This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /* |
||
4 | * This file is part of the cfdi-xml project. |
||
5 | * |
||
6 | * (c) Kinedu |
||
7 | * |
||
8 | * For the full copyright and license information, please view the LICENSE |
||
9 | * file that was distributed with this source code. |
||
10 | */ |
||
11 | |||
12 | namespace Kinedu\CfdiXML\Common; |
||
13 | |||
14 | use DOMElement; |
||
15 | use DOMDocument; |
||
16 | use DOMNodeList; |
||
17 | |||
18 | class Node |
||
19 | { |
||
20 | /** |
||
21 | * Node document. |
||
22 | * |
||
23 | * @var DOMDocument |
||
24 | */ |
||
25 | protected $document; |
||
26 | |||
27 | /** |
||
28 | * Node element. |
||
29 | * |
||
30 | * @var DOMElement |
||
31 | */ |
||
32 | protected $element; |
||
33 | |||
34 | /** |
||
35 | * Define the parent node name. |
||
36 | * |
||
37 | * @var string|null |
||
38 | */ |
||
39 | protected $parentNodeName = null; |
||
40 | |||
41 | /** |
||
42 | * Define the node name. |
||
43 | * |
||
44 | * @var string |
||
45 | */ |
||
46 | protected $nodeName; |
||
47 | |||
48 | /** |
||
49 | * Node attributes. |
||
50 | * |
||
51 | * @var array |
||
52 | */ |
||
53 | protected $attr = []; |
||
54 | |||
55 | protected $outstandingReferences; |
||
56 | |||
57 | /** |
||
58 | * Create a new node instance. |
||
59 | * |
||
60 | * @param array $attr |
||
61 | */ |
||
62 | public function __construct(array ...$attr) |
||
63 | { |
||
64 | $this->attr = $attr; |
||
65 | |||
66 | $this->document = new DOMDocument('1.0', 'UTF-8'); |
||
67 | $this->document->preserveWhiteSpace = false; |
||
68 | |||
69 | if ($nodeName = $this->getNodeName()) { |
||
70 | $this->element = $this->document->createElement($nodeName); |
||
71 | $this->document->appendChild($this->element); |
||
72 | $this->setAttr($this->element, $this->getAttr()); |
||
73 | } |
||
74 | } |
||
75 | |||
76 | /** |
||
77 | * Add a new node. |
||
78 | * |
||
79 | * @param \Kinedu\CfdiXML\Common\Node $node |
||
80 | * |
||
81 | * @return void |
||
82 | */ |
||
83 | public function add(Node $node) |
||
84 | { |
||
85 | $wrapperElement = null; |
||
86 | |||
87 | if ($node->hasOutstandingReferences()) { |
||
88 | $schemaDefinition = $node->outstandingReferences['schema_definition']; |
||
89 | $namespace = $node->outstandingReferences['namespace']; |
||
90 | |||
91 | $this->setSchemaDefinition($schemaDefinition); |
||
0 ignored issues
–
show
|
|||
92 | $this->setNamespace($namespace); |
||
0 ignored issues
–
show
It seems like
$namespace defined by $node->outstandingReferences['namespace'] on line 89 can also be of type string ; however, Kinedu\CfdiXML\Common\Node::setNamespace() does only seem to accept object<Kinedu\CfdiXML\Common\Node> , maybe add an additional type check?
If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check: /**
* @return array|string
*/
function returnsDifferentValues($x) {
if ($x) {
return 'foo';
}
return array();
}
$x = returnsDifferentValues($y);
if (is_array($x)) {
// $x is an array.
}
If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue. ![]() |
|||
93 | } |
||
94 | |||
95 | if (isset($node->schemaDefinition) && $node->globalSchemaLocation) { |
||
0 ignored issues
–
show
The property
globalSchemaLocation does not exist. Did you maybe forget to declare it?
In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { }
$x = new MyClass();
$x->foo = true;
Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass {
public $foo;
}
$x = new MyClass();
$x->foo = true;
![]() |
|||
96 | $this->setSchemaDefinition( |
||
97 | $node->getSchemaLocation() |
||
0 ignored issues
–
show
It seems like you code against a specific sub-type and not the parent class
Kinedu\CfdiXML\Common\Node as the method getSchemaLocation() does only exist in the following sub-classes of Kinedu\CfdiXML\Common\Node : Kinedu\CfdiXML\Common\Complemento , Kinedu\CfdiXML\Common\ComplementoBase , Kinedu\CfdiXML\Common\ComplementoConcepto , Kinedu\CfdiXML\Common\Complemento\IEDU , Kinedu\CfdiXML\Common\Complemento\Pago , Kinedu\CfdiXML\Common\Co...nto\TimbreFiscalDigital . Maybe you want to instanceof check for one of these explicitly?
