Issues in Generator.php (master) - Issues in master - EvilFreelancer/composer-json-generator - Measure and Improve Code Quality continuously with Scrutinizer

Issues (12)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Generator.php (1 issue)

Labels

Bug 1

Severity

Critical 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

namespace ComposerJson;

use ComposerJson\Schemas\Author;
use ComposerJson\Schemas\Composer;
use ComposerJson\Schemas\Repository;
use ComposerJson\Schemas\Support;
use ErrorException;
use JsonException;
use InvalidArgumentException;

class Generator
{
    use Helper;

    /**
     * Main root object of composer
     *
     * @var Composer
     */
    private Composer $composer;


    /**
     * Check if file is JSON
     *
     * @param string $source
     *
     * @return JsonException|array
     * @throws JsonException
     */
    private function isJson(string &$source)
    {
        return json_decode($source, true, 512, JSON_THROW_ON_ERROR);
    }

    /**
     * Generator constructor.
     *
     * @param \ComposerJson\Schemas\Composer|null $composer
     */
    public function __construct(Composer $composer = null)
    {
        if (null !== $composer) {
            $this->composer = $composer;
        }
    }

    /**
     * Load composer to memory
     *
     * @param \ComposerJson\Schemas\Composer $composer
     *
     * @return $this
     */
    public function load(Composer $composer): self
    {
        $this->composer = $composer;
        return $this;
    }

    /**
     * Return array of values
     *
     * @return array
     */
    public function toArray(): array
    {
        return $this->composer->toArray();
    }

    /**
     * Return JSON with composer
     *
     * @return string
     * @throws JsonException
     */
    public function toJson(): string
    {
        return json_encode($this->toArray(), JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR);
    }

    /**
     * Compolomus believe what is a simplification of code...
     *
     * @param string $rule
     * @param mixed  $value
     */
    private function parseFields(string $rule, $value): void
    {
        $rule      = $rule !== 'autoload-dev' ? $rule : 'autoload';
        $classRule = $this->denormalize($rule);

        if (!empty($classRule)) {
            if (is_array($this->composer->$classRule)) {
                $method = 'parse' . $this->normalizeMethodName($rule);
                if (method_exists($this, $method)) {
                    $this->composer->$classRule = $this->$method($value);
                } else {
                    $this->composer->$classRule = $value;
                }
            } else {
                $this->composer->$classRule = $value;
            }
        }

    }

    /**
     * Read JSON conde and return Composer object
     *
     * @param string $file
     *
     * @return Composer
     * @throws ErrorException
     * @throws JsonException
     */
    public function read(string $file): Composer
    {
        // Read file from string
        if (!$source = file_get_contents($file)) {
            throw new ErrorException('Provided file could not to be read');
        }

        // Convert JSON to array or throw JsonException
        $array = $this->isJson($source);

        // Initiate composer object
        $this->composer = new Composer();

        // Parse values
        foreach ($array as $key => $value) {
            $this->parseFields($key, $value);
        }

        return $this->composer;
    }

    /**
     * Parse autoload parts of composer.json
     *
     * @param array $autoload
     *
     * @return array
     */
    private function parseAutoload(array $autoload): array
    {
        $objects = [];

        $methodsArray = [
            'psr-0',
            'psr-4',
            'classmap',
            'files'
        ];

        foreach ($autoload as $type => $options) {
            if (in_array($type, $methodsArray, true)) {
                $class  = 'ComposerJson\\Schemas\\' . $this->normalizeMethodName($type);
                $object = new $class;

                // Autoload object options
                $object->options = $options;

                // Save object
                $objects[$type] = $object;
            } else {
                throw new InvalidArgumentException('Incorrect type of autoloader provided');
            }
        }

        return $objects;
    }

    /**
     * Convert array of repositories to array of repository objects
     *
     * @param array $repositories
     *
     * @return \ComposerJson\Schemas\Repository[]
     */
    private function parseRepositories(array $repositories): array
    {
        $objects = [];
        foreach ($repositories as $repository) {
            $object = new Repository();

            foreach ($repository as $key => $value) {

                if ($key === 'packagist.org') {
                    $key = 'packagistOrg';
                }

                $object->$key = $value;
            }

            $objects[] = $object;
        }

        return $objects;
    }

    /**
     * Convert support array to object of schema
     *
     * @param array $support
     *
     * @return \ComposerJson\Schemas\Support
     */
    private function parseSupport(array $support): Support
    {
        $object = new Support();

        foreach ($support as $key => $value) {
            $object->$key = $value;
        }

        return $object;
    }

    /**
     * Convert authors array to array of objects
     *
     * @param array $authors
     *
     * @return \ComposerJson\Schemas\Author[]
     */
    private function parseAuthors(array $authors): array
    {
        $objects = [];
        foreach ($authors as $author) {
            $object = new Author();

            foreach ($author as $key => $value) {
                $object->$key = $value;
            }

