Issues (302)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Connectors/Wikipedia/WikiToApi.php (12 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Integrations\Connectors\Wikipedia;
4
5
use Log;
6
use App\Models\User;
7
8
/* PHP-Wiki-API: This is a simple class to get short Wikipedia info boxes from a given Keyword.
9
 *
10
 * @package    PHP-Wiki-API
11
 * @copyright  Copyright (c) 2019 Igor Gaffling <[email protected]>
12
 * @license    https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt  LGPL License
13
 * @version    Release: @1.1@
14
 * @link       https://github.com/gaffling/PHP-Wiki-API
15
 * @since      Class available since Release 1.0
16
 *
17
 * @example    <php>
18
 *             require_once __DIR__.'/wiki2api.php'; // Include the Wikipedia API Class
19
 *             $wiki = new wiki();                   // Start the Wikipedia API Class
20
 *             echo $wiki->api($_GET['q']);          // Output the API Response
21
 *             </php>
22
 */
23
24
25
class WikiToApi
26
{
27
  
28
29
    // Read and set Parameters
30
    public function __construct($params=array())
31
    {
32
    
33
        // Default Values
34
        $defaults = array(
35
        'language'      => 'de',
36
        'userAgent'     => 'WikiBot/1.0 (+http://'.$_SERVER['SERVER_NAME'].'/)',
37
        'betterResults' => true,
38
        'proxy'         => '',
39
        'imageProxy'    => true,
40
        'DEBUG'         => '',
41
        );
42
    
43
        // Merge Parameters and Defaults
44
        $this->params = array_merge($defaults, $params);
0 ignored issues
show
The property params does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
45
    }
46
47
    // Helper Function to get the Content from the API URL
48
    private function getContent($url, $user_agent, $proxy='')
49
    {
50
51
        // Hopfully we run PHP 4 >= 4.3.0
52
        if (function_exists('file_get_contents')) {
53
      
54
            // Set User-Agent and Proxy
55
            $context = array (
56
            'http' => array (
57
            'user_agent'      => $user_agent,
58
            'proxy'           => $proxy, 
59
            'request_fulluri' => true,
60
            ),
61
            );
62
      
63
            // Build Stream Context
64
            $context = stream_context_create($context);
65
      
66
            // Use file_get_contents() Function and hide Error with @
67
            $content = @file_get_contents($url, null, $context);
68
        }
69
        else // We run PHP < 4.3.0 - OMG :-o
70
        {
71
      
72
            // Ini Var
73
            $content = ''; 
74
      
75
            // Open URL and hide Error with @
76
            if($handle = @fopen($url, 'r')) {
77
        
78
                // While there is Data
79
                while (!feof($handle))
80
                { 
81
          
82
                    // Read the Data-Line
83
                    $line = fgets($handle, 4096);
84
          
85
                    // Add the Data-Line to the Content Var
86
                    $content .= $line; 
87
                }
88
        
89
                // Better Close the FileHandle after the fgets()
90
                fclose($handle);
91
            }
92
        }
93
    
94
        // The Function returns the Content
95
        return $content;
96
    }
97
98
    // Call the API Main Function
99
    public function api($query)
100
    {
101
102
        // Ini Vars
103
        $text = $image = $description = '';
104
105
        // Convert Query to Lowercase for Headline
106
        $strtolower = mb_strtolower($query);
107
108
        // Convert Headlie to UTF-8 Uppercase Words
109
        $headline = mb_convert_case($strtolower, MB_CASE_TITLE, 'UTF-8');
110
111
        // If Query is complete Uppercase make also complete Uppercase Headline
112
        if ($query === strtoupper($query)) { 
113
            $headline = mb_strtoupper($query);
114
        }
115
116
        // Replace spaces in Query to Underscore and use Uppercase Words from Headline 
117
        $query = str_replace(' ', '_', $headline);
118
119
        // In DEBUG Mode print Query
120 View Code Duplication
        if ($this->params['DEBUG']=='KEY' || $this->params['DEBUG']=='ALL') {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
121
            echo '<tt><b>Search-Keyword </b><xmp>#'.$query.'#</xmp></tt>';
122
        }
123
124
        // First search the API if betterResults==true
125
        if ($this->params['betterResults'] == true) {
126
127
            // Wikipedia API URL 1 - https://en.wikipedia.org/w/api.php
128
            $url = 'https://'.$this->params['language'].'.wikipedia.org/w/api.php'.
129
             '?action=query&format=json&list=search&srsearch=intitle:'.$query.
130
             '&maxlag=1'; /* stop if wiki server is busy */
131
      