Let’s take a look at an example: abstract class User
{
/** @return string */
abstract public function getPassword();
}
class MyUser extends User
{
public function getPassword()
{
// return something
}
public function getDisplayName()
{
// return some name.
}
}
class AuthSystem
{
public function authenticate(User $user)
{
$this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName()));
// do something.
}
}
In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different sub-classes of User which does not have a getDisplayName() method, the code will break. Available Fixes
Note: PHP Analyzer uses reverse abstract interpretation to narrow down the types
inside the if block in such a case.
![]() |
|||
98 | ); |
||
99 | |||
100 | $this->setNamespace($node); |
||
101 | } |
||
102 | |||
103 | $nodeElement = $this->document->createElement($node->getNodeName()); |
||
104 | $this->setAttr($nodeElement, $node->getAttr()); |
||
105 | |||
106 | foreach ($node->element->childNodes as $child) { |
||
107 | $nodeElement->appendChild( |
||
108 | $this->document->importNode($child, true) |
||
109 | ); |
||
110 | } |
||
111 | |||
112 | if ($wrapperName = $node->getWrapperNodeName()) { |
||
113 | $wrapperElement = $this->getDirectChildElementByName( |
||
114 | $this->element->childNodes, |
||
115 | $wrapperName |
||
116 | ); |
||
117 | |||
118 | if (!$wrapperElement) { |
||
119 | $wrapperElement = $this->document->createElement($wrapperName); |
||
120 | $this->element->appendChild($wrapperElement); |
||
121 | } |
||
122 | |||
123 | $this->setAttr($wrapperElement, $node->getAttr('wrapper')); |
||
124 | } |
||
125 | |||
126 | if ($parentName = $node->getParentNodeName()) { |
||
127 | $currentElement = ($wrapperElement) ? $wrapperElement : $this->element; |
||
128 | |||
129 | $parentNode = $this->getDirectChildElementByName( |
||
130 | $currentElement->childNodes, |
||
131 | $parentName |
||
132 | ); |
||
133 | |||
134 | if (!$parentNode) { |
||
135 | $parentElement = $this->document->createElement($parentName); |
||
136 | $currentElement->appendChild($parentElement); |
||
137 | $parentElement->appendChild($nodeElement); |
||
138 | $this->setAttr($parentElement, $node->getAttr('parent')); |
||
139 | } else { |
||
140 | $parentNode->appendChild($nodeElement); |
||
141 | } |
||
142 | } else { |
||
143 | $this->element->appendChild($nodeElement); |
||
144 | } |
||
145 | } |
||
146 | |||
147 | /** |
||
148 | * Search the direct child of an element. |
||
149 | * |
||
150 | * @param DOMNodeList $children |
||
151 | * @param string $find |
||
152 | * |
||
153 | * @return DOMElement|null |
||
154 | */ |
||
155 | protected function getDirectChildElementByName(DOMNodeList $children, string $find) |
||
156 | { |
||
157 | foreach ($children as $child) { |
||
158 | if ($child->nodeName == $find) { |
||
159 | return $child; |
||
160 | } |
||
161 | } |
||
162 | |||
163 | return null; |
||
164 | } |
||
165 | |||
166 | /** |
||
167 | * @param \Kinedu\CfdiXML\Common\Node $node |
||
168 | * @return void |
||
169 | */ |
||
170 | public function setNamespace(Node $node) |
||
171 | { |
||
172 | $element = $this->element; |
||
173 | |||
174 | if ($element->tagName == 'cfdi:Comprobante') { |
||
175 | $namespaceKey = "xmlns:{$node->namespaceKey}"; |
||
0 ignored issues
–
show
The property
namespaceKey does not exist. Did you maybe forget to declare it?
In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { }
$x = new MyClass();
$x->foo = true;
Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass {
public $foo;
}
$x = new MyClass();
$x->foo = true;
![]() |
|||
176 | $namespaceValue = $node->getNamespace(); |
||
0 ignored issues
–
show
It seems like you code against a specific sub-type and not the parent class
Kinedu\CfdiXML\Common\Node as the method getNamespace() does only exist in the following sub-classes of Kinedu\CfdiXML\Common\Node : Kinedu\CfdiXML\Common\Complemento , Kinedu\CfdiXML\Common\ComplementoBase , Kinedu\CfdiXML\Common\ComplementoConcepto , Kinedu\CfdiXML\Common\Complemento\IEDU , Kinedu\CfdiXML\Common\Complemento\Pago , Kinedu\CfdiXML\Common\Co...nto\TimbreFiscalDigital . Maybe you want to instanceof check for one of these explicitly?
Let’s take a look at an example: abstract class User
{
/** @return string */
abstract public function getPassword();
}
class MyUser extends User
{
public function getPassword()
{
// return something
}
public function getDisplayName()
{
// return some name.
}
}
class AuthSystem
{
public function authenticate(User $user)
{
$this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName()));
// do something.
