Issues in HttpRequest.php (master) - Issues in master - KSST/KF - Measure and Improve Code Quality continuously with Scrutinizer

Issues (3098)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

framework/Koch/Http/HttpRequest.php (71 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

/**
 * Koch Framework
 * Jens-André Koch © 2005 - onwards.
 *
 * This file is part of "Koch Framework".
 *
 * License: GNU/GPL v2 or any later version, see LICENSE file.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */

namespace Koch\Http;

/**
 * Koch Framework - Class for Request Handling.
 *
 * It encapsulates the access to sanitized superglobals ($_GET, $_POST, $_SERVER).
 * There are two ways of access (1) via methods && (2) via spl arrayaccess array handling.
 */
class HttpRequest implements HttpRequestInterface, \ArrayAccess
{
    /**
     * @var array Contains the cleaned Parameters.
     */
    private $post_parameters;


    /**
     * @var array Contains the cleaned Parameters.
     */
    private $get_parameters;


    /**
     * @var array Contains the cleaned Parameters.
     */
    private $cookie_parameters;


    /**
     * @var The requestmethod. Possible values are GET, POST, PUT, DELETE.
     */
    protected static $request_method;


    /**
     * @var string the base URL (protocol://server:port)
     */
    protected static $baseURL;

    /**
     * @var object Object with pieces of informations about the target route.
     */
    private $route;

    /**
     * Construct the Request Object.
     *
     * 1) Drop Superglobal $_REQUEST. Just hardcoded reminder for developers to not use it!
     * 2) Additional Security Checks
     * 3) Clear Array, Filter and Assign the $_REQUEST Global to it
     * 4) Detect REST Tunneling through POST and set request_method accordingly
     */
    public function __construct()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        // 1) Drop $_REQUEST and $GLOBALS. Usage is forbidden!
        unset($_REQUEST);
        //unset($GLOBALS);

        /*
         * 2) Additional Security Checks
         */

        // block XSS
        $_SERVER['PHP_SELF'] = htmlspecialchars($_SERVER['PHP_SELF']);
        if (isset($_SERVER['QUERY_STRING'])) {
            htmlspecialchars($_SERVER['QUERY_STRING']);
        }

        /*
         * 3) Init Parameter Arrays and Assign the GLOBALS
         */

        // Clear Parameters Array
        $this->get_parameters    = [];
        $this->post_parameters   = [];
        $this->cookie_parameters = [];

        // Assign the GLOBALS $_GET, $_POST, $_COOKIE

        $this->get_parameters    = $_GET;
        $this->post_parameters   = $_POST;
        $this->cookie_parameters = $_COOKIE;

        /*
         * 4) Detect REST Tunneling through POST and set request_method accordingly
         */
        $this->detectRESTTunneling();
    }

    /**
     * Returns the raw POST Parameters Array.
     * Raw means: no validation, no filtering, no sanitization.
     *
     * @return array POST Parameters Array.
     */
    public function getPost()
    {
        return $this->post_parameters;
    }

    /**
     * Returns the HTTP POST data in raw format via Stream.
     *
     * @return string HTTP POST data (raw).
     */
    public function getPostRaw()
    {
        return file_get_contents('php://input');
    }

    /**
     * Returns the raw GET Parameters Array.
     * Raw means: no validation, no filtering, no sanitization.
     *
     * @return array GET Parameters Array.
     */
    public function getGet()
    {
        return $this->get_parameters;
    }

    /**
     * Returns the COOKIES Parameters Array.
     * Raw means: no validation, no filtering, no sanitization.
     *
     * @return array COOKIES Parameters Array.
     */
    public function getCookies()
    {
        return $this->cookie_parameters;
    }

    public function getServer()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        return $_SERVER;
    }

    /**
     * expectParameters.
     *
     * a) isset test          -  to determine if the parameter is incomming
     * b) exception throwing  -  if parameter is not incomming, but expected
     *
     * @todo c) validation          -  validates the incomming parameter via rules
     *
     * $parameters array structure:
     * $parameters = array(
     *  'parametername' => array (      // parametername as key for rules array
     *      'source',                   // (GET|POST)
     *      'validation-rule'
     * );
     * 'modulename' => array ('GET', 'string|lowercase')
     *
     * @example
     * // parameter names only
     * $this->expectParameters(array('modulename','language'));
     * // parameters, one with rules
     * // parameters, all with rules
     *
     * @param array $parameters
     */
    public function expectParameters(array $parameters)
    {
        foreach ($parameters as $parameter => $array_or_parametername) {

