Issues (737)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Legacy/Drupal7.php (13 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 * @file
5
 * Contains \Drupal\service_container\Legacy\Drupal7.
6
 */
7
8
namespace Drupal\service_container\Legacy;
9
10
/**
11
 * Defines the Drupal 7 legacy service.
12
 *
13
 * @method void flood_register_event(string $name, integer $window = 3600, string $identifier = NULL)
14
 * @method void flood_clear_event(string $name, string $identifier = NULL)
15
 * @method bool flood_is_allowed(string $name, integer $threshold, integer $window = 3600, string $identifier = NULL)
16
 * @method bool module_load_all(bool $bootstrap = FALSE)
17
 * @method array module_list(bool $refresh = FALSE, bool $bootstrap_refresh = FALSE, bool $sort = FALSE, array $fixed_list = NULL)
18
 * @method bool module_exists(string $module)
19
 * @method string drupal_get_filename(string $type, string $name, string $filename = NULL)
20
 * @method string module_load_include(string $type, string $module, string $name = NULL)
21
 * @method void module_load_all_includes(string $type, string $name = NULL)
22
 * @method array module_implements(string $hook, bool $sort = FALSE, bool $reset = FALSE)
23
 * @method void module_implements_write_cache()
24
 * @method void drupal_static_reset(string $name = NULL)
25
 * @method array system_rebuild_module_data()
26
 * @method array module_hook_info()
27
 * @method bool module_enable(array $module_list, bool $enable_dependencies = TRUE)
28
 * @method bool module_disable(array $module_list, bool $enable_dependencies = TRUE)
29
 * @method bool drupal_uninstall_modules(array $module_list = array(), bool $uninstall_dependents = TRUE)
30
 * @method void watchdog($type, $message, $variables = array(), $severity = WATCHDOG_NOTICE, $link = NULL)
31
 * @method bool user_access($string, $account = NULL)
32
 * @method bool user_is_logged_in()
33
 * @method bool user_is_anonymous()
34
 * @method string drupal_get_user_timezone()
35
 * @method string format_plural($count, $singular, $plural, array $args = array(), array $options = array())
36
 * @method mixed variable_get($name, $default = NULL)
37
 * @method void variable_set($name, $value)
38
 * @method void drupal_set_message(string $message = NULL, string $type = 'status', bool $repeat = TRUE)
39
 * @method mixed drupal_get_message(string $message = NULL, string $type = 'status', bool $repeat = TRUE)
40
 *
41
 * @codeCoverageIgnore
42
 */
43
class Drupal7 {
44
45
  public function __call($method, $args) {
46
    switch(count($args)) {
47
      case 0:
48
        return $method();
49
        break;
0 ignored issues
show
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
50
      case 1:
51
        return $method($args[0]);
52
        break;
0 ignored issues
show
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
53
      case 2:
54
        return $method($args[0], $args[1]);
55
        break;
0 ignored issues
show
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
56
      case 3:
57
        return $method($args[0], $args[1], $args[2]);
58
        break;
0 ignored issues
show
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
59
      case 4:
60
        return $method($args[0], $args[1], $args[2], $args[3]);
61
        break;
0 ignored issues
show
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
62
      case 5:
63
        return $method($args[0], $args[1], $args[2], $args[3], $args[4]);
64
        break;
0 ignored issues
show
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
65
      case 6:
66
        return $method($args[0], $args[1], $args[2], $args[3], $args[4], $args[5]);
67
        break;
0 ignored issues
show
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
68
      case 7:
69
        return $method($args[0], $args[1], $args[2], $args[3], $args[4], $args[5], $args[6]);
70
        break;
0 ignored issues
show
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
71
      case 8:
72
        return $method($args[0], $args[1], $args[2], $args[3], $args[4], $args[5], $args[6], $args[7]);
73
        break;
0 ignored issues
show
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
74 View Code Duplication
      case 9:
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
75
        return $method($args[0], $args[1], $args[2], $args[3], $args[4], $args[5], $args[6], $args[7], $args[8]);
76
        break;
0 ignored issues
show
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
77 View Code Duplication
      case 10:
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
78
        return $method($args[0], $args[1], $args[2], $args[3], $args[4], $args[5], $args[6], $args[7], $args[8], $args[9]);
79
        break;
0 ignored issues
show
break is not strictly necessary here and could be removed.

The break statement is not necessary if it is preceded for example by a return statement:

switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}

If you would like to keep this construct to be consistent with other case statements, you can safely mark this issue as a false-positive.

Loading history...
80
      default:
81
        // This is a necessary hack to ensure that things that have been passed
82
        // by reference continue to being passed by reference.
