GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (41)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

WorkflowExtensionsExtension.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * This file is part of the Global Trading Technologies Ltd workflow-extension-bundle package.
4
 *
5
 * For the full copyright and license information, please view the LICENSE
6
 * file that was distributed with this source code.
7
 *
8
 * (c) fduch <[email protected]>
9
 * @date 17.07.15
10
 */
11
12
namespace Gtt\Bundle\WorkflowExtensionsBundle\DependencyInjection;
13
14
use Gtt\Bundle\WorkflowExtensionsBundle\Action\Reference\ServiceMethod;
15
use Gtt\Bundle\WorkflowExtensionsBundle\Action\Reference\StaticMethod;
16
use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
17
use Symfony\Component\Config\FileLocator;
18
use Symfony\Component\Config\Loader\LoaderInterface;
19
use Symfony\Component\DependencyInjection\ContainerBuilder;
20
use Symfony\Component\DependencyInjection\Definition;
21
use Symfony\Component\DependencyInjection\DefinitionDecorator;
22
use Symfony\Component\DependencyInjection\Loader\XmlFileLoader;
23
use Symfony\Component\DependencyInjection\Reference;
24
use Symfony\Component\HttpKernel\DependencyInjection\Extension;
25
26
/**
27
 * Extension class for DI
28
 */
29
class WorkflowExtensionsExtension extends Extension
30
{
31
    /**
32
     * {@inheritdoc}
33
     */
34
    public function load(array $config, ContainerBuilder $container)
35
    {
36
        $configuration = $this->getConfiguration($config, $container);
37
        $config = $this->processConfiguration($configuration, $config);
0 ignored issues
show
$configuration is of type object|null, but the function expects a object<Symfony\Component...ConfigurationInterface>.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
38
        $loader = new XmlFileLoader($container, new FileLocator(__DIR__ . '/../Resources/config'));
39
40
        $loader->load('actions.xml');
41
42
        $this->registerSubjectManipulatorConfiguration($loader, $container, $config['subject_manipulator']);
43
44
        if (array_key_exists('workflows', $config)) {
45
            $this->registerWorkflowsConfiguration($loader, $container, $config['workflows']);
46
        }
47
48
        // if there are triggers with actions scheduling, register scheduler config
49
        if ($container->getParameter('gtt.workflow.workflows_with_scheduling')) {
50
            $this->registerSchedulerConfiguration($loader, $container, $config['scheduler']);
51
        } else {
52
            // remove scheduler listener if scheduler is not used
53
            $container->removeDefinition('gtt.workflow.trigger.event.listener.scheduler');
54
        }
55
56
        if (array_key_exists('actions', $config)) {
57
            $this->registerActionsConfiguration($config['actions'], $container);
58
        }
59
    }
60
61
    /**
62
     * Registers subject manipulator config
63
     *
64
     * @param LoaderInterface  $loader                   config loader
65
     * @param ContainerBuilder $container                container
66
     * @param array            $subjectManipulatorConfig subject manipulator config
67
     */
68
    private function registerSubjectManipulatorConfiguration(
69
        LoaderInterface $loader,
70
        ContainerBuilder $container,
71
        array $subjectManipulatorConfig)
72
    {
73
        $loader->load('subject_manipulator.xml');
74
75
        $subjectManipulatorDefinition = $container->findDefinition('gtt.workflow.subject_manipulator');
76
77
        $subjectClassesWithSubjectFromDomain = [];
78
        foreach ($subjectManipulatorConfig as $subjectClass => $subjectConfig) {
79
            $addSupportedSubjectArgs = [
80
                $subjectClass,
81
                $subjectConfig['id_from_subject']
82
            ];
83
84
            if (!empty($subjectConfig['subject_from_domain'])) {
85
                $subjectClassesWithSubjectFromDomain[] = $subjectClass;
86
                $addSupportedSubjectArgs[]             = $subjectConfig['subject_from_domain'];
87
            }
88
89
            $subjectManipulatorDefinition->addMethodCall('addSupportedSubject', $addSupportedSubjectArgs);
90
        }
91
92
        // parameter used to check that all the configs needed for scheduling are collected
93
        // see \Gtt\Bundle\WorkflowExtensionsBundle\DependencyInjection\Compiler\CheckSubjectManipulatorConfigPass
94
        $container->setParameter('gtt.workflow.subject_classes_with_subject_from_domain', $subjectClassesWithSubjectFromDomain);
95
    }
96
97
    /**
98
     * Registers workflows configuration section
99
     *
100
     * @param LoaderInterface  $loader          config loader
101
     * @param ContainerBuilder $container       container
102
     * @param array            $workflowsConfig workflows config
103
     */
104
    private function registerWorkflowsConfiguration(LoaderInterface $loader, ContainerBuilder $container, array $workflowsConfig)
105
    {
106
        $triggerConfigLoaded = false;
107
        $guardConfigLoaded   = false;
108
        foreach ($workflowsConfig as $workflowName => $workflowConfig) {
109
            if (!empty($workflowConfig['triggers'])) {
110
                if (!$triggerConfigLoaded) {