            /*
             * check if we have some rules to process
             */
            if (true === is_array($array_or_parametername)) {

                $array_name = $array_or_parametername[0];      // GET|POST|COOKIE

                #$validation_rules   = $array_or_parametername[1];      // some validation commands


                /*
                 * ISSET or Exception
                 */
                $this->expectParameter($parameter, $array_name);


                /*
                 * VALID or Exception
                 */
                #$this->validateParameter($parameter, $validation_rules);

            } else { // if(is_int($array_or_parametername))

                $this->expectParameter($array_or_parametername);

            }
        }
    }

    /**
     * This method ensures that all the parameters you are expecting
     * and which are required by your action are really incomming with the request.
     * It's a multiple call to issetParameter(), with the difference,
     * that it throws an Exception if not isset!
     *
     * a) isset test          -  to determine if the parameter is incomming
     * b) exception throwing  -  if parameter is not incomming, but expected
     *
     * @param string $parameter
     * @param string $array     (GET|POST|COOKIE)
     */
    public function expectParameter($parameter, $array = '')
    {
        // when array is not defined issetParameter will searches (POST|GET|COOKIE)
        if (is_string($array)) {
            if (false === $this->issetParameter($parameter)) {
                throw new \Koch\Exception\Exception('Incoming Parameter missing: "' . $parameter . '".');
            }
        } else { // when array is defined issetParameter will search the given array
            if (false === $this->issetParameter($parameter, $array)) {
                throw new \Koch\Exception\Exception(
                    'Incoming Parameter missing: "' . $parameter . '" in Array "' . $array . '".'
                );
            }
        }
    }

    /**
     * isset, checks if a certain parameter exists in the parameters array.
     *
     * @param string $parameter Name of the Parameter
     * @param string $array     GET, POST, COOKIE. Default = GET.
     * @param bool   $where     If set to true, method will return the name of the array the parameter was found in.
     *
     * @return string boolean string arrayname

     */
    public function issetParameter($parameter, $array = 'GET', $where = false)
    {
        $array = mb_strtoupper($array);

        switch ($array) {
            case 'GET':
                if (isset($this->get_parameters[$parameter])) {
                    return ($where === false) ? true : 'get';

                }
                break;
            case 'POST':
                if (isset($this->post_parameters[$parameter])) {
                    return ($where === false) ? true : 'post';

                }
                break;
            case 'COOKIE':
                if (isset($this->cookie_parameters[$parameter])) {
                    return ($where === false) ? true : 'cookie';

                }
                break;
            default:
                return false;
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
                break;
switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}
        }
    }

    /**
     * get, returns a certain parameter if existing.
     *
     * @param string $parameter Name of the Parameter
     * @param string $array     GET, POST, COOKIE. Default = POST.
     * @param string $default   You can set a default value. It's returned if parametername was not found.

     *
     * @return mixed data | null
     */
    public function getParameter($parameter, $array = 'POST', $default = null)
    {
        /*
         * check if the parameter exists in $array
         * the third property of issetParameter is set to true, so that we get the full and correct array name back
         */
        $parameter_array = $this->issetParameter($parameter, $array, true);


        /*
         * we use type hinting here to cast the string with array name to boolean
         */
        if ((bool) $parameter_array === true) {

            // this returns a value from the parameterarray
            return $this->{mb_strtolower($parameter_array) . '_parameters'}[$parameter];

        } elseif ($default !== null) {
            // this returns the default value,incomming via method property $default
            return $default;
        } else {
            return;
        }
    }

    /**
     * set, returns a certain parameter if existing.
     *
     * @param string $parameter Name of the Parameter
     * @param string $array     G, P, C. Default = POST.
     *
     * @return mixed data | null
     */
    public function setParameter($parameter, $array = 'POST')
    {
        if (true === $this->issetParameter($parameter, $array)) {
            return $this->{mb_strtolower($array) . '_parameters'}[$parameter];
        } else {
            return;
        }
    }

