Issues in BaseElement.php (master) - Issues in master - Magentron/laravel-html - Measure and Improve Code Quality continuously with Scrutinizer

Issues (42)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/BaseElement.php (2 issues)

Labels

Severity

Minor 2

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

namespace Spatie\Html;

use BadMethodCallException;
use Illuminate\Support\Collection;
use Illuminate\Support\HtmlString;
use Spatie\Html\Exceptions\MissingTag;
use Spatie\Html\Exceptions\InvalidHtml;
use Illuminate\Support\Traits\Macroable;
use Spatie\Html\Exceptions\InvalidChild;
use Illuminate\Contracts\Support\Htmlable;
use Illuminate\Contracts\Support\Arrayable;

abstract class BaseElement implements Htmlable, HtmlElement, Arrayable
{
    use Macroable {
        __call as __macro_call;
    }

    /** @var string */
    protected $tag;

    /** @var \Spatie\Html\Attributes */
    protected $attributes;

    /** @var \Illuminate\Support\Collection */
    protected $children;

    public function __construct()
    {
        if (empty($this->tag)) {
            throw MissingTag::onClass(static::class);
        }

        $this->attributes = new Attributes();
        $this->children = new Collection();
    }

    public static function create()
    {
        return new static();
    }

    /**
     * Get the HTML element (tag, attributes, children) as a plain array.
     *
     * @return array
     */
    public function toArray()
    {
        return [
            'tag'        => (string) $this->tag,
            'attributes' => $this->attributes->toArray(),
            'children'   => $this->children->toArray(),
        ];
    }

    /**
     * @param string $attribute
     * @param string|null $value
     *
     * @return static
     */
    public function attribute($attribute, $value = null)
    {
        $element = clone $this;

        $element->attributes->setAttribute($attribute, (string) $value);

        return $element;
    }

    /**
     * @param iterable $attributes
     *
     * @return static
     */
    public function attributes($attributes)
    {
        $element = clone $this;

        $element->attributes->setAttributes($attributes);

        return $element;
    }

    /**
     * @param string $attribute
     *
     * @return static
     */
    public function forgetAttribute($attribute)
    {
        $element = clone $this;

        $element->attributes->forgetAttribute($attribute);

        return $element;
    }

    /**
     * @param string $attribute
     * @param mixed $fallback
     *
     * @return mixed
     */
    public function getAttribute($attribute, $fallback = null)
    {
        return $this->attributes->getAttribute($attribute, $fallback);
    }

    /**
     * @param string $attribute
     *
     * @return bool
     */
    public function hasAttribute($attribute)
    {
        return $this->attributes->hasAttribute($attribute);
    }

    /**
     * @param iterable|string $class
     *
     * @return static
     */
    public function class_($class)
    {
        return $this->addClass($class);
    }

    /**
     * Alias for `class`.
     *
     * @param iterable|string $class
     *
     * @return static
     */
    public function addClass($class)
    {
        $element = clone $this;

        $element->attributes->addClass($class);

        return $element;
    }

    /**
     * @param string $id
     *
     * @return static
     */
    public function id($id)
    {
        return $this->attribute('id', $id);
    }

    /**
     * @param array|string|null $style
     *
     * @return static
     */
    public function style($style)
    {
        if (is_array($style)) {
            $style = implode('; ', array_map(function ($value, $attribute) {
                return "{$attribute}: {$value}";
            }, $style, array_keys($style)));
        }

        return $this->attribute('style', $style);
    }

    /**
     * @param string $name
     * @param string $value
     *
     * @return static
     */
    public function data($name, $value)
    {
        return $this->attribute("data-{$name}", $value);
    }

    /**
     * @param \Spatie\Html\HtmlElement|string|iterable|null $children
     * @param callable|null $mapper
     *
     * @return static
     */
    public function addChildren($children, $mapper = null)
    {
        if (is_null($children)) {
            return $this;
        }

        $children = $this->parseChildren($children, $mapper);

        $element = clone $this;

        $element->children = $element->children->merge($children);

        return $element;
    }

    /**
     * Alias for `addChildren`.
     *
     * @param \Spatie\Html\HtmlElement|string|iterable|null $children
     * @param callable|null $mapper
     *
     * @return static
     */
    public function addChild($child, $mapper = null)
    {
        return $this->addChildren($child, $mapper);
    }

