Issues (566)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

ufpdf/ufpdf.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/*******************************************************************************
3
* Software: UFPDF, Unicode Free PDF generator                                  *
4
* Version:  0.1                                                                *
5
*           based on FPDF 1.52 by Olivier PLATHEY                              *
6
* Date:     2004-09-01                                                         *
7
* Author:   Steven Wittens <[email protected]>                                   *
8
* License:  GPL                                                                *
9
*                                                                              *
10
* UFPDF is a modification of FPDF to support Unicode through UTF-8.            *
11
*                                                                              *
12
*******************************************************************************/
13
14
15
class UFPDF extends FPDF
0 ignored issues
show
Coding Style Compatibility introduced by
PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions.

You can fix this by adding a namespace to your class:

namespace YourVendor;

class YourClass { }

When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.

Loading history...
16
{
17
18
/*******************************************************************************
19
*                                                                              *
20
*                               Public methods                                 *
21
*                                                                              *
22
*******************************************************************************/
23
function UFPDF($orientation='P',$unit='mm',$format='A4')
24
{
25
  FPDF::FPDF($orientation, $unit, $format);
26
  define('FPDF_FONTPATH',dirname(__FILE__).'/font/');
27
}
28
29
function GetStringWidth($s)
30
{
31
  //Get width of a string in the current font
32
  $s = (string)$s;
33
  $codepoints=$this->utf8_to_codepoints($s);
34
  $cw=&$this->CurrentFont['cw'];
35
  $w=0;
36
  foreach($codepoints as $cp)
37
    $w+=$cw[$cp];
38
  return $w*$this->FontSize/1000;
39
}
40
41
function AddFont($family,$style='',$file='')
42
{
43
  //Add a TrueType or Type1 font
44
  $family=strtolower($family);
45
  if($family=='arial')
46
    $family='helvetica';
47
  $style=strtoupper($style);
48
  if($style=='IB')
49
    $style='BI';
50
  if(isset($this->fonts[$family.$style]))
51
    $this->Error('Font already added: '.$family.' '.$style);
52 View Code Duplication
  if($file=='')
53
    $file=str_replace(' ','',$family).strtolower($style).'.php';
54
  if(defined('FPDF_FONTPATH'))
55
    $file=FPDF_FONTPATH.$file;
56
  include($file);
57
  if(!isset($name))
58
    $this->Error('Could not include font definition file');
59
  $i=count($this->fonts)+1;
60
  $this->fonts[$family.$style]=array('i'=>$i,'type'=>$type,'name'=>$name,'desc'=>$desc,'up'=>$up,'ut'=>$ut,'cw'=>$cw,'file'=>$file,'ctg'=>$ctg);
61
  if($file)
62
  {
63
    if($type=='TrueTypeUnicode')
64
      $this->FontFiles[$file]=array('length1'=>$originalsize);
65
    else
66
      $this->FontFiles[$file]=array('length1'=>$size1,'length2'=>$size2);
67
  }
68
}
69
70 View Code Duplication
function Text($x,$y,$txt)
71
{
72
  //Output a string
73
  $s=sprintf('BT %.2f %.2f Td %s Tj ET',$x*$this->k,($this->h-$y)*$this->k,$this->_escapetext($txt));
74