    /**
     * Shortcut to get a Parameter from $_POST.
     *
     * @param string $name Name of the Parameter
     *
     * @return mixed data | null
     */
    public function getParameterFromPost($name)
    {
        return $this->getParameter($name, 'POST');
    }

    /**
     * Shortcut to get a Parameter from $_GET.
     *
     * @param string $name Name of the Parameter
     *
     * @return mixed data | null
     */
    public function getParameterFromGet($name)
    {
        return $this->getParameter($name, 'GET');
    }

    /**
     * Shortcut to get a Parameter from $_SERVER.
     *
     * @param string $name Name of the Parameter
     *
     * @return mixed data | null
     */
    public function getParameterFromServer($name)
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        if (in_array($name, array_keys($_SERVER), true)) {
            return $_SERVER[$name];
        } else {
            return;
        }
    }

    /**
     * Get previously set cookies.
     *
     * @param string $name Name of the Cookie
     *
     * @return Returns an associative array containing any previously set cookies.
     */
    public function getParameterFromCookie($name)
    {
        if (isset($this->cookie_parameters[$name]) === true) {
            return $this->cookie_parameters($name);

        }
    }

    /**
     * Get Value of a specific http-header.
     *
     * @param string $parameter Name of the Parameter
     *
     * @return string
     */
    public static function getHeader($parameter)
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        $parameter = 'HTTP_' . mb_strtoupper(str_replace('-', '_', $parameter));

        if ($_SERVER[$parameter] !== null) {
            return $_SERVER[$parameter];
        }

        return;
    }

    /**
     * Determine Type of Protocol for Webpaths (http/https)
     * Get for $_SERVER['HTTPS'].
     *
     * @todo check $_SERVER['SSL_PROTOCOL'] + $_SERVER['HTTP_X_FORWARD_PROTO']?
     * @todo check -> or $_SERVER['SSL_PROTOCOL']
     *
     * @return string
     */
    public static function getServerProtocol()
    {
        if (self::isSecure()) {
            return 'https://';
        } else {
            return 'http://';
        }
    }

    /**
     * Determine Type of Protocol for Webpaths (http/https)
     * Get for $_SERVER['HTTPS'] with boolean return value.
     *
     * @todo check about $_SERVER['SERVER_PORT'] == 443, is this always ssl then?
     *
     * @see $this->getServerProtocol()
     *
     * @return bool
     */
    public static function isSecure()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        if (isset($_SERVER['HTTPS']) && (mb_strtolower($_SERVER['HTTPS']) === 'on' or $_SERVER['HTTPS'] === '1')) {
// Logical operators have lower precedence:
$f = false or true;

// is executed like this:
($f = false) or true;


// Boolean operators have higher precedence:
$f = false || true;

// is executed like this:
$f = (false || true);
            return true;
        } else {
            return false;
        }
    }

    /**
     * Determine Port Number for Webpaths (http/https)
     * Get for $_SERVER['SERVER_PORT'] and $_SERVER['SSL_PROTOCOL'].
     *
     * @return string

     */
    private static function getServerPort()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        // custom port
        if (self::isSecure() === false and $_SERVER['SERVER_PORT'] !== 80) {
// Logical operators have lower precedence:
$f = false or true;

// is executed like this:
($f = false) or true;


// Boolean operators have higher precedence:
$f = false || true;

// is executed like this:
$f = (false || true);
            return ':' . $_SERVER['SERVER_PORT'];
        }

        // custom ssl port
        if (self::isSecure() && $_SERVER['SERVER_PORT'] !== 443) {
            return ':' . $_SERVER['SERVER_PORT'];
        }
    }

    /**
     * Returns the base of the current URL
     * Format: protocol://server:port.
     *
     * The "template constant"" WWW_ROOT is later defined as getBaseURL
     * <form action="<?=WWW_ROOT?>/news/7" method="DELETE"/>
     *
     * @return string
     */
    public static function getBaseURL()
    {
        if (empty(self::$baseURL)) {
            // 1. Determine Protocol
            self::$baseURL = self::getServerProtocol();