    /**
     * Alias for `addChildren`.
     *
     * @param \Spatie\Html\HtmlElement|string|iterable|null $children
     * @param callable|null $mapper
     *
     * @return static
     */
    public function child($child, $mapper = null)
    {
        return $this->addChildren($child, $mapper);
    }

    /**
     * Alias for `addChildren`.
     *
     * @param \Spatie\Html\HtmlElement|string|iterable|null $children
     * @param callable|null $mapper
     *
     * @return static
     */
    public function children($children, $mapper = null)
    {
        return $this->addChildren($children, $mapper);
    }

    /**
     * Replace all children with an array of elements.
     *
     * @param \Spatie\Html\HtmlElement[] $children
     * @param callable|null $mapper
     *
     * @return static
     */
    public function setChildren($children, $mapper = null)
    {
        $element = clone $this;

        $element->children = new Collection();

        return $element->addChildren($children, $mapper);
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
    }

    /**
     * @param \Spatie\Html\HtmlElement|string|iterable|null $children
     * @param callable|null $mapper
     *
     * @return static
     */
    public function prependChildren($children, $mapper = null)
    {
        $children = $this->parseChildren($children, $mapper);

        $element = clone $this;

        $element->children = $children->merge($element->children);

        return $element;
    }

    /**
     * Alias for `prependChildren`.
     *
     * @param \Spatie\Html\HtmlElement|string|iterable|null $children
     * @param callable|null $mapper
     *
     * @return static
     */
    public function prependChild($children, $mapper = null)
    {
        return $this->prependChildren($children, $mapper);
    }

    /**
     * @param string|null $text
     *
     * @return static
     */
    public function text($text)
    {
        return $this->html(htmlentities($text, ENT_QUOTES, 'UTF-8', false));
    }

    /**
     * @param string|null $html
     *
     * @return static
     */
    public function html($html)
    {
        if ($this->isVoidElement()) {
            throw new InvalidHtml("Can't set inner contents on `{$this->tag}` because it's a void element");
        }

        return $this->setChildren($html);
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
    }

    /**
     * Condintionally transform the element. Note that since elements are
     * immutable, you'll need to return a new instance from the callback.
     *
     * @param bool $condition
     * @param callable $callback
     * @return BaseElement|$this
     */
    public function if_($condition, callable $callback)
    {
        if ($condition) {
            return $callback($this);
        }

        return $this;
    }

    /**
     * @return \Illuminate\Contracts\Support\Htmlable
     */
    public function open()
    {
        $tag = $this->attributes->isEmpty()
            ? '<'.$this->tag.'>'
            : "<{$this->tag} {$this->attributes->render()}>";

        $children = $this->children->map(function ($child) {
            if ($child instanceof HtmlElement) {
                return (string) $child->render();
            }

            if (is_null($child)) {
                return '';
            }

            if (is_string($child)) {
                return $child;
            }

            throw InvalidChild::childMustBeAnHtmlElementOrAString();
        })->implode('');

        return new HtmlString($tag.$children);
    }

    /**
     * @return \Illuminate\Contracts\Support\Htmlable
     */
    public function close()
    {
        return new HtmlString(
            $this->isVoidElement()
                ? ''
                : "</{$this->tag}>"
        );
    }

    /**
     * @return \Illuminate\Contracts\Support\Htmlable
     */
    public function render()
    {
        return new HtmlString(
            $this->open().$this->close()
        );
    }

    /**
     * @return bool
     */
    public function isVoidElement()
    {
        return in_array($this->tag, [
            'area', 'base', 'br', 'col', 'embed', 'hr',
            'img', 'input', 'keygen', 'link', 'menuitem',
            'meta', 'param', 'source', 'track', 'wbr',
        ]);
    }

    /**
     * Dynamically handle calls to the class.
     * Check for methods finishing by If or fallback to Macroable.
     *
     * @param  string  $method
     * @param  array   $parameters
     * @return mixed
     *
     * @throws BadMethodCallException
     */
    public function __call($name, $arguments)
    {
        if (ends_with($name, 'If')) {
            $name = str_replace('If', '', $name);
            if ('class' === $name) {
                $name = 'class_';
            }
            if (! method_exists($this, $name)) {
                throw new BadMethodCallException("$name is not a valid method for this class");
            }

            $condition = (bool) array_shift($arguments);

            return $condition ?
                $this->{$name}(...$arguments) :
                $this;
        }

        foreach (['class', 'for', 'if'] as $keyword) {
            if ($keyword === $name && method_exists($this, $keyword.'_')) {
                $name = $keyword.'_';

                return $this->{$name}(...$arguments);
            }
        }

        return $this->__macro_call($name, $arguments);
    }

    public function __clone()
    {
        $this->attributes = clone $this->attributes;
        $this->children = clone $this->children;
    }

