Issues in CertainApiClient.php (master) - Issues in master - Wabel/certain-api-wrapper - Measure and Improve Code Quality continuously with Scrutinizer

Issues (29)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/CertainApiClient.php (4 issues)

Labels

Duplication 4

Severity

Informational 4

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

namespace Wabel\CertainAPI;

use GuzzleHttp\Client;
use GuzzleHttp\Exception\ClientException;
use Wabel\CertainAPI\Response\CertainResponse;
use Psr\Http\Message\ResponseInterface;

/**
 * CertainApiClient
 * @see http://developer.certain.com/api2docs/introduction
 */
class CertainApiClient
{
    /**
     * URL for call request
     *
     * @var string
     */
    private $baseUri = 'https://appeu.certain.com/certainExternal/service/v1/';

    /**
     *
     * @var Client
     */
    private $client;

    /**
     * AccountCode to put in the URI
     *
     * @var string
     */
    private $accountCode;

    /**
     *
     * @var string
     */
    private $builPath;

    /**
     *
     * @var string
     */
    private $username;

    /**
     *
     * @var string
     */
    private $password;

    /**
     *
     * @param string|null $baseUri
     * @param string $username
     * @param string $password
     * @param string $accountCode
     */
    public function __construct($baseUri, $username, $password,
                                $accountCode)
    {
        if ($baseUri !== null) {
            $this->baseUri = $baseUri;
        }
        $this->username = $username;
        $this->password = $password;
        $this->accountCode = $accountCode;
        $this->setClient(new Client([
            'base_uri' => $this->baseUri
            ]
        ));
    }

    /**
     *
     * @return Client
     */
    public function getClient()
    {
        return $this->client;
    }

    /**
     * Define a client
     * @param Client $client
     * @return \Wabel\CertainAPI\CertainApiClient
     */
    public function setClient(Client $client)
    {
        $this->client = $client;
        return $this;
    }

    /**
     * Get Account Code
     * @return string
     */
    public function getAccountCode()
    {
        return $this->accountCode;
    }

    /**
     * Build the URI to request
     * @param string|array $ressourceName
     * @param string $ressourceId
     * @return string
     */
    private function builPathToCall($ressourceName,$ressourcePath =null, $ressourceId = null)
    {
        $ressourceAdded = '';
        if(!is_null($ressourcePath) && $ressourcePath != ''){
            $ressourceAdded = $ressourcePath;
        }

        if ($ressourceId !== null) {
            $ressourceAdded = '/'.$ressourceId;
        }
        if(!is_null($ressourcePath)){
            $this->builPath = 'accounts/'.$this->getAccountCode().$ressourceAdded;
            return  $this->builPath;
        }else{
            $this->builPath = $ressourceName.'/'.$this->getAccountCode().$ressourceAdded;
            return  $this->builPath;
        }

    }

    /**
     * Make "GET" request with the client.
     * @param string $ressourceName
     * @param string $ressourcePath
     * @param string $ressourceId
     * @param array $query
     * @param boolean $assoc
     * @param string $contentType
     * @return array
     */
    public function get($ressourceName, $ressourcePath =null, $ressourceId = null, $query = array(),

                        $assoc = false, $contentType = 'json')
    {
        try {
            $urlRessource = $this->builPathToCall($ressourceName, $ressourcePath, $ressourceId);
            $response     = $this->getClient()->get($urlRessource,
                array(
                'auth' => [$this->username, $this->password],
                'headers' => ['Accept' => "application/$contentType"],
                'query' => $query,
                'verify' => false
            ));
        } catch (ClientException $ex) {
            $response = $ex->getResponse();
        }
        return $this->makeCertainApiResponse($response, $contentType, $assoc);
    }

    /**
     * Make "POST" request with the client.
     * @param string $ressourceName
     * @param string $ressourcePath
     * @param string $ressourceId
     * @param array $bodyData
     * @param array $query
     * @param boolean $assoc
     * @param string $contentType
     * @return array
     */
    public function post($ressourceName, $ressourcePath =null, $ressourceId = null,