            // 2. Determine Servername
            self::$baseURL .= self::getServerName();

            // 3. Determine Port
            self::$baseURL .= self::getServerPort();
        }

        return self::$baseURL;
    }

    /**
     * Get $_SERVER SERVER_NAME.
     *
     * @return string The name of the server host under which the current script is executing.
     */
    public static function getServerName()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        return $_SERVER['SERVER_NAME'];
    }

    /**
     * Get $_SERVER REQUEST_URI.
     *
     * @return string The URI which was given in order to access this page; for instance, '/index.html'.
     */
    public static function getRequestURI()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        if ($_SERVER['REQUEST_URI'] !== null) {
            return urldecode(mb_strtolower($_SERVER['REQUEST_URI']));
        }

        // MS-IIS and ISAPI Rewrite Filter (only on windows platforms)
        if (isset($_SERVER['HTTP_X_REWRITE_URL']) and stripos(PHP_OS, 'WIN') !== false) {
// Logical operators have lower precedence:
$f = false or true;

// is executed like this:
($f = false) or true;


// Boolean operators have higher precedence:
$f = false || true;

// is executed like this:
$f = (false || true);
            return urldecode(mb_strtolower($_SERVER['HTTP_X_REWRITE_URL']));
        }

        $p = $_SERVER['SCRIPT_NAME'];
        if ($_SERVER['QUERY_STRING'] !== null) {
            $p .= '?' . $_SERVER['QUERY_STRING'];
        }

        return urldecode(mb_strtolower($p));
    }

    /**
     * Get $_SERVER REMOTE_URI.
     *
     * @return string
     */
    public static function getRemoteURI()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        return $_SERVER['REMOTE_URI'];
    }

    /**
     * Get $_SERVER QUERY_STRING.
     *
     * @return string The query string via which the page was accessed.
     */
    public static function getQueryString()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        return $_SERVER['QUERY_STRING'];
    }

    /**
     * Get the current Url.
     *
     * @return string Returns the current URL, which is the HOST + REQUEST_URI, without index.php.
     */
    public static function getCurrentUrl()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        return str_replace('/index.php', '', 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
    }

    /**
     * Get IP = $_SERVER REMOTE_ADDRESS.
     *
     * @return string The IP/HOST from which the user is viewing the current page.
     */
    public static function getRemoteAddress()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        $ip = null;
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

        if ($_SERVER['HTTP_CLIENT_IP'] !== null) {
            $ip = $_SERVER['HTTP_CLIENT_IP'];
        } elseif ($_SERVER['HTTP_X_FORWARDED_FOR'] !== null) {
            $ip = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
            $ip = array_pop($ip);
        } elseif ($_SERVER['HTTP_X_REAL_IP'] !== null) {
            // NGINX - with natural russian config passes the IP as REAL_IP
            $ip = $_SERVER['HTTP_X_REAL_IP'];
        } elseif ($_SERVER['HTTP_FORWARDED_FOR'] !== null) {
            $ip = $_SERVER['HTTP_FORWARDED_FOR'];
        } elseif ($_SERVER['HTTP_CLIENT_IP'] !== null) {
            $ip = $_SERVER['HTTP_CLIENT_IP'];
        } elseif ($_SERVER['HTTP_X_CLUSTER_CLIENT_IP'] !== null) {
            $ip = $_SERVER['HTTP_X_CLUSTER_CLIENT_IP'];
        } elseif ($_SERVER['HTTP_FORWARDED'] !== null) {
            $ip = $_SERVER['HTTP_FORWARDED'];
        } elseif ($_SERVER['HTTP_X_FORWARDED'] !== null) {
            $ip = $_SERVER['HTTP_X_FORWARDED'];
        } else {
            $ip = $_SERVER['REMOTE_ADDR'];
        }

        if (true === self::validateIP($ip)) {
            return $ip;
        }
    }

    /**
     * Returns the User Agent ($_SERVER HTTP_USER_AGENT).
     *
     * @return string String denoting the user agent being which is accessing the page.
     */
    public static function getUserAgent()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        $ua          = strip_tags($_SERVER['HTTP_USER_AGENT']);
        $ua_filtered = filter_var($ua, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH);


        return $ua_filtered;