  if($this->underline and $txt!='')
75
    $s.=' '.$this->_dounderline($x,$y,$this->GetStringWidth($txt),$txt);
76
  if($this->ColorFlag)
77
    $s='q '.$this->TextColor.' '.$s.' Q';
78
  $this->_out($s);
79
}
80
81
function AcceptPageBreak()
82
{
83
  //Accept automatic page break or not
84
  return $this->AutoPageBreak;
85
}
86
87
function Cell($w,$h=0,$txt='',$border=0,$ln=0,$align='',$fill=0,$link='')
88
{
89
  //Output a cell
90
  $k=$this->k;
91
  if($this->y+$h>$this->PageBreakTrigger and !$this->InFooter and $this->AcceptPageBreak())
92
  {
93
    //Automatic page break
94
    $x=$this->x;
95
    $ws=$this->ws;
96
    if($ws>0)
97
    {
98
      $this->ws=0;
99
      $this->_out('0 Tw');
100
    }
101
    $this->AddPage($this->CurOrientation);
102
    $this->x=$x;
103 View Code Duplication
    if($ws>0)
104
    {
105
      $this->ws=$ws;
106
      $this->_out(sprintf('%.3f Tw',$ws*$k));
107
    }
108
  }
109
  if($w==0)
110
    $w=$this->w-$this->rMargin-$this->x;
111
  $s='';
112
  if($fill==1 or $border==1)
113
  {
114
    if($fill==1)
115
      $op=($border==1) ? 'B' : 'f';
116
    else
117
      $op='S';
118
    $s=sprintf('%.2f %.2f %.2f %.2f re %s ',$this->x*$k,($this->h-$this->y)*$k,$w*$k,-$h*$k,$op);
119
  }
120
  if(is_string($border))
121
  {
122
    $x=$this->x;
123
    $y=$this->y;
124 View Code Duplication
    if(is_int(strpos($border,'L')))
125
      $s.=sprintf('%.2f %.2f m %.2f %.2f l S ',$x*$k,($this->h-$y)*$k,$x*$k,($this->h-($y+$h))*$k);
126 View Code Duplication
    if(is_int(strpos($border,'T')))
127
      $s.=sprintf('%.2f %.2f m %.2f %.2f l S ',$x*$k,($this->h-$y)*$k,($x+$w)*$k,($this->h-$y)*$k);
128 View Code Duplication
    if(is_int(strpos($border,'R')))
129
      $s.=sprintf('%.2f %.2f m %.2f %.2f l S ',($x+$w)*$k,($this->h-$y)*$k,($x+$w)*$k,($this->h-($y+$h))*$k);
130 View Code Duplication
    if(is_int(strpos($border,'B')))
131
      $s.=sprintf('%.2f %.2f m %.2f %.2f l S ',$x*$k,($this->h-($y+$h))*$k,($x+$w)*$k,($this->h-($y+$h))*$k);
132
  }
133
  if($txt!='')
134
  {
135
    $width = $this->GetStringWidth($txt);
136 View Code Duplication
    if($align=='R')
137
      $dx=$w-$this->cMargin-$width;
138
    elseif($align=='C')
139
      $dx=($w-$width)/2;
140
    else
141
      $dx=$this->cMargin;
142
    if($this->ColorFlag)
143
      $s.='q '.$this->TextColor.' ';
144
    $txtstring=$this->_escapetext($txt);
145
    $s.=sprintf('BT %.2f %.2f Td %s Tj ET',($this->x+$dx)*$k,($this->h-($this->y+.5*$h+.3*$this->FontSize))*$k,$txtstring);
146 View Code Duplication
    if($this->underline)
147
      $s.=' '.$this->_dounderline($this->x+$dx,$this->y+.5*$h+.3*$this->FontSize,$width,$txt);
148
    if($this->ColorFlag)
149
      $s.=' Q';
150 View Code Duplication
    if($link)
151
      $this->Link($this->x+$dx,$this->y+.5*$h-.5*$this->FontSize,$width,$this->FontSize,$link);
152
  }
153
  if($s)
154
    $this->_out($s);
155
  $this->lasth=$h;
156 View Code Duplication
  if($ln>0)
157
  {
158
    //Go to next line
159
    $this->y+=$h;
160
    if($ln==1)
161
      $this->x=$this->lMargin;
162
  }
163
  else
164
    $this->x+=$w;
165
}
166
167
/*******************************************************************************
168
*                                                                              *
169
*                              Protected methods                               *
170
*                                                                              *
171
*******************************************************************************/
172
