsvType
67
     */
68
    protected $CsvType;
69
70
    /**
71
     * @var \Eccube\Entity\Csv[]
72
     */
73
    protected $Csvs;
74
75
    /**
76
     * @var \Eccube\Repository\CsvRepository
77
     */
78
    protected $csvRepository;
79
80
    /**
81
     * @var \Eccube\Repository\Master\CsvTypeRepository
82
     */
83
    protected $csvTypeRepository;
84
85
    /**
86
     * @var \Eccube\Repository\OrderRepository
87
     */
88
    protected $orderRepository;
89
90
    /**
91
     * @var \Eccube\Repository\CustomerRepository
92
     */
93
    protected $customerRepository;
94
95
    /**
96
     * @var \Eccube\Repository\ProductRepository
97
     */
98
    protected $productRepository;
99
100
    /**
101
     * @param $config
102
     */
103 2
    public function setConfig($config)
104
    {
105 2
        $this->config = $config;
106
    }
107
108
    /**
109
     * @param \Eccube\Repository\CsvRepository $csvRepository
110
     */
111 2
    public function setCsvRepository(\Eccube\Repository\CsvRepository $csvRepository)
112
    {
113 2
        $this->csvRepository = $csvRepository;
114
    }
115
116
    /**
117
     * @param \Eccube\Repository\Master\CsvTypeRepository $csvTypeRepository
118
     */
119 2
    public function setCsvTypeRepository(\Eccube\Repository\Master\CsvTypeRepository $csvTypeRepository)
120
    {
121 2
        $this->csvTypeRepository = $csvTypeRepository;
122
    }
123
124
    /**
125
     * @param \Eccube\Repository\OrderRepository $orderRepository
126
     */
127 2
    public function setOrderRepository(\Eccube\Repository\OrderRepository $orderRepository)
128
    {
129 2
        $this->orderRepository = $orderRepository;
130
    }
131
132
    /**
133
     * @param \Eccube\Repository\CustomerRepository $customerRepository
134
     */
135 2
    public function setCustomerRepository(\Eccube\Repository\CustomerRepository $customerRepository)
136
    {
137 2
        $this->customerRepository = $customerRepository;
138
    }
139
140
    /**
141
     * @param \Eccube\Repository\ProductRepository $productRepository
142
     */
143 2
    public function setProductRepository(\Eccube\Repository\ProductRepository $productRepository)
144
    {
145 2
        $this->productRepository = $productRepository;
146
    }
147
148
    /**
149
     * @param \Doctrine\ORM\EntityManager $em
150
     */
151 2
    public function setEntityManager(\Doctrine\ORM\EntityManager $em)
152
    {
153 2
        $this->em = $em;
154
    }
155
156
    /**
157
     * @return \Doctrine\ORM\EntityManager
158
     */
159
    public function getEntityManager()
160
    {
161
        return $this->em;
162
    }
163
164
    /**
165
     * @param \Doctrine\ORM\QueryBuilder $qb
166
     */
167 1
    public function setExportQueryBuilder(\Doctrine\ORM\QueryBuilder $qb)
168
    {
169 1
        $this->qb = $qb;
170
    }
171
172
    /**
173
     * Csv種別からServiceの初期化を行う.
174
     *
175
     * @param $CsvType|integer
176
     */
177 2
    public function initCsvType($CsvType)
178
    {
179 2
        if ($CsvType instanceof \Eccube\Entity\Master\CsvType) {
0 ignored issues
show
The class Eccube\Entity\Master\CsvType does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
180
            $this->CsvType = $CsvType;
181
        } else {
182 2
            $this->CsvType = $this->csvTypeRepository->find($CsvType);
183
        }
184
185
        $criteria = array(
186 2
            'CsvType' => $CsvType,
187
            'enable_flg' => Constant::ENABLED
188
        );
189
        $orderBy = array(
190
            'rank' => 'ASC'
191 2
        );
192 2
        $this->Csvs = $this->csvRepository->findBy($criteria, $orderBy);
193
    }
194
195
    /**
196
     * @return \Eccube\Entity\Csv[]
197
     */
198 1
    public function getCsvs()
199
    {
200 1
        return $this->Csvs;
201
    }
202
203
    /**
204
     * ヘッダ行を出力する.