111
                    $loader->load('triggers.xml');
112
                    $triggerConfigLoaded = true;
113
                }
114
                $this->registerTriggerConfiguration($container, $workflowName, $workflowConfig['triggers']);
115
            }
116
            if (!empty($workflowConfig['guard'])) {
117
                if (!$guardConfigLoaded) {
118
                    $loader->load('guard.xml');
119
                    $guardConfigLoaded = true;
120
                }
121
                $this->registerGuardConfiguration($loader, $container, $workflowName, $workflowConfig['guard']);
122
            }
123
        }
124
    }
125
126
    /**
127
     * Adjusts trigger configurations
128
     *
129
     * @param ContainerBuilder $container       container
130
     * @param string           $workflowName    workflow name
131
     * @param array            $triggersConfig  triggers config
132
     */
133
    private function registerTriggerConfiguration(ContainerBuilder $container, $workflowName, array $triggersConfig)
134
    {
135
        $workflowsWithScheduling = [];
136
137
        $actionListenerDefinition     = $container->findDefinition('gtt.workflow.trigger.event.listener.action');
138
        $expressionListenerDefinition = $container->findDefinition('gtt.workflow.trigger.event.listener.expression');
139
        $schedulerListenerDefinition  = $container->findDefinition('gtt.workflow.trigger.event.listener.scheduler');
140
141
        foreach ($triggersConfig as $triggerType => $triggerConfig) {
142
            switch ($triggerType) {
143
                case 'event':
144
                    foreach ($triggerConfig as $eventName => $eventConfig) {
145
                        $registerTriggerEventArgs = [$eventName, $workflowName, $eventConfig['subject_retrieving_expression']];
146
147
                        if (!empty($eventConfig['actions'])) {
148
                            $this->registerTriggerEventForListener(
149
                                $actionListenerDefinition,
150
                                $eventName,
151
                                array_merge($registerTriggerEventArgs, [$eventConfig['actions']])
152
                            );
153
                        }
154
155
                        if (!empty($eventConfig['expression'])) {
156
                            $this->registerTriggerEventForListener(
157
                                $expressionListenerDefinition,
158
                                $eventName,
159
                                array_merge($registerTriggerEventArgs, [$eventConfig['expression']])
160
                            );
161
                        }
162
163
                        if (!empty($eventConfig['schedule'])) {
164
                            $this->registerTriggerEventForListener(
165
                                $schedulerListenerDefinition,
166
                                $eventName,
167
                                array_merge($registerTriggerEventArgs, [$eventConfig['schedule']])
168
                            );
169
170
                            if (!in_array($workflowName, $workflowsWithScheduling)) {
171
                                $workflowsWithScheduling[] = $workflowName;
172
                            }
173
                        }
174
                    }
175
176
                    break;
177
                default:
178
                    // should never happen
179
                    throw new InvalidConfigurationException(sprintf("Unknown trigger type %s", $triggerType));
180
            }
181
        }
182
183
        // parameter used to check that all the configs needed for scheduling are collected
184
        // see \Gtt\Bundle\WorkflowExtensionsBundle\DependencyInjection\Compiler\CheckSubjectManipulatorConfigPass
185
        $container->setParameter('gtt.workflow.workflows_with_scheduling', $workflowsWithScheduling);
186
    }
187
188
    /**
189
     * Configures event listener with particular event and arguments
190
     *
191
     * @param Definition $listenerDefinition listener definition
192
     * @param string     $eventName          event name
193
     * @param array      $arguments          arguments for event handling
194
     */
195
    private function registerTriggerEventForListener(Definition $listenerDefinition, $eventName, array $arguments)
196
    {
197
        $listenerDefinition->addMethodCall('registerEvent', $arguments);
198
        $listenerDefinition->addTag('kernel.event_listener', ['event' => $eventName, 'method' => 'dispatchEvent']);
199
    }
200
201
    /**
202
     * Adjusts scheduler configurations
203
     *
204
     * @param LoaderInterface  $loader          config loader
205
     * @param ContainerBuilder $container       container
206
     * @param array            $schedulerConfig scheduler config
207
     */
208
    private function registerSchedulerConfiguration(LoaderInterface $loader, ContainerBuilder $container, array $schedulerConfig)
209
    {
210
        if (!$schedulerConfig) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $schedulerConfig of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using empty($expr) instead to make it clear that you intend to check for an array without elements.