                         $bodyData = array(), $query = array(), $assoc = false,
                         $contentType = 'json')
    {
        if ($contentType !== 'json') {
            throw new \Exception('Use only json to update or create');
        }
        try {
            $urlRessource = $this->builPathToCall($ressourceName, $ressourcePath, $ressourceId);
            $response     = $this->getClient()->post($urlRessource,
                array(
                'auth' => [$this->username, $this->password],
                'headers' => ['Accept' => "application/$contentType"],
                'json' => $bodyData,
                'query' => $query,
                'verify' => false
            ));
        } catch (ClientException $ex) {
            $response = $ex->getResponse();
        }
        return $this->makeCertainApiResponse($response, $contentType, $assoc);
    }

    /**
     * Make "PUT" request with the client.
     * @param string $ressourceName
     * @param string $ressourcePath
     * @param string $ressourceId
     * @param array $bodyData
     * @param array $query
     * @param boolean $assoc
     * @param string $contentType
     * @return array
     */
    public function put($ressourceName, $ressourcePath =null, $ressourceId = null,

                         $bodyData = array(), $query = array(), $assoc = false,
                         $contentType = 'json')
    {
        if ($contentType !== 'json') {
            throw new \Exception('Use only json to update or create');
        }
        try {
            $urlRessource = $this->builPathToCall($ressourceName, $ressourcePath, $ressourceId);
            $response     = $this->getClient()->put($urlRessource,
                array(
                'auth' => [$this->username, $this->password],
                'headers' => ['Accept' => "application/$contentType"],
                'json' => $bodyData,
                'query' => $query,
                'verify' => false
            ));
        } catch (ClientException $ex) {
            $response = $ex->getResponse();
        }
        return $this->makeCertainApiResponse($response, $contentType, $assoc);
    }

    /**
     * Make "DELETE" request with the client.
     * @param string $ressourceName
     * @param string $ressourcePath
     * @param string $ressourceId
     * @param boolean $assoc
     * @param string $contentType
     * @return array
     */
    public function delete($ressourceName, $ressourcePath =null, $ressourceId = null, $assoc = false,

                           $contentType = 'json')
    {
        try {
            $urlRessource = $this->builPathToCall($ressourceName, $ressourcePath, $ressourceId);
            $response     = $this->getClient()->delete($urlRessource,
                array(
                'auth' => [$this->username, $this->password],
                'headers' => ['Accept' => "application/$contentType"],
                'verify' => false
            ));
        } catch (ClientException $ex) {
            $response = $ex->getResponse();
        }
        return $this->makeCertainApiResponse($response, $contentType, $assoc);
    }

    /**
     * Make the  Certain Api repsonse.
     * @param ResponseInterface|null $response
     * @param string $contentType
     * @param boolean $assoc
     * @return array
     */
    private function makeCertainApiResponse($response,
                                            $contentType = 'json', $assoc = false)
    {

        $responseCertainApi = new CertainResponse($response);
        return $responseCertainApi->getResponse($contentType, $assoc);
    }

    public function getBuilPath()
    {
        return $this->builPath;
    }


}

1		<?php
2
3		namespace Wabel\CertainAPI;
4
5		use GuzzleHttp\Client;
6		use GuzzleHttp\Exception\ClientException;
7		use Wabel\CertainAPI\Response\CertainResponse;
8		use Psr\Http\Message\ResponseInterface;
9
10		/**
11		* CertainApiClient
12		* @see http://developer.certain.com/api2docs/introduction
13		*/
14		class CertainApiClient
15		{
16		/**
17		* URL for call request
18		*
19		* @var string
20		*/
21		private $baseUri = 'https://appeu.certain.com/certainExternal/service/v1/';
22
23		/**
24		*
25		* @var Client
26		*/
27		private $client;
28
29		/**
30		* AccountCode to put in the URI
31		*
32		* @var string
33		*/
34		private $accountCode;
35
36		/**
37		*
38		* @var string
39		*/
40		private $builPath;
41
42		/**
43		*
44		* @var string
45		*/
46		private $username;
47
48		/**
49		*
50		* @var string
51		*/
52		private $password;
53
54		/**
55		*
56		* @param string\|null $baseUri
57		* @param string $username
58		* @param string $password
59		* @param string $accountCode
60		*/
61		public function __construct($baseUri, $username, $password,
62		$accountCode)
63		{
64		if ($baseUri !== null) {
65		$this->baseUri = $baseUri;
66		}
67		$this->username = $username;
68		$this->password = $password;
69		$this->accountCode = $accountCode;
70		$this->setClient(new Client([
71		'base_uri' => $this->baseUri
72		]
73		));
74		}
75
76		/**
77		*
78		* @return Client
79		*/
80		public function getClient()
81		{
82		return $this->client;
83		}
84
85		/**
86		* Define a client
87		* @param Client $client
88		* @return \Wabel\CertainAPI\CertainApiClient
89		*/
90		public function setClient(Client $client)
91		{
92		$this->client = $client;
93		return $this;
94		}
95
96		/**
97		* Get Account Code
98		* @return string
99		*/
100		public function getAccountCode()
101		{
102		return $this->accountCode;
103		}
104
105		/**
106		* Build the URI to request
107		* @param string\|array $ressourceName
108		* @param string $ressourceId
109		* @return string
110		*/
111		private function builPathToCall($ressourceName,$ressourcePath =null, $ressourceId = null)
112		{
113		$ressourceAdded = '';
114		if(!is_null($ressourcePath) && $ressourcePath != ''){
115		$ressourceAdded = $ressourcePath;
116		}
117
118		if ($ressourceId !== null) {
119		$ressourceAdded = '/'.$ressourceId;
120		}
121		if(!is_null($ressourcePath)){
122		$this->builPath = 'accounts/'.$this->getAccountCode().$ressourceAdded;
123		return $this->builPath;
124		}else{
125		$this->builPath = $ressourceName.'/'.$this->getAccountCode().$ressourceAdded;
126		return $this->builPath;
127		}
128
129		}
130
131		/**
132		* Make "GET" request with the client.
133		* @param string $ressourceName
134		* @param string $ressourcePath
135		* @param string $ressourceId
136		* @param array $query
137		* @param boolean $assoc
138		* @param string $contentType
139		* @return array
140		*/
141	View Code Duplication	public function get($ressourceName, $ressourcePath =null, $ressourceId = null, $query = array(),
		0 ignored issues – show Duplication introduced 2017-09-07 12:49 UTC by Report Bug Copy Issue Report Show Similar Issues like this This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
142		$assoc = false, $contentType = 'json')
143		{
144		try {
145		$urlRessource = $this->builPathToCall($ressourceName, $ressourcePath, $ressourceId);
146		$response = $this->getClient()->get($urlRessource,
147		array(
148		'auth' => [$this->username, $this->password],
149		'headers' => ['Accept' => "application/$contentType"],
150		'query' => $query,
151		'verify' => false
152		));
153		} catch (ClientException $ex) {
154		$response = $ex->getResponse();
155		}
156		return $this->makeCertainApiResponse($response, $contentType, $assoc);
157		}
158
159		/**
160		* Make "POST" request with the client.
161		* @param string $ressourceName
162		* @param string $ressourcePath
163		* @param string $ressourceId
164		* @param array $bodyData
165		* @param array $query
166		* @param boolean $assoc
167		* @param string $contentType
168		* @return array
169		*/