            $objects[] = $object;
        }

        return $objects;
    }
}


1			<?php
2
3			namespace ComposerJson;
4
5			use ComposerJson\Schemas\Author;
6			use ComposerJson\Schemas\Composer;
7			use ComposerJson\Schemas\Repository;
8			use ComposerJson\Schemas\Support;
9			use ErrorException;
10			use JsonException;
11			use InvalidArgumentException;
12
13			class Generator
14			{
15			use Helper;
16
17			/**
18			* Main root object of composer
19			*
20			* @var Composer
21			*/
22			private Composer $composer;
			0 ignored issues – show Bug introduced 2019-09-21 19:09 UTC by Report Bug Copy Issue Report Show Similar Issues like this This code did not parse for me. Apparently, there is an error somewhere around this line: Syntax error, unexpected T_STRING, expecting T_FUNCTION or T_CONST Loading history...
23
24			/**
25			* Check if file is JSON
26			*
27			* @param string $source
28			*
29			* @return JsonException\|array
30			* @throws JsonException
31			*/
32			private function isJson(string &$source)
33			{
34			return json_decode($source, true, 512, JSON_THROW_ON_ERROR);
35			}
36
37			/**
38			* Generator constructor.
39			*
40			* @param \ComposerJson\Schemas\Composer\|null $composer
41			*/
42			public function __construct(Composer $composer = null)
43			{
44			if (null !== $composer) {
45			$this->composer = $composer;
46			}
47			}
48
49			/**
50			* Load composer to memory
51			*
52			* @param \ComposerJson\Schemas\Composer $composer
53			*
54			* @return $this
55			*/
56			public function load(Composer $composer): self
57			{
58			$this->composer = $composer;
59			return $this;
60			}
61
62			/**
63			* Return array of values
64			*
65			* @return array
66			*/
67			public function toArray(): array
68			{
69			return $this->composer->toArray();
70			}
71
72			/**
73			* Return JSON with composer
74			*
75			* @return string
76			* @throws JsonException
77			*/
78			public function toJson(): string
79			{
80			return json_encode($this->toArray(), JSON_PRETTY_PRINT \| JSON_UNESCAPED_UNICODE \| JSON_UNESCAPED_SLASHES \| JSON_THROW_ON_ERROR);
81			}
82
83			/**
84			* Compolomus believe what is a simplification of code...
85			*
86			* @param string $rule
87			* @param mixed $value
88			*/
89			private function parseFields(string $rule, $value): void
90			{
91			$rule = $rule !== 'autoload-dev' ? $rule : 'autoload';
92			$classRule = $this->denormalize($rule);
93
94			if (!empty($classRule)) {
95			if (is_array($this->composer->$classRule)) {
96			$method = 'parse' . $this->normalizeMethodName($rule);
97			if (method_exists($this, $method)) {
98			$this->composer->$classRule = $this->$method($value);
99			} else {
100			$this->composer->$classRule = $value;
101			}
102			} else {
103			$this->composer->$classRule = $value;
104			}
105			}
106
107			}
108
109			/**
110			* Read JSON conde and return Composer object
111			*
112			* @param string $file
113			*
114			* @return Composer
115			* @throws ErrorException
116			* @throws JsonException
117			*/
118			public function read(string $file): Composer
119			{
120			// Read file from string
121			if (!$source = file_get_contents($file)) {
122			throw new ErrorException('Provided file could not to be read');
123			}
124
125			// Convert JSON to array or throw JsonException
126			$array = $this->isJson($source);
127
128			// Initiate composer object
129			$this->composer = new Composer();
130
131			// Parse values
132			foreach ($array as $key => $value) {
133			$this->parseFields($key, $value);
134			}
135
136			return $this->composer;
137			}
138
139			/**
140			* Parse autoload parts of composer.json
141			*
142			* @param array $autoload
143			*
144			* @return array
145			*/
146			private function parseAutoload(array $autoload): array
147			{
148			$objects = [];
149
150			$methodsArray = [
151			'psr-0',
152			'psr-4',
153			'classmap',
154			'files'
155			];
156
157			foreach ($autoload as $type => $options) {
158			if (in_array($type, $methodsArray, true)) {
159			$class = 'ComposerJson\\Schemas\\' . $this->normalizeMethodName($type);
160			$object = new $class;
161
162			// Autoload object options
163			$object->options = $options;
164
165			// Save object
166			$objects[$type] = $object;
167			} else {
168			throw new InvalidArgumentException('Incorrect type of autoloader provided');
169			}
170			}
171
172			return $objects;
173			}
174
175			/**
176			* Convert array of repositories to array of repository objects
177			*
178			* @param array $repositories
179			*
180			* @return \ComposerJson\Schemas\Repository[]
181			*/
182			private function parseRepositories(array $repositories): array
183			{
184			$objects = [];
185			foreach ($repositories as $repository) {
186			$object = new Repository();
187
188			foreach ($repository as $key => $value) {
189
190			if ($key === 'packagist.org') {
191			$key = 'packagistOrg';
192			}
193
194			$object->$key = $value;
195			}
196
197			$objects[] = $object;
198			}
199
200			return $objects;
201			}
202
203			/**
204			* Convert support array to object of schema
205			*
206			* @param array $support
207			*
208			* @return \ComposerJson\Schemas\Support
209			*/
210			private function parseSupport(array $support): Support
211			{
212			$object = new Support();
213
214			foreach ($support as $key => $value) {
215			$object->$key = $value;
216			}
217
218			return $object;
219			}
220
221			/**
222			* Convert authors array to array of objects
223			*
224			* @param array $authors
225			*
226			* @return \ComposerJson\Schemas\Author[]
227			*/
228			private function parseAuthors(array $authors): array
229			{
230			$objects = [];
231			foreach ($authors as $author) {
232			$object = new Author();
233
234			foreach ($author as $key => $value) {
235			$object->$key = $value;
236			}
237
238			$objects[] = $object;
239			}
240
241			return $objects;
242			}
243			}
244

EvilFreelancer / composer-json-generator

Issues (12)

Security Analysis no request data

src/Generator.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like