173
function _puttruetypeunicode($font) {
174
  //Type0 Font
175
  $this->_newobj();
176
  $this->_out('<</Type /Font');
177
  $this->_out('/Subtype /Type0');
178
  $this->_out('/BaseFont /'. $font['name'] .'-UCS');
179
  $this->_out('/Encoding /Identity-H');
180
  $this->_out('/DescendantFonts ['. ($this->n + 1) .' 0 R]');
181
  $this->_out('>>');
182
  $this->_out('endobj');
183
184
  //CIDFont
185
  $this->_newobj();
186
  $this->_out('<</Type /Font');
187
  $this->_out('/Subtype /CIDFontType2');
188
  $this->_out('/BaseFont /'. $font['name']);
189
  $this->_out('/CIDSystemInfo <</Registry (Adobe) /Ordering (UCS) /Supplement 0>>');
190
  $this->_out('/FontDescriptor '. ($this->n + 1) .' 0 R');
191
  $c = 0;
192
  foreach ($font['cw'] as $i => $w) {
193
    $widths .= $i .' ['. $w.'] ';
194
  }
195
  $this->_out('/W ['. $widths .']');
196
  $this->_out('/CIDToGIDMap '. ($this->n + 2) .' 0 R');
197
  $this->_out('>>');
198
  $this->_out('endobj');
199
200
  //Font descriptor
201
  $this->_newobj();
202
  $this->_out('<</Type /FontDescriptor');
203
  $this->_out('/FontName /'.$font['name']);
204
  foreach ($font['desc'] as $k => $v) {
205
    $s .= ' /'. $k .' '. $v;
206
  }
207
  if ($font['file']) {
208
		$s .= ' /FontFile2 '. $this->FontFiles[$font['file']]['n'] .' 0 R';
209
  }
210
  $this->_out($s);
211
  $this->_out('>>');
212
  $this->_out('endobj');
213
214
  //Embed CIDToGIDMap
215
  $this->_newobj();
216
  if(defined('FPDF_FONTPATH'))
217
    $file=FPDF_FONTPATH.$font['ctg'];
218
  else
219
    $file=$font['ctg'];
220
  $size=filesize($file);
221
  if(!$size)
222
    $this->Error('Font file not found');
223
  $this->_out('<</Length '.$size);
224
	if(substr($file,-2) == '.z')
225
    $this->_out('/Filter /FlateDecode');
226
  $this->_out('>>');
227
  $f = fopen($file,'rb');
228
  $this->_putstream(fread($f,$size));
229
  fclose($f);
230
  $this->_out('endobj');
231
}
232
233 View Code Duplication
function _dounderline($x,$y,$width,$txt)
234
{
235
  //Underline text
236
  $up=$this->CurrentFont['up'];
237
  $ut=$this->CurrentFont['ut'];
238
  $w=$width+$this->ws*substr_count($txt,' ');
239
  return sprintf('%.2f %.2f %.2f %.2f re f',$x*$this->k,($this->h-($y-$up/1000*$this->FontSize))*$this->k,$w*$this->k,-$ut/1000*$this->FontSizePt);
240
}
241
242 View Code Duplication
function _textstring($s)
243
{
244
  //Convert to UTF-16BE
245
  $s = $this->utf8_to_utf16be($s);
246
  //Escape necessary characters
247
  return '('. strtr($s, array(')' => '\\)', '(' => '\\(', '\\' => '\\\\')) .')';
248
}
249
250 View Code Duplication
function _escapetext($s)
251
{
252
  //Convert to UTF-16BE
253
  $s = $this->utf8_to_utf16be($s, false);
254
  //Escape necessary characters
255
  return '('. strtr($s, array(')' => '\\)', '(' => '\\(', '\\' => '\\\\')) .')';
256
}
257
258
function _putinfo()
259
{
260
	$this->_out('/Producer '.$this->_textstring('UFPDF '. UFPDF_VERSION));
261
	if(!empty($this->title))
262
		$this->_out('/Title '.$this->_textstring($this->title));
263
	if(!empty($this->subject))
264
		$this->_out('/Subject '.$this->_textstring($this->subject));
265
	if(!empty($this->author))
266
		$this->_out('/Author '.$this->_textstring($this->author));
267
	if(!empty($this->keywords))
268
		$this->_out('/Keywords '.$this->_textstring($this->keywords));
269
	if(!empty($this->creator))
270
		$this->_out('/Creator '.$this->_textstring($this->creator));
271
	$this->_out('/CreationDate '.$this->_textstring('D:'.date('YmdHis')));
272
}
273
274
// UTF-8 to UTF-16BE conversion.
