This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | namespace Germania\TwigRequestHandler; |
||
3 | |||
4 | use Psr\Http\Message\ServerRequestInterface; |
||
5 | use Psr\Http\Message\ResponseInterface; |
||
6 | use Psr\Http\Message\ResponseFactoryInterface; |
||
7 | use Psr\Http\Server\RequestHandlerInterface; |
||
8 | use Twig\Environment as TwigEnvironment; |
||
9 | |||
10 | class TwigRequestHandler implements RequestHandlerInterface |
||
11 | { |
||
12 | |||
13 | /** |
||
14 | * @var ResponseFactoryInterface |
||
15 | */ |
||
16 | public $response_factory; |
||
17 | |||
18 | |||
19 | /** |
||
20 | * @var TwigEnvironment|null |
||
21 | */ |
||
22 | public $twig; |
||
23 | |||
24 | |||
25 | /** |
||
26 | * Default response status code |
||
27 | * @var integer |
||
28 | */ |
||
29 | public $response_status_code = 200; |
||
30 | |||
31 | |||
32 | /** |
||
33 | * Default response content type |
||
34 | * @var integer |
||
35 | */ |
||
36 | public $response_content_type = "text/html"; |
||
37 | |||
38 | |||
39 | /** |
||
40 | * Request attribute name for the Twig template |
||
41 | * @var string |
||
42 | */ |
||
43 | public $template_attribute_name = 'template'; |
||
44 | |||
45 | |||
46 | /** |
||
47 | * Request attribute name for the Twig template context variables |
||
48 | * @var string |
||
49 | */ |
||
50 | public $context_attribute_name = 'context'; |
||
51 | |||
52 | |||
53 | /** |
||
54 | * @param TwigEnvironment $twig Twig Environment |
||
55 | * @param ResponseFactoryInterface $response_factory PSR-17 Response Factory |
||
56 | */ |
||
57 | 2 | public function __construct(TwigEnvironment $twig, ResponseFactoryInterface $response_factory) |
|
58 | { |
||
59 | 2 | $this->setTwig($twig); |
|
60 | 2 | $this->setResponseFactory($response_factory); |
|
61 | 2 | } |
|
62 | |||
63 | |||
64 | |||
65 | /** |
||
66 | * @inheritDoc |
||
67 | */ |
||
68 | 14 | public function handle(ServerRequestInterface $request) : ResponseInterface |
|
69 | { |
||
70 | 14 | $context = $request->getAttribute($this->context_attribute_name, null); |
|
71 | |||
72 | 14 | if ($context instanceOf \ArrayObject) { |
|
73 | $context = $context->getArrayCopy(); |
||
74 | } |
||
75 | |||
76 | 14 | if (!is_array($context)) { |
|
77 | 6 | $context_type = is_object($context) ? get_class($context) : gettype($context); |
|
78 | 6 | $msg = sprintf( |
|
79 | 6 | "Expected Request attribute '%s' to be array or ArrayObject, got '%s'.", |
|
80 | 6 | $this->context_attribute_name, |
|
81 | $context_type |
||
82 | ); |
||
83 | 6 | throw new \RuntimeException($msg); |
|
84 | } |
||
85 | |||
86 | 8 | $template = $request->getAttribute($this->template_attribute_name, null); |
|
87 | 8 | if (!is_string($template) or empty($template)) { |
|
88 | 6 | $msg = sprintf( |
|
89 | 6 | "Expected Request attribute '%s' to be non-empty string, got '%s'.", |
|
90 | 6 | $this->template_attribute_name, |
|
91 | 6 | gettype($template) |
|
92 | ); |
||
93 | 6 | throw new \RuntimeException($msg); |
|
94 | } |
||
95 | |||
96 | |||
97 | 2 | $html = $this->twig->render($template, $context); |
|
98 | |||
99 | 2 | $response = $this->response_factory |
|
100 | 2 | ->createResponse($this->response_status_code) |
|
101 | 2 | ->withHeader('Content-Type', $this->response_content_type); |
|
102 | |||
103 | 2 | $response->getBody()->write($html); |
|
104 | |||
105 | 2 | return $response; |
|
106 | } |
||
107 | |||
108 | |||
109 | |||
110 | /** |
||
111 | * Sets the Twig Environment. |
||
112 | * |
||
113 | * @param TwigEnvironment $twig |
||
114 | */ |
||
115 | 18 | public function setTwig(TwigEnvironment $twig) : self |
|
116 | { |
||
117 | 18 | $this->twig = $twig; |
|
118 | 18 | return $this; |
|
119 | } |
||
120 | |||
121 | |||
122 | /** |
||
123 | * Sets the Response Factory. |
||
124 | * |
||
125 | * @param ResponseFactoryInterface $response_factory PSR-17 ResponseFactory |
||
126 | */ |
||
127 | 4 | public function setResponseFactory(ResponseFactoryInterface $response_factory) : self |
|
128 | { |
||
129 | 4 | $this->response_factory = $response_factory; |
|
130 | 4 | return $this; |
|
131 | } |
||
132 | |||
133 | |||
134 | /** |
||
135 | * Sets the Status code for generated response. |
||
136 | * |
||
137 | * @param int $response_status_code HTTP Status Code |
||
138 | */ |
||
139 | 4 | public function setResponseStatusCode(int $response_status_code) : self |
|
140 | { |
||
141 | 4 | $this->response_status_code = $response_status_code; |
|
142 | 4 | return $this; |
|
143 | } |
||
144 | |||
145 | |||
146 | /** |
||
147 | * Sets the content-type for generated response. |
||
148 | * |
||
149 | * @param string $response_content_type Response Content-type |
||
150 | */ |
||
151 | 4 | public function setResponseContentType(string $response_content_type) : self |
|
152 | { |
||
153 | 4 | $this->response_content_type = $response_content_type; |
|
0 ignored issues
–
show
|
|||
154 | 4 | return $this; |
|
155 | } |
||
156 | |||
157 | |||
158 | /** |
||
159 | * Sets the request attribute that carries the template. |
||
160 | * |
||
161 | * @param string $attr Request attribute name |
||
162 | */ |
||
163 | 16 | public function setTemplateAttributeName(string $attr) : self |
|
164 | { |
||
165 | 16 | $this->template_attribute_name = $attr; |
|
166 | 16 | return $this; |
|
167 | } |
||
168 | |||
169 | |||
170 | /** |
||
171 | * Sets the request attribute that carries the context array. |
||
172 | * |
||
173 | * @param string $attr Request attribute name |
||
174 | */ |
||
175 | 16 | public function setContextAttributeName(string $attr) : self |
|
176 | { |
||
177 | 16 | $this->context_attribute_name = $attr; |
|
178 | 16 | return $this; |
|
179 | } |
||
180 | } |
||
181 |
This check looks for assignments to scalar types that may be of the wrong type.
To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.