    /**
     * @return string
     */
    public function __toString()
    {
        return (string) $this->render();
    }

    /**
     * @return string
     */
    public function toHtml()
    {
        return (string) $this->render();
    }

    /**
     * @return Collection
     */
    protected function parseChildren($children, $mapper = null)
    {
        if ($children instanceof HtmlElement) {
            $children = [$children];
        }

        $children = Collection::make($children);

        if ($mapper) {
            $children = $children->map($mapper);
        }

        $this->guardAgainstInvalidChildren($children);

        return $children;
    }

    protected function guardAgainstInvalidChildren(Collection $children)
    {
        foreach ($children as $child) {
            if ((! $child instanceof HtmlElement) && (! is_string($child)) && (! is_null($child))) {
                throw InvalidChild::childMustBeAnHtmlElementOrAString();
            }
        }
    }
}


1		<?php
2
3		namespace Spatie\Html;
4
5		use BadMethodCallException;
6		use Illuminate\Support\Collection;
7		use Illuminate\Support\HtmlString;
8		use Spatie\Html\Exceptions\MissingTag;
9		use Spatie\Html\Exceptions\InvalidHtml;
10		use Illuminate\Support\Traits\Macroable;
11		use Spatie\Html\Exceptions\InvalidChild;
12		use Illuminate\Contracts\Support\Htmlable;
13		use Illuminate\Contracts\Support\Arrayable;
14
15		abstract class BaseElement implements Htmlable, HtmlElement, Arrayable
16		{
17		use Macroable {
18		__call as __macro_call;
19		}
20
21		/** @var string */
22		protected $tag;
23
24		/** @var \Spatie\Html\Attributes */
25		protected $attributes;
26
27		/** @var \Illuminate\Support\Collection */
28		protected $children;
29
30		public function __construct()
31		{
32		if (empty($this->tag)) {
33		throw MissingTag::onClass(static::class);
34		}
35
36		$this->attributes = new Attributes();
37		$this->children = new Collection();
38		}
39
40		public static function create()
41		{
42		return new static();
43		}
44
45		/**
46		* Get the HTML element (tag, attributes, children) as a plain array.
47		*
48		* @return array
49		*/
50		public function toArray()
51		{
52		return [
53		'tag' => (string) $this->tag,
54		'attributes' => $this->attributes->toArray(),
55		'children' => $this->children->toArray(),
56		];
57		}
58
59		/**
60		* @param string $attribute
61		* @param string\|null $value
62		*
63		* @return static
64		*/
65		public function attribute($attribute, $value = null)
66		{
67		$element = clone $this;
68
69		$element->attributes->setAttribute($attribute, (string) $value);
70
71		return $element;
72		}
73
74		/**
75		* @param iterable $attributes
76		*
77		* @return static
78		*/
79		public function attributes($attributes)
80		{
81		$element = clone $this;
82
83		$element->attributes->setAttributes($attributes);
84
85		return $element;
86		}
87
88		/**
89		* @param string $attribute
90		*
91		* @return static
92		*/
93		public function forgetAttribute($attribute)
94		{
95		$element = clone $this;
96
97		$element->attributes->forgetAttribute($attribute);
98
99		return $element;
100		}
101
102		/**
103		* @param string $attribute
104		* @param mixed $fallback
105		*
106		* @return mixed
107		*/
108		public function getAttribute($attribute, $fallback = null)
109		{
110		return $this->attributes->getAttribute($attribute, $fallback);
111		}
112
113		/**
114		* @param string $attribute
115		*
116		* @return bool
117		*/
118		public function hasAttribute($attribute)
119		{
120		return $this->attributes->hasAttribute($attribute);
121		}
122
123		/**
124		* @param iterable\|string $class
125		*
126		* @return static
127		*/
128		public function class_($class)
129		{
130		return $this->addClass($class);
131		}
132
133		/**
134		* Alias for `class`.
135		*
136		* @param iterable\|string $class
137		*
138		* @return static
139		*/
140		public function addClass($class)
141		{
142		$element = clone $this;
143
144		$element->attributes->addClass($class);
145
146		return $element;
147		}
148
149		/**
150		* @param string $id
151		*
152		* @return static
153		*/
154		public function id($id)
155		{
156		return $this->attribute('id', $id);
157		}
158
159		/**
160		* @param array\|string\|null $style
161		*
162		* @return static
163		*/
