GeoCacheFileController::__construct() - Code Metrics - Inspection of "adding qr ics code" - OpencachingDeutschland/oc-server3 - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Pull Request — development (#752)

by Thomas

created 2019-02-07 22:26 UTC

GeoCacheFileController::__construct() A

↳ Parent: GeoCacheFileController

Complexity

Conditions	1
Paths	1

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	1
nc	1
nop	2
dl	0
loc	5
rs	10
c	0
b	0
f	0

<?php

namespace Oc\GeoCache\Controller;

use Oc\GeoCache\Persistence\GeoCache\GeoCacheEntity;
use Oc\GeoCache\Persistence\GeoCache\GeoCacheService;
use Oc\GeoCache\Util;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route;
use Symfony\Bundle\FrameworkBundle\Controller\Controller;
use Symfony\Component\HttpFoundation\Request;

class GeoCacheFileController extends Controller
{
    /**
     * @var GeoCacheService
     */
    private $geoCacheService;

    /**
     * @var Util
     */
    private $geoCacheUtil;

    public function __construct(GeoCacheService $geoCacheService, Util $geoCacheUtil)
    {
        $this->geoCacheService = $geoCacheService;
        $this->geoCacheUtil = $geoCacheUtil;
    }

    /**
     * @param Request $request
     * @Route("/api/geocache/qrCodes")
     */
    public function generateQrCode(Request $request): void
    {
        $waypoint = $request->get('wp');
        $geoCache = $this->geoCacheService->fetchByWaypoint($waypoint);

        if (!$geoCache instanceof GeoCacheEntity) {
            throw new \InvalidArgumentException('the waypoint is not valid!');
        }

        header('Content-Type: image/png');

        if ($request->get('download')) {
            header('Content-Disposition: attachment; filename="' . $waypoint . '.png"');
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
        }

        $this->geoCacheUtil->generateQrCodeFromString('https://www.opencaching.de/' . $geoCache->wpOc);
    }

    /**
     * @param Request $request
     * @Route("/api/geocache/qrCodes/ics")
     */
    public function generateQrCodeIcs(Request $request): void
    {
        $waypoint = $request->get('wp');
        $geoCache = $this->geoCacheService->fetchByWaypoint($waypoint);

        if (!$geoCache instanceof GeoCacheEntity && $geoCache->type !== 6) {
            throw new \InvalidArgumentException('the waypoint is not valid or not an event!');
        }

        $icsString = $this->geoCacheUtil->generateIcsStringFromGeoCache($geoCache);
/** @return stdClass|null */
function mayReturnNull() { }

function doesNotAcceptNull(stdClass $x) { }

// With potential error.
function withoutCheck() {
    $x = mayReturnNull();
    doesNotAcceptNull($x); // Potential error here.
}

// Safe - Alternative 1
function withCheck1() {
    $x = mayReturnNull();
    if ( ! $x instanceof stdClass) {
        throw new \LogicException('$x must be defined.');
    }
    doesNotAcceptNull($x);
}

// Safe - Alternative 2
function withCheck2() {
    $x = mayReturnNull();
    if ($x instanceof stdClass) {
        doesNotAcceptNull($x);
    }
}

        if ($request->get('download')) {
            header('Content-Type: text/calendar; charset=utf-8');
            header('Content-Disposition: attachment; filename="' . $geoCache->wpOc . '.ics"');

            echo $icsString;
            die();
        }

        header('Content-Type: image/png');
        $this->geoCacheUtil->generateQrCodeFromString($icsString);
    }
}