    }

    /**
     * Returns the Referrer ($_SERVER HTTP_REFERER).
     *
     * @return string The address of the page (if any) which referred the user agent to the current page.
     */
    public static function getReferer()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        if ($_SERVER['HTTP_REFERER'] !== null) {
            $refr          = strip_tags($_SERVER['HTTP_REFERER']);
            $refr_filtered = filter_var($refr, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH);

        }

        return $refr_filtered;
function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}
    }

    /**
     * Validates a given IP.
     *
     * @see getRemoteAddress()
     *
     * @param string $ip   The IP address to validate.
     * @param boolen $ipv6 Boolean true, activates ipv6 checking.

     *
     * @return bool True, if IP is valid. False, otherwise.
     */
    public static function validateIP($ip, $ipv6 = false)

    {
        if (true === $ipv6) {
            return (bool) filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);
        } else {
            return (bool) filter_var(
                $ip,
                FILTER_VALIDATE_IP,
                FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE | FILTER_FLAG_IPV4
            );
        }
    }

    /**
     * Get Route returns the static \Koch\Router\TargetRoute object.
     *
     * With php onbord tools you can't debug this.
     * Please use \Koch\Debug\Debug:firebug($route); to debug.
     * Firebug uses Reflection to show the static properties and values.
     *
     * @return object \Koch\Router\TargetRoute
     */
    public function getRoute()
    {
        return $this->route;
    }

    /**
     * Set Route Object.
     *
     * @param $route \Koch\Router\TargetRoute
     */
    public function setRoute(\Koch\Router\TargetRoute $route)
    {
        $this->route = $route;
    }

    /**
     * REST Tunneling Detection.
     *
     * This method takes care for REST (Representational State Transfer)
     * by tunneling PUT, DELETE through POST (principal of least power).
     * Ok, this is faked or spoofed REST, but lowers the power of POST
     * and it's short and nice in html forms.
     *
     * @todo consider allowing 'GET' through POST?
     *
     * @see https://wiki.nbic.nl/index.php/REST.inc
     * @see http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
     */
    public function detectRESTTunneling()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        $allowed_rest_methodnames = ['DELETE', 'PUT'];


        // request_method has to be POST AND GET has to to have the method GET
        if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST'
            and $this->issetParameter('GET', 'method')) {
// Logical operators have lower precedence:
$f = false or true;

// is executed like this:
($f = false) or true;


// Boolean operators have higher precedence:
$f = false || true;

// is executed like this:
$f = (false || true);
            // check for allowed rest commands
            if (in_array(mb_strtoupper($_GET['method']), $allowed_rest_methodnames, true)) {

                // set the internal (tunneled) method as new REQUEST_METHOD
                self::setRequestMethod($_GET['method']);

                // unset the tunneled method
                unset($_GET['method']);

                // now strip the methodname from the QUERY_STRING and rebuild REQUEST_URI

                // rebuild the QUERY_STRING from $_GET
                $_SERVER['QUERY_STRING'] = http_build_query($_GET);
                // rebuild the REQUEST_URI
                $_SERVER['REQUEST_URI'] = $_SERVER['SCRIPT_NAME'];
                // append QUERY_STRING to REQUEST_URI if not empty
                if ($_SERVER['QUERY_STRING'] !== '') {
                    $_SERVER['REQUEST_URI'] .= '?' . $_SERVER['QUERY_STRING'];
                }
            } else {
                throw new \Koch\Exception\Exception(
                    'Request Method failure. You tried to tunnel a ' . $this->getParameter('method', 'GET')
                    . ' request through an HTTP POST request.'
                );
            }
        } elseif (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'GET'
            and $this->issetParameter('GET', 'method')) {
// Logical operators have lower precedence:
$f = false or true;

// is executed like this:
($f = false) or true;


// Boolean operators have higher precedence:
$f = false || true;

// is executed like this:
$f = (false || true);
            // NOPE, there's no tunneling through GET!
            throw new \Koch\Exception\Exception(
                'Request Method failure. You tried to tunnel a ' . $this->getParameter('method', 'GET')
                . ' request through an HTTP GET request.'
            );
        }
    }