275
// Correctly handles all illegal UTF-8 sequences.
276
function utf8_to_utf16be(&$txt, $bom = true) {
277
  $l = strlen($txt);
278
  $out = $bom ? "\xFE\xFF" : '';
279
  for ($i = 0; $i < $l; ++$i) {
280
    $c = ord($txt{$i});
281
    // ASCII
282
    if ($c < 0x80) {
283
      $out .= "\x00". $txt{$i};
284
    }
285
    // Lost continuation byte
286
    else if ($c < 0xC0) {
287
      $out .= "\xFF\xFD";
288
      continue;
289
    }
290
    // Multibyte sequence leading byte
291
    else {
292 View Code Duplication
      if ($c < 0xE0) {
293
        $s = 2;
294
      }
295
      else if ($c < 0xF0) {
296
        $s = 3;
297
      }
298
      else if ($c < 0xF8) {
299
        $s = 4;
300
      }
301
      // 5/6 byte sequences not possible for Unicode.
302
      else {
303
        $out .= "\xFF\xFD";
304
        while (ord($txt{$i + 1}) >= 0x80 && ord($txt{$i + 1}) < 0xC0) { ++$i; }
305
        continue;
306
      }
307
308
      $q = array($c);
309
      // Fetch rest of sequence
310 View Code Duplication
      while (ord($txt{$i + 1}) >= 0x80 && ord($txt{$i + 1}) < 0xC0) { ++$i; $q[] = ord($txt{$i}); }
311
312
      // Check length
313
      if (count($q) != $s) {
314
        $out .= "\xFF\xFD";
315
        continue;
316
      }
317
318
      switch ($s) {
319
        case 2:
320
          $cp = (($q[0] ^ 0xC0) << 6) | ($q[1] ^ 0x80);
321
          // Overlong sequence
322 View Code Duplication
          if ($cp < 0x80) {
323
            $out .= "\xFF\xFD";
324
          }
325
          else {
326
            $out .= chr($cp >> 8);
327
            $out .= chr($cp & 0xFF);
328
          }
329
          continue;
330
331
        case 3:
332
          $cp = (($q[0] ^ 0xE0) << 12) | (($q[1] ^ 0x80) << 6) | ($q[2] ^ 0x80);
333
          // Overlong sequence
334
          if ($cp < 0x800) {
335
            $out .= "\xFF\xFD";
336
          }
337
          // Check for UTF-8 encoded surrogates (caused by a bad UTF-8 encoder)
338 View Code Duplication
          else if ($c > 0xD800 && $c < 0xDFFF) {
339
            $out .= "\xFF\xFD";
340
          }
341
          else {
342
            $out .= chr($cp >> 8);
343
            $out .= chr($cp & 0xFF);
344
          }
345
          continue;
346
347
        case 4:
348
          $cp = (($q[0] ^ 0xF0) << 18) | (($q[1] ^ 0x80) << 12) | (($q[2] ^ 0x80) << 6) | ($q[3] ^ 0x80);
349
          // Overlong sequence
350
          if ($cp < 0x10000) {
351
            $out .= "\xFF\xFD";
352
          }
353
          // Outside of the Unicode range
354
          else if ($cp >= 0x10FFFF) {
355
            $out .= "\xFF\xFD";
356
          }
357
          else {
358
            // Use surrogates
359
            $cp -= 0x10000;
360
            $s1 = 0xD800 | ($cp >> 10);
361
            $s2 = 0xDC00 | ($cp & 0x3FF);
362
363
            $out .= chr($s1 >> 8);
364
            $out .= chr($s1 & 0xFF);
365
            $out .= chr($s2 >> 8);
366
            $out .= chr($s2 & 0xFF);
367
          }
368
          continue;
369
      }
370
    }
371
  }
372
  return $out;
373
}
374
375
// UTF-8 to codepoint array conversion.