164		public function style($style)
165		{
166		if (is_array($style)) {
167		$style = implode('; ', array_map(function ($value, $attribute) {
168		return "{$attribute}: {$value}";
169		}, $style, array_keys($style)));
170		}
171
172		return $this->attribute('style', $style);
173		}
174
175		/**
176		* @param string $name
177		* @param string $value
178		*
179		* @return static
180		*/
181		public function data($name, $value)
182		{
183		return $this->attribute("data-{$name}", $value);
184		}
185
186		/**
187		* @param \Spatie\Html\HtmlElement\|string\|iterable\|null $children
188		* @param callable\|null $mapper
189		*
190		* @return static
191		*/
192	View Code Duplication	public function addChildren($children, $mapper = null)
193		{
194		if (is_null($children)) {
195		return $this;
196		}
197
198		$children = $this->parseChildren($children, $mapper);
199
200		$element = clone $this;
201
202		$element->children = $element->children->merge($children);
203
204		return $element;
205		}
206
207		/**
208		* Alias for `addChildren`.
209		*
210		* @param \Spatie\Html\HtmlElement\|string\|iterable\|null $children
211		* @param callable\|null $mapper
212		*
213		* @return static
214		*/
215		public function addChild($child, $mapper = null)
216		{
217		return $this->addChildren($child, $mapper);
218		}
219
220		/**
221		* Alias for `addChildren`.
222		*
223		* @param \Spatie\Html\HtmlElement\|string\|iterable\|null $children
224		* @param callable\|null $mapper
225		*
226		* @return static
227		*/
228		public function child($child, $mapper = null)
229		{
230		return $this->addChildren($child, $mapper);
231		}
232
233		/**
234		* Alias for `addChildren`.
235		*
236		* @param \Spatie\Html\HtmlElement\|string\|iterable\|null $children
237		* @param callable\|null $mapper
238		*
239		* @return static
240		*/
241		public function children($children, $mapper = null)
242		{
243		return $this->addChildren($children, $mapper);
244		}
245
246		/**
247		* Replace all children with an array of elements.
248		*
249		* @param \Spatie\Html\HtmlElement[] $children
250		* @param callable\|null $mapper
251		*
252		* @return static
253		*/
254		public function setChildren($children, $mapper = null)
255		{
256		$element = clone $this;
257
258		$element->children = new Collection();
259
260		return $element->addChildren($children, $mapper);
		0 ignored issues – show Documentation introduced 2018-05-21 21:25 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$children` is of type `array<integer,object<Spatie\Html\HtmlElement>>`, but the function expects a `object<Spatie\Html\HtmlE...tie\Html\iterable>\|null`. It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { } $x = '123'; // string "123" // Instead of acceptsInteger($x); // we recommend to use acceptsInteger((integer) $x); Loading history...
261		}
262
263		/**
264		* @param \Spatie\Html\HtmlElement\|string\|iterable\|null $children
265		* @param callable\|null $mapper
266		*
267		* @return static
268		*/
269	View Code Duplication	public function prependChildren($children, $mapper = null)
270		{
271		$children = $this->parseChildren($children, $mapper);
272
273		$element = clone $this;
274
275		$element->children = $children->merge($element->children);
276
277		return $element;
278		}
279
280		/**
281		* Alias for `prependChildren`.
282		*
283		* @param \Spatie\Html\HtmlElement\|string\|iterable\|null $children
284		* @param callable\|null $mapper
285		*
286		* @return static
287		*/
288		public function prependChild($children, $mapper = null)
289		{
290		return $this->prependChildren($children, $mapper);
291		}
292
293		/**
294		* @param string\|null $text
295		*
296		* @return static
297		*/
298		public function text($text)
299		{
300		return $this->html(htmlentities($text, ENT_QUOTES, 'UTF-8', false));
301		}
302
303		/**
304		* @param string\|null $html
305		*
306		* @return static
307		*/
308		public function html($html)
309		{
310		if ($this->isVoidElement()) {
311		throw new InvalidHtml("Can't set inner contents on `{$this->tag}` because it's a void element");
312		}
313
314		return $this->setChildren($html);
