This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * This file is part of the Global Trading Technologies Ltd workflow-extension-bundle package. |
||
4 | * |
||
5 | * For the full copyright and license information, please view the LICENSE |
||
6 | * file that was distributed with this source code. |
||
7 | * |
||
8 | * (c) fduch <[email protected]> |
||
9 | * @date 14.07.16 |
||
10 | */ |
||
11 | |||
12 | namespace Gtt\Bundle\WorkflowExtensionsBundle\Guard; |
||
13 | |||
14 | use Gtt\Bundle\WorkflowExtensionsBundle\WorkflowContext; |
||
15 | use Gtt\Bundle\WorkflowExtensionsBundle\Exception\UnsupportedGuardEventException; |
||
16 | use Gtt\Bundle\WorkflowExtensionsBundle\WorkflowSubject\SubjectManipulator; |
||
17 | use Symfony\Component\ExpressionLanguage\ExpressionLanguage; |
||
18 | use Symfony\Component\Workflow\Event\GuardEvent; |
||
19 | use Symfony\Component\Workflow\Registry as WorkflowRegistry; |
||
20 | use Psr\Log\LoggerInterface; |
||
21 | use Exception; |
||
22 | use Throwable; |
||
23 | |||
24 | /** |
||
25 | * Listener for workflow guard events that can block or allow transition with specified expression |
||
26 | */ |
||
27 | class ExpressionGuard |
||
28 | { |
||
29 | /** |
||
30 | * Expression language |
||
31 | * |
||
32 | * @var ExpressionLanguage |
||
33 | */ |
||
34 | private $language; |
||
35 | |||
36 | /** |
||
37 | * Subject manipulator |
||
38 | * |
||
39 | * @var SubjectManipulator |
||
40 | */ |
||
41 | private $subjectManipulator; |
||
42 | |||
43 | /** |
||
44 | * Workflow registry |
||
45 | * |
||
46 | * @var WorkflowRegistry |
||
47 | */ |
||
48 | private $workflowRegistry; |
||
49 | |||
50 | /** |
||
51 | * Logger |
||
52 | * |
||
53 | * @var LoggerInterface |
||
54 | */ |
||
55 | private $logger; |
||
56 | |||
57 | /** |
||
58 | * Maps guard event name to expression and workflow used to block or allow transition |
||
59 | * |
||
60 | * @var array |
||
61 | */ |
||
62 | private $supportedEventsConfig = []; |
||
63 | |||
64 | /** |
||
65 | * ExpressionGuard constructor |
||
66 | * |
||
67 | * @param ExpressionLanguage $language expression language |
||
68 | * @param SubjectManipulator $subjectManipulator subject manipulator |
||
69 | * @param WorkflowRegistry $workflowRegistry workflow registry |
||
70 | * @param LoggerInterface $logger logger |
||
71 | */ |
||
72 | View Code Duplication | public function __construct( |
|
0 ignored issues
–
show
|
|||
73 | ExpressionLanguage $language, |
||
74 | SubjectManipulator $subjectManipulator, |
||
75 | WorkflowRegistry $workflowRegistry, |
||
76 | LoggerInterface $logger) |
||
77 | { |
||
78 | $this->language = $language; |
||
79 | $this->subjectManipulator = $subjectManipulator; |
||
80 | $this->workflowRegistry = $workflowRegistry; |
||
81 | $this->logger = $logger; |
||
82 | } |
||
83 | |||
84 | /** |
||
85 | * Registers guard expression |
||
86 | * |
||
87 | * @param string $eventName guard event name |
||
88 | * @param string $workflowName workflow name |
||
89 | * @param string $expression guard expression |
||
90 | */ |
||
91 | public function registerGuardExpression($eventName, $workflowName, $expression) |
||
92 | { |
||
93 | $this->supportedEventsConfig[$eventName] = [$workflowName, $expression]; |
||
94 | } |
||
95 | |||
96 | /** |
||
97 | * Blocks or allows workflow transitions by guard expression evaluation |
||
98 | * |
||
99 | * @param GuardEvent $event |
||
100 | * @param string $eventName |
||
101 | * |
||
102 | * @throws \Exception in case of failure |
||
103 | */ |
||
104 | public function guardTransition(GuardEvent $event, $eventName) |
||
105 | { |
||
106 | if (!array_key_exists($eventName, $this->supportedEventsConfig)) { |
||
107 | throw new UnsupportedGuardEventException(sprintf("Cannot find registered guard event by name '%s'", $eventName)); |
||
108 | } |
||
109 | |||
110 | list($workflowName, $expression) = $this->supportedEventsConfig[$eventName]; |
||
111 | $subject = $event->getSubject(); |
||
112 | $workflowContext = new WorkflowContext( |
||
113 | $this->workflowRegistry->get($subject, $workflowName), |
||
114 | $subject, |
||
115 | $this->subjectManipulator->getSubjectId($subject) |
||
0 ignored issues
–
show
$this->subjectManipulator->getSubjectId($subject) is of type array , but the function expects a string|integer .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
116 | ); |
||
117 | $loggerContext = $workflowContext->getLoggerContext(); |
||
118 | |||
119 | $expressionFailure = false; |
||
120 | $errorMessage = null; |
||
121 | |||
122 | try { |
||
123 | $expressionResult = $this->language->evaluate($expression, ['event' => $event]); |
||
124 | } catch (Exception $e) { |
||
125 | $errorMessage = sprintf( |
||
126 | "Guard expression '%s' for guard event '%s' cannot be evaluated. Details: '%s'", |
||
127 | $expression, |
||
128 | $eventName, |
||
129 | $e->getMessage() |
||
130 | ); |
||
131 | $expressionFailure = true; |
||
132 | } catch (Throwable $e) { |
||
0 ignored issues
–
show
|
|||
133 | $errorMessage = sprintf( |
||
134 | "Guard expression '%s' for guard event '%s' cannot be evaluated. Details: '%s'", |
||
135 | $expression, |
||
136 | $eventName, |
||
137 | $e->getMessage() |
||
138 | ); |
||
139 | $expressionFailure = true; |
||
140 | } |
||
141 | |||
142 | if ($expressionFailure) { |
||
143 | $this->logger->error($errorMessage, $loggerContext); |
||
144 | |||
145 | // simply skipping processing here without blocking transition |
||
146 | return; |
||
147 | } |
||
148 | |||
149 | if (!is_bool($expressionResult)) { |
||
150 | $this->logger->debug( |
||
151 | sprintf("Guard expression '%s' for guard event '%s' evaluated with non-boolean result". |
||
152 | " and will be converted to boolean", $expression, $eventName), |
||
153 | $loggerContext |
||
154 | ); |
||
155 | } |
||
156 | |||
157 | $event->setBlocked($expressionResult); |
||
158 | |||
159 | if ($expressionResult) { |
||
160 | $this->logger->debug( |
||
161 | sprintf("Transition '%s' is blocked by guard expression '%s' for guard event '%s'", |
||
162 | $event->getTransition()->getName(), |
||
163 | $expression, |
||
164 | $eventName |
||
165 | ), |
||
166 | $loggerContext |
||
167 | ); |
||
168 | } |
||
169 | } |
||
170 | } |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.