This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.

Consider making the comparison explicit by using empty(..) or ! empty(...) instead.

Loading history...
211
            throw new InvalidConfigurationException('"scheduler" section must be configured');
212
        }
213
214
        $loader->load("scheduler.xml");
215
216
        $schedulerDefinition      = $container->findDefinition('gtt.workflow.action_scheduler');
217
        $schedulerEntityManagerId = sprintf('doctrine.orm.%s_entity_manager', $schedulerConfig['entity_manager']);
218
219
        $schedulerDefinition->replaceArgument(0, new Reference($schedulerEntityManagerId));
220
    }
221
222
    /**
223
     * Adjusts guard configurations
224
     *
225
     * @param LoaderInterface  $loader       config loader
226
     * @param ContainerBuilder $container    container
227
     * @param string           $workflowName workflow name
228
     * @param array            $guardConfig  workflow trigger config
229
     */
230
    private function registerGuardConfiguration(LoaderInterface $loader, ContainerBuilder $container, $workflowName, $guardConfig)
231
    {
232
        $loader->load('guard.xml');
233
234
        $guardDefinition = $container->findDefinition('gtt.workflow.guard');
235
236
        if (isset($guardConfig['expression'])) {
237
            // register workflow-level guard
238
            $eventName = sprintf('workflow.%s.guard', $workflowName);
239
            $this->registerGuardListener($guardDefinition, $eventName, $workflowName, $guardConfig['expression']);
240
        }
241
242
        foreach ($guardConfig['transitions'] as $transition => $transitionConfig) {
243
            // register transition-level guard
244
            $eventName = sprintf('workflow.%s.guard.%s', $workflowName, $transition);
245
            $this->registerGuardListener($guardDefinition, $eventName, $workflowName, $transitionConfig['expression']);
246
        }
247
    }
248
249
    /**
250
     * Registers expression listener for guard event
251
     *
252
     * @param Definition $guardDefinition guard service definition
253
     * @param string     $eventName       event name
254
     * @param string     $workflowName    workflow name
255
     * @param string     $expression      guard expression
256
     */
257
    private function registerGuardListener($guardDefinition, $eventName, $workflowName, $expression)
258
    {
259
        $guardDefinition->addMethodCall('registerGuardExpression', [$eventName, $workflowName, $expression]);
260
        $guardDefinition->addTag('kernel.event_listener', ['event' => $eventName, 'method' => 'guardTransition']);
261
    }
262
263
    /**
264
     * Register configuration for actions section
265
     *
266
     * @param array            $actionConfigs actions config
267
     * @param ContainerBuilder $container     container
268
     */
269
    private function registerActionsConfiguration(array $actionConfigs, ContainerBuilder $container)
270
    {
271
        $registryDefinition = $container->findDefinition('gtt.workflow.action.registry');
272
273
        foreach ($actionConfigs as $actionName => $actionConfig) {
274
            // here we explicitly set parent class to decorated definition in order to fix inconsistent behavior for <= 2.7
275
            // see https://github.com/symfony/symfony/issues/17353 and https://github.com/symfony/symfony/pull/15096
276
            if (array_key_exists('service', $actionConfig)) {
277
                $actionReferenceDefinition = new DefinitionDecorator('gtt.workflow.action.service_method.reference.prototype');
278
                $actionReferenceDefinition->setClass(ServiceMethod::class);
279
                $actionReferenceDefinition->setArguments([$actionConfig['method'], $actionConfig['service'], $actionConfig['type']]);
280
            } else {
281
                $actionReferenceDefinition = new DefinitionDecorator('gtt.workflow.action.static_method.reference.prototype');
282
                $actionReferenceDefinition->setClass(StaticMethod::class);
283
                $actionReferenceDefinition->setArguments([$actionConfig['method'], $actionConfig['class'], $actionConfig['type']]);
284
            }
285
286
            $registryDefinition->addMethodCall('add', [$actionName, $actionReferenceDefinition]);
287
        }
288
    }
289
}