205
     * このメソッドを使う場合は, 事前にinitCsvType($CsvType)で初期化しておく必要がある.
206
     */
207 1
    public function exportHeader()
208
    {
209 1
        if (is_null($this->CsvType) || is_null($this->Csvs)) {
210
            throw new \LogicException('init csv type incomplete.');
211
        }
212
213 1
        $row = array();
214 1
        foreach ($this->Csvs as $Csv) {
215 1
            $row[] = $Csv->getDispName();
216
        }
217
218 1
        $this->fopen();
219 1
        $this->fputcsv($row);
220 1
        $this->fclose();
221
    }
222
223
    /**
224
     * クエリビルダにもとづいてデータ行を出力する.
225
     * このメソッドを使う場合は, 事前にsetExportQueryBuilder($qb)で出力対象のクエリビルダをわたしておく必要がある.
226
     *
227
     * @param \Closure $closure
228
     */
229 1
    public function exportData(\Closure $closure)
230
    {
231 1
        if (is_null($this->qb) || is_null($this->em)) {
232
            throw new \LogicException('query builder not set.');
233
        }
234
235 1
        $this->fopen();
236
237 1
        $query = $this->qb->getQuery();
238 1
        foreach ($query->getResult() as $iteratableResult) {
239 1
            $closure($iteratableResult, $this);
240 1
            $this->em->detach($iteratableResult);
241 1
            $query->free();
242 1
            flush();
243
        }
244
245 1
        $this->fclose();
246
    }
247
248
    /**
249
     * CSV出力項目と比較し, 合致するデータを返す.
250
     *
251
     * @param \Eccube\Entity\Csv $Csv
252
     * @param $entity
253
     * @return mixed|null|string|void
254
     */
255 1
    public function getData(\Eccube\Entity\Csv $Csv, $entity)
256
    {
257
        // エンティティ名が一致するかどうかチェック.
258 1
        $csvEntityName = str_replace('\\\\', '\\', $Csv->getEntityName());
259 1
        $entityName = str_replace('\\\\', '\\', get_class($entity));
260 1
        if ($csvEntityName !== $entityName) {
261 1
            $entityName = str_replace('DoctrineProxy\\__CG__\\', '', $entityName);
262 1
            if ($csvEntityName !== $entityName) {
263 1
                return null;
264
            }
265
        }
266
267
        // カラム名がエンティティに存在するかどうかをチェック.
268 1
        if (!$entity->offsetExists($Csv->getFieldName())) {
269
            return null;
270
        }
271
272
        // データを取得.
273 1
        $data = $entity->offsetGet($Csv->getFieldName());
274
275
        // one to one の場合は, dtb_csv.referece_field_nameと比較し, 合致する結果を取得する.
276 1
        if ($data instanceof \Eccube\Entity\AbstractEntity) {
0 ignored issues
show
The class Eccube\Entity\AbstractEntity does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
277 1
            if (EntityUtil::isNotEmpty($data)) {
278 1
                return $data->offsetGet($Csv->getReferenceFieldName());
279
            }
280 1
        } elseif ($data instanceof \Doctrine\Common\Collections\Collection) {
281
            // one to manyの場合は, カンマ区切りに変換する.
282
            $array = array();
283
            foreach ($data as $elem) {
284
                if (EntityUtil::isNotEmpty($elem)) {
285
                    $array[] = $elem->offsetGet($Csv->getReferenceFieldName());
286
                }
287
            }
288
            return implode($this->config['csv_export_multidata_separator'], $array);
289
290 1
        } elseif ($data instanceof \DateTime) {
291
            // datetimeの場合は文字列に変換する.
292 1
            return $data->format($this->config['csv_export_date_format']);
293
294
        } else {
295
            // スカラ値の場合はそのまま.
296 1
            return $data;
297
        }
298
299
        return null;
300
    }
301
302
    /**
303
     * 文字エンコーディングの変換を行うコールバック関数を返す.
