cat_socket() - Code Metrics - Inspection of "Ansible playbook for Managed SP" - GEANT/CAT - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( 034956...2b8b29 )

by Maja

created 2020-04-28 19:09 UTC

cat_socket() A

↳ Parent: Project

Complexity

Conditions	2
Paths	2

Size

Total Lines	9
Code Lines	7

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

Metric	Value
cc	2
eloc	7
c	1
b	0
f	0
nc	2
nop	1
dl	0
loc	9
rs	10

<?php
define('SOCKET', '/opt/Socket/CAT_requests/queue');
define('OPNAME_PREFIX', '1hostspot-');
define('OPNAME_SUFFIX', '.hosted.eduroam.org');

function cat_socket($obj) {
   $sock = socket_create(AF_UNIX, SOCK_STREAM, 0);
   $conn = socket_connect($sock, SOCKET);
   if ( $conn ) {
     socket_write ($sock, $obj, strlen($obj));
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
     $out = socket_read ($sock, 2048);
     return $out;
   }
   return 'FAILURE';
}


Push — master ( 034956...2b8b29 )

cat_socket() A

Complexity

Size

Duplication

Importance

7 paths for user data to reach this point

General Strategies to prevent injection

1			<?php
2			define('SOCKET', '/opt/Socket/CAT_requests/queue');
3			define('OPNAME_PREFIX', '1hostspot-');
4			define('OPNAME_SUFFIX', '.hosted.eduroam.org');
5
6			function cat_socket($obj) {
7			$sock = socket_create(AF_UNIX, SOCK_STREAM, 0);
8			$conn = socket_connect($sock, SOCKET);
9			if ( $conn ) {
10			socket_write ($sock, $obj, strlen($obj));
			0 ignored issues – show Security Header Injection introduced 2020-04-28 19:26 UTC by Report Bug Copy Issue Report `$obj` can contain request data and is used in request header context(s) leading to a potential security vulnerability. 7 paths for user data to reach this point 1. Path: Read from `$_REQUEST` in ansible/ManagedSP/templates/web/index.php on line 26 Read from `$_REQUEST` in ansible/ManagedSP/templates/web/index.php on line 26 Data is passed through `implode()`, and `cat_socket()` is called in ansible/ManagedSP/templates/web/index.php on line 25 Enters via parameter `$obj` in ansible/ManagedSP/templates/web/lib.inc on line 6 2. Path: Read from `$_REQUEST,` and Data is passed through `implode()`, and `cat_socket()` is called in ansible/ManagedSP/templates/web/index.php on line 25 Read from `$_REQUEST,` and Data is passed through `implode()`, and `cat_socket()` is called in ansible/ManagedSP/templates/web/index.php on line 25 Enters via parameter `$obj` in ansible/ManagedSP/templates/web/lib.inc on line 6 3. Path: Read from `$_REQUEST` in ansible/ManagedSP/templates/web/index.php on line 27 Read from `$_REQUEST` in ansible/ManagedSP/templates/web/index.php on line 27 Data is passed through `implode()`, and `cat_socket()` is called in ansible/ManagedSP/templates/web/index.php on line 25 Enters via parameter `$obj` in ansible/ManagedSP/templates/web/lib.inc on line 6 4. Path: Read from `$_REQUEST,` and Data is passed through `trim()`, and `trim($_REQUEST['operatorname'])` is assigned to `$opn` in ansible/ManagedSP/templates/web/index.php on line 15 Read from `$_REQUEST,` and Data is passed through `trim()`, and `trim($_REQUEST['operatorname'])` is assigned to `$opn` in ansible/ManagedSP/templates/web/index.php on line 15 Data is passed through `base64_encode()` in ansible/ManagedSP/templates/web/index.php on line 29 Data is passed through `implode()`, and `cat_socket()` is called in ansible/ManagedSP/templates/web/index.php on line 25 Enters via parameter `$obj` in ansible/ManagedSP/templates/web/lib.inc on line 6 5. Path: Read from `$_REQUEST,` and Data is passed through `base64_encode()` in ansible/ManagedSP/templates/web/index.php on line 28 Read from `$_REQUEST,` and Data is passed through `base64_encode()` in ansible/ManagedSP/templates/web/index.php on line 28 Data is passed through `implode()`, and `cat_socket()` is called in ansible/ManagedSP/templates/web/index.php on line 25 Enters via parameter `$obj` in ansible/ManagedSP/templates/web/lib.inc on line 6 6. Path: Read from `$_REQUEST,` and Data is passed through `trim()`, and `OPNAME_PREFIX . trim($_REQUEST['instid']) . '-' . trim($_REQUEST['deploymentid']) . OPNAME_SUFFIX` is assigned to `$opn` in ansible/ManagedSP/templates/web/index.php on line 17 Read from `$_REQUEST,` and Data is passed through `trim()`, and `OPNAME_PREFIX . trim($_REQUEST['instid']) . '-' . trim($_REQUEST['deploymentid']) . OPNAME_SUFFIX` is assigned to `$opn` in ansible/ManagedSP/templates/web/index.php on line 17 Data is passed through `base64_encode()` in ansible/ManagedSP/templates/web/index.php on line 29 Data is passed through `implode()`, and `cat_socket()` is called in ansible/ManagedSP/templates/web/index.php on line 25 Enters via parameter `$obj` in ansible/ManagedSP/templates/web/lib.inc on line 6 7. Path: Read from `$_REQUEST,` and `$_REQUEST['vlan'] . '#' . implode('#', $_REQUEST['realmforvlan'])` is assigned to `$vlans` in ansible/ManagedSP/templates/web/index.php on line 21 Read from `$_REQUEST,` and `$_REQUEST['vlan'] . '#' . implode('#', $_REQUEST['realmforvlan'])` is assigned to `$vlans` in ansible/ManagedSP/templates/web/index.php on line 21 Data is passed through `base64_encode()` in ansible/ManagedSP/templates/web/index.php on line 30 Data is passed through `implode()`, and `cat_socket()` is called in ansible/ManagedSP/templates/web/index.php on line 25 Enters via parameter `$obj` in ansible/ManagedSP/templates/web/lib.inc on line 6 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
11			$out = socket_read ($sock, 2048);
12			return $out;
13			}
14			return 'FAILURE';
15			}
16

GEANT / CAT

Push — master ( 034956...2b8b29 )

cat_socket() A

Complexity

Size

Duplication

Importance

7 paths for user data to reach this point

General Strategies to prevent injection

Duplication Side-by-Side

Filter issues like