}
}
In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different sub-classes of User which does not have a getDisplayName() method, the code will break. Available Fixes
Note: PHP Analyzer uses reverse abstract interpretation to narrow down the types
inside the if block in such a case.
![]() |
|||
177 | |||
178 | $elementAttr = []; |
||
179 | |||
180 | if ($element->hasAttributes()) { |
||
181 | $lastAttrName = null; |
||
182 | |||
183 | foreach (iterator_to_array($element->attributes) as $attr) { |
||
184 | if ((substr($lastAttrName, 0, 5) == 'xmlns') && |
||
185 | (substr($attr->name, 0, 5) != 'xmlns')) { |
||
186 | $elementAttr[$namespaceKey] = $namespaceValue; |
||
187 | } |
||
188 | |||
189 | $elementAttr[$lastAttrName = $attr->name] = $attr->value; |
||
190 | |||
191 | $element->removeAttributeNode($attr); |
||
192 | } |
||
193 | } |
||
194 | |||
195 | $this->setAttr($element, $elementAttr); |
||
196 | } else { |
||
197 | $this->outstandingReferences['namespace'] = $node; |
||
198 | } |
||
199 | } |
||
200 | |||
201 | /** |
||
202 | * @param string $schemaDefinition |
||
203 | * @return void |
||
204 | */ |
||
205 | public function setSchemaDefinition(string $schemaDefinition) |
||
206 | { |
||
207 | $attrName = 'xsi:schemaLocation'; |
||
208 | |||
209 | $node = $this->element; |
||
210 | |||
211 | if ($node->hasAttribute($attrName)) { |
||
212 | $value = $node->getAttribute($attrName); |
||
213 | $value = "{$value} {$schemaDefinition}"; |
||
214 | |||
215 | $node->setAttribute($attrName, $value); |
||
216 | } else { |
||
217 | $this->outstandingReferences['schema_definition'] = $schemaDefinition; |
||
218 | } |
||
219 | } |
||
220 | |||
221 | private function hasOutstandingReferences(): bool |
||
222 | { |
||
223 | return !! $this->outstandingReferences; |
||
224 | } |
||
225 | |||
226 | /** |
||
227 | * Get node attributes. |
||
228 | * |
||
229 | * @param string $index |
||
230 | * |
||
231 | * @return array|null |
||
232 | */ |
||
233 | public function getAttr(string $index = 'node') |
||
234 | { |
||
235 | $attrIndex = ['node', 'parent', 'wrapper']; |
||
236 | |||
237 | $index = (in_array($index, $attrIndex)) |
||
238 | ? array_search($index, $attrIndex) |
||
239 | : 0; |
||
240 | |||
241 | return $this->attr[$index] ?? null; |
||
242 | } |
||
243 | |||
244 | /** |
||
245 | * Adds attributes to an element. |
||
246 | * |
||
247 | * @param DOMElement $element |
||
248 | * @param array $attr |
||
249 | * |
||
250 | * @return void |
||
251 | */ |
||
252 | public function setAttr(DOMElement $element, array $attr = null) |
||
253 | { |
||
254 | if (!is_null($attr)) { |
||
255 | foreach ($attr as $key => $value) { |
||
256 | $element->setAttribute($key, $value); |
||
257 | } |
||
258 | } |
||
259 | } |
||
260 | |||
261 | /** |
||
262 | * Get element. |
||
263 | * |
||
264 | * @return DOMElement |
||
265 | */ |
||
266 | public function getElement(): DOMElement |
||
267 | { |
||
268 | return $this->element; |
||
269 | } |
||
270 | |||
271 | /** |
||
272 | * Get document. |
||
273 | * |
||
274 | * @return DOMDocument |
||
275 | */ |
||
276 | public function getDocument(): DOMDocument |
||
277 | { |
||
278 | return $this->document; |
||
279 | } |
||
280 | |||
281 | /** |
||
282 | * Get wrapper node name. |
||
283 | * |
||
284 | * @return string|null |
||
285 | */ |
||
286 | public function getWrapperNodeName() |
||
287 | { |
||
288 | return $this->wrapperNodeName ?? null; |
||
0 ignored issues
–
show
The property
wrapperNodeName does not seem to exist. Did you mean nodeName ?
An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name. If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading. ![]() |
|||
289 | } |
||
290 | |||
291 | /** |
||
292 | * Get parent node name. |
||
293 | * |
||
294 | * @return string|null |
||
295 | */ |
||
296 | public function getParentNodeName() |
||
297 | { |
||
298 | return $this->parentNodeName ?? null; |
||
299 | } |
||
300 | |||
301 | /** |
||
302 | * Get node name. |
||
303 | * |
||
304 | * @return string |
||
305 | */ |
||
306 | public function getNodeName() |
||
307 | { |
||
308 | return $this->nodeName ?? null; |
||
309 | } |
||
310 | } |
||
311 |
If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check:
If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue.