This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||
| 2 | |||
| 3 | declare(strict_types=1); |
||
| 4 | |||
| 5 | namespace Ray\AuraSqlModule\Pagerfanta; |
||
| 6 | |||
| 7 | use Aura\Sql\ExtendedPdoInterface; |
||
| 8 | use Pagerfanta\Adapter\AdapterInterface; |
||
| 9 | |||
| 10 | use function assert; |
||
| 11 | use function count; |
||
| 12 | use function is_int; |
||
| 13 | use function preg_match; |
||
| 14 | use function preg_replace; |
||
| 15 | use function preg_split; |
||
| 16 | use function strpos; |
||
| 17 | use function strtolower; |
||
| 18 | use function trim; |
||
| 19 | |||
| 20 | use const PHP_EOL; |
||
| 21 | |||
| 22 | /** |
||
| 23 | * @template T |
||
| 24 | * @implements AdapterInterface<T> |
||
| 25 | */ |
||
| 26 | class ExtendedPdoAdapter implements AdapterInterface |
||
| 27 | { |
||
| 28 | private ExtendedPdoInterface $pdo; |
||
| 29 | private string $sql; |
||
| 30 | |||
| 31 | /** @var array<mixed> */ |
||
| 32 | private array $params; |
||
| 33 | private FetcherInterface $fetcher; |
||
| 34 | |||
| 35 | /** |
||
| 36 | * @param array<mixed> $params |
||
| 37 | */ |
||
| 38 | public function __construct(ExtendedPdoInterface $pdo, string $sql, array $params, ?FetcherInterface $fetcher = null) |
||
| 39 | { |
||
| 40 | $this->pdo = $pdo; |
||
| 41 | $this->sql = $sql; |
||
| 42 | $this->params = $params; |
||
| 43 | $this->fetcher = $fetcher ?? new FetchAssoc($pdo); |
||
| 44 | } |
||
| 45 | |||
| 46 | /** |
||
| 47 | * {@inheritdoc} |
||
| 48 | * |
||
| 49 | * @SuppressWarnings(PHPMD.GotoStatement) |
||
| 50 | */ |
||
| 51 | public function getNbResults(): int |
||
| 52 | { |
||
| 53 | // be smart and try to guess the total number of records |
||
| 54 | $countQuery = $this->rewriteCountQuery($this->sql); |
||
| 55 | if (! $countQuery) { |
||
| 56 | // GROUP BY => fetch the whole result set and count the rows returned |
||
| 57 | $result = $this->pdo->perform($this->sql, $this->params)->fetchAll(); |
||
| 58 | $count = ! $result ? 0 : count($result); |
||
| 59 | goto ret; |
||
| 60 | } |
||
| 61 | |||
| 62 | if ($this->params) { |
||
|
0 ignored issues
–
show
|
|||
| 63 | $count = $this->pdo->fetchValue($countQuery, $this->params); |
||
| 64 | goto ret; |
||
| 65 | } |
||
| 66 | |||
| 67 | $count = $this->pdo->fetchValue($countQuery); |
||
| 68 | ret: |
||
| 69 | /** @var string $count */ |
||
| 70 | $nbResult = ! $count ? 0 : (int) $count; |
||
| 71 | assert(is_int($nbResult)); |
||
| 72 | assert($nbResult >= 0); |
||
| 73 | |||
| 74 | return $nbResult; |
||
| 75 | } |
||
| 76 | |||
| 77 | /** |
||
| 78 | * {@inheritdoc} |
||
| 79 | * |
||
| 80 | * @param int $offset |
||
| 81 | * @param int $length |
||
| 82 | * |
||
| 83 | * @return array<mixed> |
||
| 84 | */ |
||
| 85 | public function getSlice(int $offset, int $length): iterable |
||
| 86 | { |
||
| 87 | $sql = $this->sql . $this->getLimitClause($offset, $length); |
||
| 88 | $result = ($this->fetcher)($sql, $this->params); |
||
| 89 | |||
| 90 | return ! $result ? [] : $result; |
||
| 91 | } |
||
| 92 | |||
| 93 | /** |
||
| 94 | * {@inheritdoc} |
||
| 95 | */ |
||
| 96 | public function getLimitClause(int $offset, int $length): string |
||
| 97 | { |
||
| 98 | if ($offset && $length) { |
||
| 99 | return PHP_EOL . "LIMIT {$length} OFFSET {$offset}"; |
||
| 100 | } |
||
| 101 | |||
| 102 | if ($length) { |
||
| 103 | return PHP_EOL . "LIMIT {$length}"; |
||
| 104 | } |
||
| 105 | |||
| 106 | return ''; |
||
| 107 | } |
||
| 108 | |||
| 109 | /** |
||
| 110 | * Return count query |
||
| 111 | * |
||
| 112 | * @param string $query |
||
| 113 | * |
||
| 114 | * @return string |
||
| 115 | * |
||
| 116 | * @see https://github.com/pear/Pager/blob/master/examples/Pager_Wrapper.php |
||
| 117 | * Taken from pear/pager and modified. |
||
| 118 | * tested at https://github.com/pear/Pager/blob/80c0e31c8b94f913cfbdeccbe83b63822f42a2f8/tests/pager_wrapper_test.php#L19 |
||
| 119 | * @codeCoverageIgnore |
||
| 120 | */ |
||
| 121 | public function rewriteCountQuery($query) |
||
| 122 | { |
||
| 123 | if (is_int(strpos(strtolower($query), 'union'))) { |
||
|
0 ignored issues
–
show
|
|||
| 124 | return ''; |
||
| 125 | } |
||
| 126 | |||
| 127 | if (preg_match('/^\s*SELECT\s+\bDISTINCT\b/is', $query) || preg_match('/\s+GROUP\s+BY\s+/is', $query)) { |
||
| 128 | return ''; |
||
| 129 | } |
||
| 130 | |||
| 131 | $openParenthesis = '(?:\()'; |
||
| 132 | $closeParenthesis = '(?:\))'; |
||
| 133 | $subQueryInSelect = $openParenthesis . '.*\bFROM\b.*' . $closeParenthesis; |
||
| 134 | $pattern = '/(?:.*' . $subQueryInSelect . '.*)\bFROM\b\s+/Uims'; |
||
| 135 | if (preg_match($pattern, $query)) { |
||
| 136 | return ''; |
||
| 137 | } |
||
| 138 | |||
| 139 | $subQueryWithLimitOrder = $openParenthesis . '.*\b(LIMIT|ORDER)\b.*' . $closeParenthesis; |
||
| 140 | $pattern = '/.*\bFROM\b.*(?:.*' . $subQueryWithLimitOrder . '.*).*/Uims'; |
||
| 141 | if (preg_match($pattern, $query)) { |
||
| 142 | return ''; |
||
| 143 | } |
||
| 144 | |||
| 145 | $queryCount = preg_replace('/(?:.*)\bFROM\b\s+/Uims', 'SELECT COUNT(*) FROM ', $query, 1); |
||
| 146 | /** @var array<int> $split */ |
||
| 147 | $split = preg_split('/\s+ORDER\s+BY\s+/is', (string) $queryCount); |
||
| 148 | [$queryCount] = $split; |
||
| 149 | /** @var array<int> $split2 */ |
||
| 150 | $split2 = preg_split('/\bLIMIT\b/is', (string) $queryCount); |
||
| 151 | [$queryCount2] = $split2; |
||
| 152 | |||
| 153 | return trim((string) $queryCount2); |
||
| 154 | } |
||
| 155 | } |
||
| 156 |
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.
Consider making the comparison explicit by using
empty(..)or! empty(...)instead.