83
        // More info: See http://goo.gl/aM5fra
84
        $args_reference = array();
85
        foreach($args as $key => &$arg) {
86
          $args_reference[$key] = &$arg;
87
        }
88
        return call_user_func_array($method, $args_reference);
89
    }
90
  }
91
92
  /**
93
   * Formats an internal or external URL link as an HTML anchor tag.
94
   *
95
   * This function correctly handles aliased paths and adds an 'active' class
96
   * attribute to links that point to the current page (for theming), so all
97
   * internal links output by modules should be generated by this function if
98
   * possible.
99
   *
100
   * However, for links enclosed in translatable text you should use t() and
101
   * embed the HTML anchor tag directly in the translated string. For example:
102
   * @code
103
   * t('Visit the <a href="@url">settings</a> page', array('@url' => url('admin')));
104
   * @endcode
105
   * This keeps the context of the link title ('settings' in the example) for
106
   * translators.
107
   *
108
   * @param string $text
109
   *   The translated link text for the anchor tag.
110
   * @param string $path
111
   *   The internal path or external URL being linked to, such as "node/34" or
112
   *   "http://example.com/foo". After the url() function is called to construct
113
   *   the URL from $path and $options, the resulting URL is passed through
114
   *   check_plain() before it is inserted into the HTML anchor tag, to ensure
115
   *   well-formed HTML. See url() for more information and notes.
116
   * @param array $options
117
   *   An associative array of additional options. Defaults to an empty array. It
118
   *   may contain the following elements.
119
   *   - 'attributes': An associative array of HTML attributes to apply to the
120
   *     anchor tag. If element 'class' is included, it must be an array; 'title'
121
   *     must be a string; other elements are more flexible, as they just need
122
   *     to work in a call to drupal_attributes($options['attributes']).
123
   *   - 'html' (default FALSE): Whether $text is HTML or just plain-text. For
124
   *     example, to make an image tag into a link, this must be set to TRUE, or
125
   *     you will see the escaped HTML image tag. $text is not sanitized if
126
   *     'html' is TRUE. The calling function must ensure that $text is already
127
   *     safe.
128
   *   - 'language': An optional language object. If the path being linked to is
129
   *     internal to the site, $options['language'] is used to determine whether
130
   *     the link is "active", or pointing to the current page (the language as
131
   *     well as the path must match). This element is also used by url().
132
   *   - Additional $options elements used by the url() function.
133
   *
134
   * @return string
135
   *   An HTML string containing a link to the given path.
136
   *
137
   * @see url()
138
   */
139
  public function l($text, $path, array $options = array()) {
140
    return l($text, $path, $options);
141
  }
142
143
  /**
144
   * Translates a string to the current language or to a given language.
145
   *
146
   * The t() function serves two purposes. First, at run-time it translates
147
   * user-visible text into the appropriate language. Second, various mechanisms
148
   * that figure out what text needs to be translated work off t() -- the text
149
   * inside t() calls is added to the database of strings to be translated.
150
   * These strings are expected to be in English, so the first argument should
151
   * always be in English. To enable a fully-translatable site, it is important
152
   * that all human-readable text that will be displayed on the site or sent to
153
   * a user is passed through the t() function, or a related function. See the
154
   * @link http://drupal.org/node/322729 Localization API @endlink pages for
155
   * more information, including recommendations on how to break up or not
156
   * break up strings for translation.
157
   *
158
   * @section sec_translating_vars Translating Variables
159
   * You should never use t() to translate variables, such as calling
160
   * @code t($text); @endcode, unless the text that the variable holds has been
161
   * passed through t() elsewhere (e.g., $text is one of several translated
162
   * literal strings in an array). It is especially important never to call
163
   * @code t($user_text); @endcode, where $user_text is some text that a user
164
   * entered - doing that can lead to cross-site scripting and other security
165
   * problems. However, you can use variable substitution in your string, to put
166
   * variable text such as user names or link URLs into translated text. Variable
167
   * substitution looks like this:
168
   * @code
169
   * $text = t("@name's blog", array('@name' => format_username($account)));
170
   * @endcode
171
   * Basically, you can put variables like @name into your string, and t() will
172
   * substitute their sanitized values at translation time. (See the
173
   * Localization API pages referenced above and the documentation of
174
   * format_string() for details about how to define variables in your string.)
175
   * Translators can then rearrange the string as necessary for the language
176
   * (e.g., in Spanish, it might be "blog de @name").
177
   *
178
   * @section sec_alt_funcs_install Use During Installation Phase
179
   * During the Drupal installation phase, some resources used by t() wil not be
180
   * available to code that needs localization. See st() and get_t() for
181
   * alternatives.
182
   *
183
   * @param $string
184
   *   A string containing the English string to translate.