    /**
     * Get the REQUEST METHOD (GET, HEAD, POST, PUT, DELETE).
     *
     * HEAD request is returned internally as GET.
     * The internally set request_method (PUT or DELETE) is returned first,
     * because we might have a REST-tunneling.
     *
     * @return string request method
     */
    public static function getRequestMethod()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        if (self::$request_method !== null) {
            return self::$request_method;
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
        }

        $method = $_SERVER['REQUEST_METHOD'];

        // get method from "http method override" header
        if (isset($_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'])) {
            return $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'];
        }

        // add support for HEAD requests, which are GET requests
        if ($method === 'HEAD') {
            $method = 'GET';
        }

        return $method;
    }

    /**
     * Set the REQUEST_METHOD.
     */
    public static function setRequestMethod($method)
    {
        self::$request_method = strtoupper($method);

    }

    /**
     * Checks if a ajax(xhr)-request is given,
     * by checking X-Requested-With Header for XMLHttpRequest.
     *
     * @return bool true if the request is an XMLHttpRequest, false otherwise
     */
    public static function isAjax()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        if (isset($_SERVER['X-Requested-With']) and $_SERVER['X-Requested-With'] === 'XMLHttpRequest') {
// Logical operators have lower precedence:
$f = false or true;

// is executed like this:
($f = false) or true;


// Boolean operators have higher precedence:
$f = false || true;

// is executed like this:
$f = (false || true);
            return true;
        } elseif (isset($_SERVER['HTTP_X_REQUESTED_WITH']) and $_SERVER['HTTP_X_REQUESTED_WITH'] === 'XMLHttpRequest') {
// Logical operators have lower precedence:
$f = false or true;

// is executed like this:
($f = false) or true;


// Boolean operators have higher precedence:
$f = false || true;

// is executed like this:
$f = (false || true);
            return true;
        } else {
            return false;
        }
    }

    /**
     * is(GET|POST|PUT|DELETE)
     * Boolean "getters" for several HttpRequest Types.
     * This makes request type checking in controllers easy.
     */

    /**
     * Determines, if request is of type GET.
     *
     * @return bool
     */
    public function isGet()
    {
        return self::$request_method === 'GET';
    }

    /**
     * Determines, if request is of type POST.
     *
     * @return bool
     */
    public function isPost()
    {
        return self::$request_method === 'POST';
    }

    /**
     * Determines, if request is of type PUT.
     *
     * @return bool
     */
    public function isPut()
    {
        return self::$request_method === 'PUT';
    }

    /**
     * Determines, if request is of type DELETE.
     *
     * @return bool
     */
    public function isDelete()
    {
        return self::$request_method === 'DELETE';
    }

    /**
     * Implementation of SPL ArrayAccess
     * only offsetExists and offsetGet are relevant.
     */
    public function offsetExists($offset)
    {
        return $this->issetParameter($offset);

    }

    public function offsetGet($offset)
    {
        return $this->getParameter($offset);
    }

    // not setting request vars
    public function offsetSet($offset, $value)
    {
        return false;
    }

    // not unsetting request vars
    public function offsetUnset($offset)
    {
        return false;
    }
}


Issues (3098)

Security Analysis not enabled

framework/Koch/Http/HttpRequest.php (71 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Logical Operators are used for Control-Flow

Logical Operators are used for Control-Flow

Logical Operators are used for Control-Flow

Available Fixes

Logical Operators are used for Control-Flow

Logical Operators are used for Control-Flow

Logical Operators are used for Control-Flow

Logical Operators are used for Control-Flow

KSST / KF

Issues (3098)

Security Analysis not enabled

framework/Koch/Http/HttpRequest.php (71 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Logical Operators are used for Control-Flow

Logical Operators are used for Control-Flow

Logical Operators are used for Control-Flow

Available Fixes

Logical Operators are used for Control-Flow

Logical Operators are used for Control-Flow

Logical Operators are used for Control-Flow

Logical Operators are used for Control-Flow

Duplication Side-by-Side

Filter issues like