1			<?php
2
3			namespace Oc\GeoCache\Controller;
4
5			use Oc\GeoCache\Persistence\GeoCache\GeoCacheEntity;
6			use Oc\GeoCache\Persistence\GeoCache\GeoCacheService;
7			use Oc\GeoCache\Util;
8			use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route;
9			use Symfony\Bundle\FrameworkBundle\Controller\Controller;
10			use Symfony\Component\HttpFoundation\Request;
11
12			class GeoCacheFileController extends Controller
13			{
14			/**
15			* @var GeoCacheService
16			*/
17			private $geoCacheService;
18
19			/**
20			* @var Util
21			*/
22			private $geoCacheUtil;
23
24			public function __construct(GeoCacheService $geoCacheService, Util $geoCacheUtil)
25			{
26			$this->geoCacheService = $geoCacheService;
27			$this->geoCacheUtil = $geoCacheUtil;
28			}
29
30			/**
31			* @param Request $request
32			* @Route("/api/geocache/qrCodes")
33			*/
34			public function generateQrCode(Request $request): void
35			{
36			$waypoint = $request->get('wp');
37			$geoCache = $this->geoCacheService->fetchByWaypoint($waypoint);
38
39			if (!$geoCache instanceof GeoCacheEntity) {
40			throw new \InvalidArgumentException('the waypoint is not valid!');
41			}
42
43			header('Content-Type: image/png');
44
45			if ($request->get('download')) {
46			header('Content-Disposition: attachment; filename="' . $waypoint . '.png"');
			0 ignored issues – show Security Response Splitting introduced 2019-02-07 22:31 UTC by Report Bug Copy Issue Report `'Content-Disposition: at...' . $waypoint . '.png"'` can contain request data and is used in response header context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Request::get() returns tainted data, and `$waypoint` is assigned in htdocs/src/Oc/GeoCache/Controller/GeoCacheFileController.php on line 36 Response Splitting Attacks Allowing an attacker to set a response header, opens your application to response splitting attacks; effectively allowing an attacker to send any response, he would like. General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
47			}
48
49			$this->geoCacheUtil->generateQrCodeFromString('https://www.opencaching.de/' . $geoCache->wpOc);
50			}
51
52			/**
53			* @param Request $request
54			* @Route("/api/geocache/qrCodes/ics")
55			*/
56			public function generateQrCodeIcs(Request $request): void
57			{
58			$waypoint = $request->get('wp');
59			$geoCache = $this->geoCacheService->fetchByWaypoint($waypoint);
60
61			if (!$geoCache instanceof GeoCacheEntity && $geoCache->type !== 6) {
62			throw new \InvalidArgumentException('the waypoint is not valid or not an event!');
63			}
64
65			$icsString = $this->geoCacheUtil->generateIcsStringFromGeoCache($geoCache);
			0 ignored issues – show Bug introduced 2019-02-07 22:31 UTC by Report Bug Copy Issue Report It seems like `$geoCache` defined by `$this->geoCacheService->...chByWaypoint($waypoint)` on line `59` can be `null`; however, `Oc\GeoCache\Util::generateIcsStringFromGeoCache()` does not accept `null`, maybe add an additional type check? Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: /** @return stdClass\|null */ function mayReturnNull() { } function doesNotAcceptNull(stdClass $x) { } // With potential error. function withoutCheck() { $x = mayReturnNull(); doesNotAcceptNull($x); // Potential error here. } // Safe - Alternative 1 function withCheck1() { $x = mayReturnNull(); if ( ! $x instanceof stdClass) { throw new \LogicException('$x must be defined.'); } doesNotAcceptNull($x); } // Safe - Alternative 2 function withCheck2() { $x = mayReturnNull(); if ($x instanceof stdClass) { doesNotAcceptNull($x); } } Loading history...
66
67			if ($request->get('download')) {
68			header('Content-Type: text/calendar; charset=utf-8');
69			header('Content-Disposition: attachment; filename="' . $geoCache->wpOc . '.ics"');
70
71			echo $icsString;
72			die();
73			}
74
75			header('Content-Type: image/png');
76			$this->geoCacheUtil->generateQrCodeFromString($icsString);
77			}
78			}
79

OpencachingDeutschland / oc-server3

Pull Request — development (#752)

GeoCacheFileController::__construct() A

Complexity

Size

Duplication

Importance

1 path for user data to reach this point

Response Splitting Attacks

General Strategies to prevent injection

Duplication Side-by-Side

Filter issues like