185
   * @param $args
186
   *   An associative array of replacements to make after translation. Based
187
   *   on the first character of the key, the value is escaped and/or themed.
188
   *   See format_string() for details.
189
   * @param $options
190
   *   An associative array of additional options, with the following elements:
191
   *   - 'langcode' (defaults to the current language): The language code to
192
   *     translate to a language other than what is used to display the page.
193
   *   - 'context' (defaults to the empty context): The context the source string
194
   *     belongs to.
195
   *
196
   * @return string
197
   *   The translated string.
198
   *
199
   * @see st()
200
   * @see get_t()
201
   * @see format_string()
202
   * @ingroup sanitization
203
   */
204
  public function t($string, array $args = array(), array $options = array()) {
205
    return t($string, $args, $options);
206
  }
207
208
  /**
209
   * Generates an internal or external URL.
210
   *
211
   * When creating links in modules, consider whether l() could be a better
212
   * alternative than url().
213
   *
214
   * @param $path
215
   *   (optional) The internal path or external URL being linked to, such as
216
   *   "node/34" or "http://example.com/foo". The default value is equivalent to
217
   *   passing in '<front>'. A few notes:
218
   *   - If you provide a full URL, it will be considered an external URL.
219
   *   - If you provide only the path (e.g. "node/34"), it will be
220
   *     considered an internal link. In this case, it should be a system URL,
221
   *     and it will be replaced with the alias, if one exists. Additional query
222
   *     arguments for internal paths must be supplied in $options['query'], not
223
   *     included in $path.
224
   *   - If you provide an internal path and $options['alias'] is set to TRUE, the
225
   *     path is assumed already to be the correct path alias, and the alias is
226
   *     not looked up.
227
   *   - The special string '<front>' generates a link to the site's base URL.
228
   *   - If your external URL contains a query (e.g. http://example.com/foo?a=b),
229
   *     then you can either URL encode the query keys and values yourself and
230
   *     include them in $path, or use $options['query'] to let this function
231
   *     URL encode them.
232
   * @param $options
233
   *   (optional) An associative array of additional options, with the following
234
   *   elements:
235
   *   - 'query': An array of query key/value-pairs (without any URL-encoding) to
236
   *     append to the URL.
237
   *   - 'fragment': A fragment identifier (named anchor) to append to the URL.
238
   *     Do not include the leading '#' character.
239
   *   - 'absolute': Defaults to FALSE. Whether to force the output to be an
240
   *     absolute link (beginning with http:). Useful for links that will be
241
   *     displayed outside the site, such as in an RSS feed.
242
   *   - 'alias': Defaults to FALSE. Whether the given path is a URL alias
243
   *     already.
244
   *   - 'external': Whether the given path is an external URL.
245
   *   - 'language': An optional language object. If the path being linked to is
246
   *     internal to the site, $options['language'] is used to look up the alias
247
   *     for the URL. If $options['language'] is omitted, the global $language_url
248
   *     will be used.
249
   *   - 'https': Whether this URL should point to a secure location. If not
250
   *     defined, the current scheme is used, so the user stays on HTTP or HTTPS
251
   *     respectively. TRUE enforces HTTPS and FALSE enforces HTTP, but HTTPS can
252
   *     only be enforced when the variable 'https' is set to TRUE.
253
   *   - 'base_url': Only used internally, to modify the base URL when a language
254
   *     dependent URL requires so.
255
   *   - 'prefix': Only used internally, to modify the path when a language
256
   *     dependent URL requires so.
257
   *   - 'script': The script filename in Drupal's root directory to use when
258
   *     clean URLs are disabled, such as 'index.php'. Defaults to an empty
259
   *     string, as most modern web servers automatically find 'index.php'. If
260
   *     clean URLs are disabled, the value of $path is appended as query
261
   *     parameter 'q' to $options['script'] in the returned URL. When deploying
262
   *     Drupal on a web server that cannot be configured to automatically find
263
   *     index.php, then hook_url_outbound_alter() can be implemented to force
264
   *     this value to 'index.php'.
265
   *   - 'entity_type': The entity type of the object that called url(). Only
266
   *     set if url() is invoked by entity_uri().
267
   *   - 'entity': The entity object (such as a node) for which the URL is being
268
   *     generated. Only set if url() is invoked by entity_uri().
269
   *
270
   * @return string
271
   *   A string containing a URL to the given path.
272
   */
273
  public function url($path = NULL, array $options = array()) {
274
    return url($path, $options);
275
  }
276
277
  /**
278
   * Invokes a hook in a particular module.
279
   *
280
   * All arguments are passed by value. Use drupal_alter() if you need to pass
281
   * arguments by reference.
282
   *
283
   * @param $module
284
   *   The name of the module (without the .module extension).