		0 ignored issues – show Documentation introduced 2018-05-21 21:25 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$html` is of type `string\|null`, but the function expects a `array<integer,object<Spatie\Html\HtmlElement>>`. It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { } $x = '123'; // string "123" // Instead of acceptsInteger($x); // we recommend to use acceptsInteger((integer) $x); Loading history...
315		}
316
317		/**
318		* Condintionally transform the element. Note that since elements are
319		* immutable, you'll need to return a new instance from the callback.
320		*
321		* @param bool $condition
322		* @param callable $callback
323		* @return BaseElement\|$this
324		*/
325		public function if_($condition, callable $callback)
326		{
327		if ($condition) {
328		return $callback($this);
329		}
330
331		return $this;
332		}
333
334		/**
335		* @return \Illuminate\Contracts\Support\Htmlable
336		*/
337		public function open()
338		{
339		$tag = $this->attributes->isEmpty()
340		? '<'.$this->tag.'>'
341		: "<{$this->tag} {$this->attributes->render()}>";
342
343		$children = $this->children->map(function ($child) {
344		if ($child instanceof HtmlElement) {
345		return (string) $child->render();
346		}
347
348		if (is_null($child)) {
349		return '';
350		}
351
352		if (is_string($child)) {
353		return $child;
354		}
355
356		throw InvalidChild::childMustBeAnHtmlElementOrAString();
357		})->implode('');
358
359		return new HtmlString($tag.$children);
360		}
361
362		/**
363		* @return \Illuminate\Contracts\Support\Htmlable
364		*/
365		public function close()
366		{
367		return new HtmlString(
368		$this->isVoidElement()
369		? ''
370		: "</{$this->tag}>"
371		);
372		}
373
374		/**
375		* @return \Illuminate\Contracts\Support\Htmlable
376		*/
377		public function render()
378		{
379		return new HtmlString(
380		$this->open().$this->close()
381		);
382		}
383
384		/**
385		* @return bool
386		*/
387		public function isVoidElement()
388		{
389		return in_array($this->tag, [
390		'area', 'base', 'br', 'col', 'embed', 'hr',
391		'img', 'input', 'keygen', 'link', 'menuitem',
392		'meta', 'param', 'source', 'track', 'wbr',
393		]);
394		}
395
396		/**
397		* Dynamically handle calls to the class.
398		* Check for methods finishing by If or fallback to Macroable.
399		*
400		* @param string $method
401		* @param array $parameters
402		* @return mixed
403		*
404		* @throws BadMethodCallException
405		*/
406		public function __call($name, $arguments)
407		{
408		if (ends_with($name, 'If')) {
409		$name = str_replace('If', '', $name);
410		if ('class' === $name) {
411		$name = 'class_';
412		}
413		if (! method_exists($this, $name)) {
414		throw new BadMethodCallException("$name is not a valid method for this class");
415		}
416
417		$condition = (bool) array_shift($arguments);
418
419		return $condition ?
420		$this->{$name}(...$arguments) :
421		$this;
422		}
423
424		foreach (['class', 'for', 'if'] as $keyword) {
425		if ($keyword === $name && method_exists($this, $keyword.'_')) {
426		$name = $keyword.'_';
427
428		return $this->{$name}(...$arguments);
429		}
430		}
431
432		return $this->__macro_call($name, $arguments);
433		}
434
435		public function __clone()
436		{
437		$this->attributes = clone $this->attributes;
438		$this->children = clone $this->children;
439		}
440
441		/**
442		* @return string
443		*/
444		public function __toString()
445		{
446		return (string) $this->render();
447		}
448
449		/**
450		* @return string
451		*/
452		public function toHtml()
453		{
454		return (string) $this->render();
455		}
456
457		/**
458		* @return Collection
459		*/
460		protected function parseChildren($children, $mapper = null)
461		{
462		if ($children instanceof HtmlElement) {
463		$children = [$children];
464		}
465
466		$children = Collection::make($children);
467
468		if ($mapper) {
469		$children = $children->map($mapper);
470		}
471
472		$this->guardAgainstInvalidChildren($children);
473
474		return $children;
475		}
476
477		protected function guardAgainstInvalidChildren(Collection $children)
478		{
479		foreach ($children as $child) {
480		if ((! $child instanceof HtmlElement) && (! is_string($child)) && (! is_null($child))) {
481		throw InvalidChild::childMustBeAnHtmlElementOrAString();
482		}
483		}
484		}
485		}
486

Magentron / laravel-html

Issues (42)

Security Analysis no request data

src/BaseElement.php (2 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like