132
            // If API Call 1 could be reached
133
            if ($api = $this->getContent($url, $this->params['userAgent'], $this->params['proxy'])) {
134
135
                // Decode the 1 Response
136
                $data = json_decode($api, true);
137
138
                // In DEBUG Mode print 1 Response
139 View Code Duplication
                if ($this->params['DEBUG']=='API1' || $this->params['DEBUG']=='ALL') {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
140
                    echo '<pre><b>Search API-Call (1) Response</b> ';
141
                    echo var_dump($data); 
0 ignored issues
show
Security Debugging Code introduced by
var_dump($data); looks like debug code. Are you sure you do not want to remove it? This might expose sensitive data.
Loading history...
142
                    echo '</pre>';
143
                }
144
145
                // If there is a search Result
146
                if (isset($data['query']['search'][0]['title'])) {
147
148
                    // Set Headline
149
                    $headline = $data['query']['search'][0]['title'];
150
151
                    // Set the Query to the first Search Result (and replace Spaces with Underscores)
152
                    $query = str_replace(' ', '_', $data['query']['search'][0]['title']);
153
154
                    // In DEBUG Mode print Found Keyword
155 View Code Duplication
                    if ($this->params['DEBUG']=='KEY' || $this->params['DEBUG']=='ALL') {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
156
                        echo '<tt><b>Found Search-Keyword </b><xmp>#'.$query.'#</xmp></tt>';
157
                    }
158
                }
159
160
                // If Search Result is a 'Did you mean:' Hint
161
                if (isset($data['query']['searchinfo']['suggestion'])) {
162
163
                    // Set Text Hints depending on selected Language
164
                    if ($this->params['language'] == 'de') {
165
                        $suggestionText = 'Meinten Sie: ';
166
                    } 
167
                    else
168
                    {
169
                        $suggestionText = 'Did you mean: ';
170
                    }
171
172
                    // Remove 'q=' Variable=Value Pair from Querystring
173
                    $QUERY_STRING = preg_replace('/'.('q'?'(\&|)q(\=(.*?)((?=&(?!amp\;))|$)|(.*?)\b)':'(\?.*)').'/i', '', $_SERVER['QUERY_STRING']);
174
175
                    // Delete 'intitle:' from Suggestion Keyword
176
                    $suggestion = str_replace('intitle:', '', $data['query']['searchinfo']['suggestion']);
177
178
                    // Make Suggestion UTF-8 Uppercase Words
179
                    $suggestion = mb_convert_case($suggestion, MB_CASE_TITLE, 'UTF-8');
180
181
                    // Make HTML Link for Suggestion
182
                    $description = $suggestionText.'<a href="?q='.
183
                         str_replace(' ', '_', $suggestion).$QUERY_STRING.'">'.$suggestion.'</a>';                         
184
                }
185
            }
186
        }
187
188
        // Wikipedia API URL 2 - https://en.wikipedia.org/w/api.php
189
        $url = 'https://'.$this->params['language'].
190
           '.wikipedia.org/api/rest_v1/page/summary/'.$query.
191
           '?maxlag=1'; /* stop if wiki server is busy */
192
193
        // If API Call 2 could be reached
194
        if ($api = $this->getContent($url, $this->params['userAgent'], $this->params['proxy'])) {
195
            // Decode the 2 Response
196
            $data = json_decode($api, true);
197
198
            // In DEBUG Mode print 2 Response
199 View Code Duplication
            if ($this->params['DEBUG']=='API2' || $this->params['DEBUG']=='ALL') {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
200
                echo '<pre><b>Main API-Call (2) Response</b> ';
201
                echo var_dump($data);
202
                echo '</pre>';
203
            }
204
205
            // If there is an Image in the Search Result
206