285
   * @param $hook
286
   *   The name of the hook to invoke.
287
   * @param ...
288
   *   Arguments to pass to the hook implementation.
289
   *
290
   * @return mixed
291
   *   The return value of the hook implementation.
292
   *
293
   * @see drupal_alter()
294
   */
295
  public function module_invoke($module, $hook) {
296
    $args = func_get_args();
297
    // Remove $module and $hook from the arguments.
298
    unset($args[0], $args[1]);
299
300
    return module_invoke($module, $hook, $args);
301
  }
302
303
  /**
304
   * Invokes a hook in all enabled modules that implement it.
305
   *
306
   * All arguments are passed by value. Use drupal_alter() if you need to pass
307
   * arguments by reference.
308
   *
309
   * @param $hook
310
   *   The name of the hook to invoke.
311
   * @param ...
312
   *   Arguments to pass to the hook.
313
   *
314
   * @return array
315
   *   An array of return values of the hook implementations. If modules return
316
   *   arrays from their implementations, those are merged into one array.
317
   *
318
   * @see drupal_alter()
319
   */
320
  public function module_invoke_all($hook) {
321
    $args = func_get_args();
322
    // Remove $hook from the arguments.
323
    unset($args[0]);
324
325
    return module_invoke_all($hook, $args);
326
  }
327
328
  /**
329
   * Passes alterable variables to specific hook_TYPE_alter() implementations.
330
   *
331
   * This dispatch function hands off the passed-in variables to type-specific
332
   * hook_TYPE_alter() implementations in modules. It ensures a consistent
333
   * interface for all altering operations.
334
   *
335
   * A maximum of 2 alterable arguments is supported (a third is supported for
336
   * legacy reasons, but should not be used in new code). In case more arguments
337
   * need to be passed and alterable, modules provide additional variables
338
   * assigned by reference in the last $context argument:
339
   * @code
340
   *   $context = array(
341
   *     'alterable' => &$alterable,
342
   *     'unalterable' => $unalterable,
343
   *     'foo' => 'bar',
344
   *   );
345
   *   drupal_alter('mymodule_data', $alterable1, $alterable2, $context);
346
   * @endcode
347
   *
348
   * Note that objects are always passed by reference in PHP5. If it is absolutely
349
   * required that no implementation alters a passed object in $context, then an
350
   * object needs to be cloned:
351
   * @code
352
   *   $context = array(
353
   *     'unalterable_object' => clone $object,
354
   *   );
355
   *   drupal_alter('mymodule_data', $data, $context);
356
   * @endcode
357
   *
358
   * @param $type
359
   *   A string describing the type of the alterable $data. 'form', 'links',
360
   *   'node_content', and so on are several examples. Alternatively can be an
361
   *   array, in which case hook_TYPE_alter() is invoked for each value in the
362
   *   array, ordered first by module, and then for each module, in the order of
363
   *   values in $type. For example, when Form API is using drupal_alter() to
364
   *   execute both hook_form_alter() and hook_form_FORM_ID_alter()
365
   *   implementations, it passes array('form', 'form_' . $form_id) for $type.
366
   * @param $data
367
   *   The variable that will be passed to hook_TYPE_alter() implementations to be
368
   *   altered. The type of this variable depends on the value of the $type
369
   *   argument. For example, when altering a 'form', $data will be a structured
370
   *   array. When altering a 'profile', $data will be an object.
371
   * @param $context1
372
   *   (optional) An additional variable that is passed by reference.
373
   * @param $context2
374
   *   (optional) An additional variable that is passed by reference. If more
375
   *   context needs to be provided to implementations, then this should be an
376
   *   associative array as described above.
377
   * @param $context3
378
   *   (optional) An additional variable that is passed by reference. This
379
   *   parameter is deprecated and will not exist in Drupal 8; consequently, it
380
   *   should not be used for new Drupal 7 code either. It is here only for
381
   *   backwards compatibility with older code that passed additional arguments
382
   *   to drupal_alter().
383
   */
384
  public function drupal_alter($type, &$data, &$context1 = NULL, &$context2 = NULL, &$context3 = NULL) {
385
    drupal_alter($type, $data, $context1, $context2, $context3);
386
  }
387
388
  /**
389
   * Includes a file with the provided type and name.
390
   *
391
   * This prevents including a theme, engine, module, etc., more than once.
392
   *
393
   * @param $type
394
   *   The type of item to load (i.e. theme, theme_engine, module).
395
   * @param $name
396
   *   The name of the item to load.
397
   *
398
   * @return bool
399
   *   TRUE if the item is loaded or has already been loaded.
400
   */
401
  public function drupal_load($type, $name) {
402
    return drupal_load($type, $name);
403
  }
404
405
}
406