170	View Code Duplication	public function post($ressourceName, $ressourcePath =null, $ressourceId = null,
		0 ignored issues – show Duplication introduced 2017-09-07 12:49 UTC by Report Bug Copy Issue Report Show Similar Issues like this This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
171		$bodyData = array(), $query = array(), $assoc = false,
172		$contentType = 'json')
173		{
174		if ($contentType !== 'json') {
175		throw new \Exception('Use only json to update or create');
176		}
177		try {
178		$urlRessource = $this->builPathToCall($ressourceName, $ressourcePath, $ressourceId);
179		$response = $this->getClient()->post($urlRessource,
180		array(
181		'auth' => [$this->username, $this->password],
182		'headers' => ['Accept' => "application/$contentType"],
183		'json' => $bodyData,
184		'query' => $query,
185		'verify' => false
186		));
187		} catch (ClientException $ex) {
188		$response = $ex->getResponse();
189		}
190		return $this->makeCertainApiResponse($response, $contentType, $assoc);
191		}
192
193		/**
194		* Make "PUT" request with the client.
195		* @param string $ressourceName
196		* @param string $ressourcePath
197		* @param string $ressourceId
198		* @param array $bodyData
199		* @param array $query
200		* @param boolean $assoc
201		* @param string $contentType
202		* @return array
203		*/
204	View Code Duplication	public function put($ressourceName, $ressourcePath =null, $ressourceId = null,
		0 ignored issues – show Duplication introduced 2017-09-07 12:49 UTC by Report Bug Copy Issue Report Show Similar Issues like this This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
205		$bodyData = array(), $query = array(), $assoc = false,
206		$contentType = 'json')
207		{
208		if ($contentType !== 'json') {
209		throw new \Exception('Use only json to update or create');
210		}
211		try {
212		$urlRessource = $this->builPathToCall($ressourceName, $ressourcePath, $ressourceId);
213		$response = $this->getClient()->put($urlRessource,
214		array(
215		'auth' => [$this->username, $this->password],
216		'headers' => ['Accept' => "application/$contentType"],
217		'json' => $bodyData,
218		'query' => $query,
219		'verify' => false
220		));
221		} catch (ClientException $ex) {
222		$response = $ex->getResponse();
223		}
224		return $this->makeCertainApiResponse($response, $contentType, $assoc);
225		}
226
227		/**
228		* Make "DELETE" request with the client.
229		* @param string $ressourceName
230		* @param string $ressourcePath
231		* @param string $ressourceId
232		* @param boolean $assoc
233		* @param string $contentType
234		* @return array
235		*/
236	View Code Duplication	public function delete($ressourceName, $ressourcePath =null, $ressourceId = null, $assoc = false,
		0 ignored issues – show Duplication introduced 2017-09-07 12:49 UTC by Report Bug Copy Issue Report Show Similar Issues like this This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
237		$contentType = 'json')
238		{
239		try {
240		$urlRessource = $this->builPathToCall($ressourceName, $ressourcePath, $ressourceId);
241		$response = $this->getClient()->delete($urlRessource,
242		array(
243		'auth' => [$this->username, $this->password],
244		'headers' => ['Accept' => "application/$contentType"],
245		'verify' => false
246		));
247		} catch (ClientException $ex) {
248		$response = $ex->getResponse();
249		}
250		return $this->makeCertainApiResponse($response, $contentType, $assoc);
251		}
252
253		/**
254		* Make the Certain Api repsonse.
255		* @param ResponseInterface\|null $response
256		* @param string $contentType
257		* @param boolean $assoc
258		* @return array
259		*/
260		private function makeCertainApiResponse($response,
261		$contentType = 'json', $assoc = false)
262		{
263
264		$responseCertainApi = new CertainResponse($response);
265		return $responseCertainApi->getResponse($contentType, $assoc);
266		}
267
268		public function getBuilPath()
269		{
270		return $this->builPath;
271		}
272
273
274		}

Wabel / certain-api-wrapper

Issues (29)

Security Analysis no request data

src/CertainApiClient.php (4 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like