Issues (3099)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

SearchBundle/Provider/ElasticaProvider.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Kunstmaan\SearchBundle\Provider;
4
5
use Elastica\Client;
6
use Elastica\Document;
7
use Elastica\Index;
8
9
class ElasticaProvider implements SearchProviderInterface
10
{
11
    /** @var Client The Elastica client */
12
    private $client;
13
14
    /** @var array An array of Elastica search nodes (each item in the array needs a host and port) */
15
    private $nodes = array();
16
17
    /**
18
     * @return Client
19
     */
20
    public function getClient()
21
    {
22
        if (!$this->client instanceof Client) {
23
            $this->client = new Client(
24
                array('connections' => $this->nodes,
25
                )
26
            );
27
28
            //NEXT_MAJOR: remove checks and update ruflin/elastica dependency constraints
29
            if (!class_exists(\Elastica\Mapping::class)) {
30
                @trigger_error('Using a version of ruflin/elastica below v7.0 is deprecated since KunstmaanSearchBundle 5.6 and support for older versions will be removed in KunstmaanSearchBundle 6.0. Upgrade to ruflin/elastica and elasticsearch v7 instead.', E_USER_DEPRECATED);
31
            }
32
        }
33
34
        return $this->client;
35
    }
36
37
    /**
38
     * @return string
39
     */
40
    public function getName()
41
    {
42
        return 'Elastica';
43
    }
44
45
    /**
46
     * @param string $indexName
47
     *
48
     * @return \Elastica\Index
49
     */
50
    public function createIndex($indexName)
51
    {
52
        return new Index($this->getClient(), $indexName);
53
    }
54
55
    /**
56
     * @param string $indexName
57
     *
58
     * @return \Elastica\Index
59
     */
60
    public function getIndex($indexName)
61
    {
62
        return $this->getClient()->getIndex($indexName);
63
    }
64
65
    /**
66
     * @param string $uid
67
     * @param array  $document
68
     * @param string $indexName
69
     * @param string $indexType
70
     *
71
     * @return \Elastica\Document
72
     */
73
    public function createDocument($uid, $document, $indexName = '', $indexType = '')
74
    {
75
        if (method_exists(Document::class, 'setType')) {
76
            // @phpstan-ignore-next-line
77
            return new Document($uid, $document, $indexType, $indexName);
78
        }
79
80
        return new Document($uid, $document, $indexName);
81
    }
82
83
    /**
84
     * @param string $indexName
85
     * @param string $indexType
86
     * @param array  $document
87
     * @param string $uid
88
     *
89
     * @return \Elastica\Response
90
     */
91 View Code Duplication
    public function addDocument($indexName, $indexType, $document, $uid)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
92
    {
93
        $doc = $this->createDocument($uid, $document);
94
        $index = $this->getClient()->getIndex($indexName);
95
        if (method_exists($index, 'getType')) {
96
            return $index->getType($indexType)->addDocument($doc);
97
        }
98
99
        return $index->addDocument($doc);
100
    }
101
102
    /**
103
     * @param array  $docs
104
     * @param string $indexName
105
     * @param string $indexType
106
     *
107
     * @return \Elastica\Bulk\ResponseSet
108
     */
109
    public function addDocuments($docs, $indexName = '', $indexType = '')
110
    {
111
        // Ignore indexName & indexType for Elastica, they have already been set in the document...
112
        return $this->getClient()->addDocuments($docs);
113
    }
114
115
    /**
116
     * @param string $indexName
117
     * @param string $indexType
118
     * @param string $uid
119
     *
120
     * @return \Elastica\Bulk\ResponseSet
121
     */
122
    public function deleteDocument($indexName, $indexType, $uid)
123
    {
124
        $ids = array($uid);
125
126
        return $this->deleteDocuments($indexName, $indexType, $ids);
127
    }
128
129
    /**
130
     * @param string $indexName
131
     * @param string $indexType
132
     * @param array  $ids
133
     *
134
     * @return \Elastica\Bulk\ResponseSet
135
     */
136 View Code Duplication
    public function deleteDocuments($indexName, $indexType, array $ids)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
137
    {
138
        $index = $this->getIndex($indexName);
139
140
        if (method_exists($index, 'getType')) {
141
            $type = $index->getType($indexType);
142
143
            return $this->getClient()->deleteIds($ids, $index, $type);
144
        }
145
146
        return $this->getClient()->deleteIds($ids, $index);
147
    }
148
149
    /**
150
     * @param string $indexName
151
     *
152
     * @return \Elastica\Response|null
153
     */
154
    public function deleteIndex($indexName)
155
    {
156
        $index = $this->getIndex($indexName);
157
        if ($index->exists()) {
158
            return $index->delete();
159
        }
160
161
        return null;
162
    }
163
164
    /**
165
     * @param string      $host
166
     * @param int         $port
167
     * @param string|null $username
168
     * @param string|null $password
169
     */
170
    public function addNode($host, $port, $username = null, $password = null)
171
    {
172
        foreach ($this->nodes as $node) {
173
            if ($node['host'] === $host && $node['port'] === $port) {
174
                return;
175
            }
176
        }
177
178
        $authHeader = null;
179
        if (null !== $username && $password !== null) {
180
            $authHeader = array('Authorization' => 'Basic ' . base64_encode($username . ':' . $password));
181
        }
182
183
        $this->nodes[] = array('host' => $host, 'port' => $port, 'headers' => $authHeader);
184
    }
185
186
    /**
187
     * @param array $nodes
188
     */
189
    public function setNodes($nodes)
190
    {
191
        $this->nodes = $nodes;
192
    }
193
194
    /**
195
     * @return array
196
     */
197
    public function getNodes()
198
    {
199
        return $this->nodes;
200
    }
201
}
202