            if (isset($data['originalimage']['source'])) {
207
208
                // If the DSGVO imageProxy should be use define it
209
                $proxy = '';
210
                if ($this->params['imageProxy']==true) {
211
                    $proxy = 'wiki-image-proxy.php?url=';
212
                }
213
214
                // Build HTML for Image
215
                $image = '<img src="'.$proxy.$data['thumbnail']['source'].'" />';
216
            }
217
218
            // Correct the Text
219
            $text = str_replace('#', ': ', $data['extract_html']);
220
221
            // If there is a Description
222
            if (isset($data['description'])) {
223
224
                // Correct the Description depending on selected Language
225
                $description = str_replace(
226
                    array(
227
                    'Wikimedia-Begriffsklärungsseite',
228
                    'Disambiguation page providing links to topics that could be referred to by the same search term'
229
                    ),
230
                    array(
231
                    'kann sich auf Folgendes beziehen',
232
                    'may refer to the following'
233
                    ),
234
                    $data['description']
235
                );
236
237
                // Set Keyword to UTF-8 Uppercase Words of Query
238
                $keyword = mb_convert_case($strtolower, MB_CASE_TITLE, 'UTF-8');
239
240
                // Highlight the Query in the Text and Delete some Text
241
                $text = str_replace(
242
                    array($keyword, ' may refer to', ' steht für:'), 
243
                    array('<b class="hint">'.$keyword.'</b>', '', ''), 
244
                    $text
245
                );
246
            }
247
248
            // If there is no Article Text set a Default depending on selected Language
249
            // e.g. q=Leonardo%20di%20caprio&language=de OR q=100&language=de
250
            if ($text == '') {
251
                $description = $image = '';
0 ignored issues
show
$image is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
$description is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
252 View Code Duplication
                if ($this->params['language'] == 'de') {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
253
                    $text = 'Zu diesem Stichwort ist kein Artikel vorhanden.';
0 ignored issues
show
$text is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
254
                }
255
                else if($text == '') {
256
                    $text = 'There is no article available for this keyword.';
0 ignored issues
show
$text is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
257
                }
258
                return; // ONLY IF YOU WHANT NO OUTPUT !!
259
            }      
260
        }
261
262
        // Build the HTML Output
263 View Code Duplication
        if ($this->params['language']=='de') {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
264
            $moreAbout = 'Mehr &uuml;ber';
265
            $from = 'bei';    
266
        }
267
        else
268
        {
269
            $moreAbout = 'More about';
270
            $from = 'from';    
271
        }
272
273
        // Without any Search Result return nothing
274
        if ($text == '' && $description == '') {
275
            return '';
276
        }
277
278
        // With a Search Resuld build a Footer Link
279
        if ($text != '') {
280
            $footer = $moreAbout.' &raquo;'.$headline.'&laquo; '.$from;
281
            $url = 'https://'.$this->params['language'].'.wikipedia.org/wiki/'.$query;
282
        }
283
        else if ($description != '') {
284
            // Footer Link for Suggestion-Link
285
            $footer = '';
286
            $url = 'https://'.$this->params['language'].'.wikipedia.org/';
287
        }
288
289
        // Use the Template
290
        ob_start();
291
        include 'wiki2tpl.phtm';
292
    
293
        // Return the HTML
294
        return ob_get_clean();    
295
296
    }
297
298
}
299