376
// Correctly handles all illegal UTF-8 sequences.
377
function utf8_to_codepoints(&$txt) {
378
  $l = strlen($txt);
379
  $out = array();
380
  for ($i = 0; $i < $l; ++$i) {
381
    $c = ord($txt{$i});
382
    // ASCII
383
    if ($c < 0x80) {
384
      $out[] = ord($txt{$i});
385
    }
386
    // Lost continuation byte
387
    else if ($c < 0xC0) {
388
      $out[] = 0xFFFD;
389
      continue;
390
    }
391
    // Multibyte sequence leading byte
392
    else {
393 View Code Duplication
      if ($c < 0xE0) {
394
        $s = 2;
395
      }
396
      else if ($c < 0xF0) {
397
        $s = 3;
398
      }
399
      else if ($c < 0xF8) {
400
        $s = 4;
401
      }
402
      // 5/6 byte sequences not possible for Unicode.
403
      else {
404
        $out[] = 0xFFFD;
405
        while (ord($txt{$i + 1}) >= 0x80 && ord($txt{$i + 1}) < 0xC0) { ++$i; }
406
        continue;
407
      }
408
409
      $q = array($c);
410
      // Fetch rest of sequence
411 View Code Duplication
      while (ord($txt{$i + 1}) >= 0x80 && ord($txt{$i + 1}) < 0xC0) { ++$i; $q[] = ord($txt{$i}); }
412
413
      // Check length
414
      if (count($q) != $s) {
415
        $out[] = 0xFFFD;
416
        continue;
417
      }
418
419
      switch ($s) {
420
        case 2:
421
          $cp = (($q[0] ^ 0xC0) << 6) | ($q[1] ^ 0x80);
422
          // Overlong sequence
423
          if ($cp < 0x80) {
424
            $out[] = 0xFFFD;
425
          }
426
          else {
427
            $out[] = $cp;
428
          }
429
          continue;
430
431
        case 3:
432
          $cp = (($q[0] ^ 0xE0) << 12) | (($q[1] ^ 0x80) << 6) | ($q[2] ^ 0x80);
433
          // Overlong sequence
434 View Code Duplication
          if ($cp < 0x800) {
435
            $out[] = 0xFFFD;
436
          }
437
          // Check for UTF-8 encoded surrogates (caused by a bad UTF-8 encoder)
438
          else if ($c > 0xD800 && $c < 0xDFFF) {
439
            $out[] = 0xFFFD;
440
          }
441
          else {
442
            $out[] = $cp;
443
          }
444
          continue;
445
446
        case 4:
447
          $cp = (($q[0] ^ 0xF0) << 18) | (($q[1] ^ 0x80) << 12) | (($q[2] ^ 0x80) << 6) | ($q[3] ^ 0x80);
448
          // Overlong sequence
449 View Code Duplication
          if ($cp < 0x10000) {
450
            $out[] = 0xFFFD;
451
          }
452
          // Outside of the Unicode range
453
          else if ($cp >= 0x10FFFF) {
454
            $out[] = 0xFFFD;
455
          }
456
          else {
457
            $out[] = $cp;
458
          }
459
          continue;
460
      }
461
    }
462
  }
463
  return $out;
464
}
465
466
//End of class
467
}
468
?>
469