304
     *
305
     * @return \Closure
306
     */
307 2
    public function getConvertEncodhingCallback()
308
    {
309 2
        $config = $this->config;
310
311
        return function ($value) use ($config) {
312 2
            return mb_convert_encoding(
313 2
                (string) $value, $config['csv_export_encoding'], 'UTF-8'
314
            );
315 2
        };
316
    }
317
318
    /**
319
     *
320
     */
321 2
    public function fopen()
322
    {
323 2
        if (is_null($this->fp) || $this->closed) {
324
            $this->fp = fopen('php://output', 'w');
325
        }
326
    }
327
328
    /**
329
     * @param $row
330
     * @param null $callback
331
     */
332 2
    public function fputcsv($row)
333
    {
334 2
        if (is_null($this->convertEncodingCallBack)) {
335 2
            $this->convertEncodingCallBack = $this->getConvertEncodhingCallback();
336
        }
337
338 2
        fputcsv($this->fp, array_map($this->convertEncodingCallBack, $row), $this->config['csv_export_separator']);
339
    }
340
341
    /**
342
     *
343
     */
344 2
    public function fclose()
345
    {
346 2
        if (!$this->closed) {
347 2
            fclose($this->fp);
348 2
            $this->closed = true;
349
        }
350
    }
351
352
    /**
353
     * 受注検索用のクエリビルダを返す.
354
     *
355
     * @param Request $request
356
     * @return \Doctrine\ORM\QueryBuilder
357
     */
358 View Code Duplication
    public function getOrderQueryBuilder(Request $request)
359
    {
360
        $session = $request->getSession();
361
        if ($session->has('eccube.admin.order.search')) {
362
            $searchData = $session->get('eccube.admin.order.search');
363
            $this->findDeserializeObjects($searchData);
364
        } else {
365
            $searchData = array();
366
        }
367
368
        // 受注データのクエリビルダを構築.
369
        $qb = $this->orderRepository
370
            ->getQueryBuilderBySearchDataForAdmin($searchData);
371
372
        return $qb;
373
    }
374
375
    /**
376
     * 会員検索用のクエリビルダを返す.
377
     *
378
     * @param Request $request
379
     * @return \Doctrine\ORM\QueryBuilder
380
     */
381 View Code Duplication
    public function getCustomerQueryBuilder(Request $request)
382
    {
383
        $session = $request->getSession();
384
        if ($session->has('eccube.admin.customer.search')) {
385
            $searchData = $session->get('eccube.admin.customer.search');
386
            $this->findDeserializeObjects($searchData);
387
        } else {
388
            $searchData = array();
389
        }
390
391
        // 会員データのクエリビルダを構築.
392
        $qb = $this->customerRepository
393
            ->getQueryBuilderBySearchData($searchData);
394
395
        return $qb;
396
    }
397
398
    /**
399
     * 商品検索用のクエリビルダを返す.
400
     *
401
     * @param Request $request
402
     * @return \Doctrine\ORM\QueryBuilder
403
     */
404 View Code Duplication
    public function getProductQueryBuilder(Request $request)
405
    {
406
        $session = $request->getSession();
407
        if ($session->has('eccube.admin.product.search')) {
408
            $searchData = $session->get('eccube.admin.product.search');
409
            $this->findDeserializeObjects($searchData);
410
        } else {
411
            $searchData = array();
412
        }
413
414
        // 商品データのクエリビルダを構築.
415
        $qb = $this->productRepository
416
            ->getQueryBuilderBySearchDataForAdmin($searchData);
417
418
        return $qb;
419
    }
420
421
    /**
422
     * セッションでシリアライズされた Doctrine のオブジェクトを取得し直す.
423
     *
424
     * XXX self::setExportQueryBuilder() をコールする前に EntityManager を取得したいので、引数で渡している
425
     *
426
     * @param array $searchData セッションから取得した検索条件の配列
427
     * @param EntityManager $em
428
     */
429
    protected function findDeserializeObjects(array &$searchData)
430
    {
431
        $em = $this->getEntityManager();
432
        foreach ($searchData as &$Conditions) {
433
            if ($Conditions instanceof ArrayCollection) {
434
                $Conditions = new ArrayCollection(
435
                    array_map(
436
                        function ($Entity) use ($em) {
437
                            return $em->getRepository(get_class($Entity))->find($Entity->getId());
438
                        }, $Conditions->toArray()
439
                    )
440
                );
441
            } elseif ($Conditions instanceof \Eccube\Entity\AbstractEntity) {
0 ignored issues
show
The class Eccube\Entity\AbstractEntity does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
442
                $Conditions = $em->getRepository(get_class($Conditions))->find($Conditions->getId());
443
            }
444
        }
445
    }
446
}
447