Issues in mysql.php (master) - Issues in master - WordPoints/hooks-api - Measure and Improve Code Quality continuously with Scrutinizer

Issues (96)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/includes/classes/query/builder/db/mysql.php (3 issues)

Labels

Severity

Critical 3

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

/**
 * .
 *
 * @package wordpoints-hooks-api
 * @since 1.
 */


interface WordPoints_Query_BuilderI {
	public function set_fields( $fields );
	public function add_field( $field );
	public function set_table( $table_name );
	public function get_table();
	public function enter_join( $join );
	public function exit_join();
	public function where( $condition );
	public function get_query();
}

abstract class WordPoints_Query_Builder_DB implements WordPoints_Query_BuilderI {

	/**
	 *
	 *
	 * @since 1.
	 *
	 * @var WordPoints_Hierarchy
	 */
	protected $query;

	protected $aliases = array();

	public function __construct() {
		$this->query = new WordPoints_Hierarchy( 'joins' );
		$this->query->push( '', array() );
	}

	public function set_fields( $fields ) {
		$this->query->set_field( 'fields', $fields );
	}

	public function add_field( $field ) {
		$this->query->push_to( 'fields', $field );
	}

	public function set_table( $table_name ) {
		$this->query->set_field( 'table_name',  $table_name );
	}

	public function get_table() {
		return $this->query->get_field( 'table_name' );
	}

	protected function get_alias( $data ) {

		if ( ! isset( $this->aliases[ $data['table_name'] ] ) ) {
			$this->aliases[ $data['table_name'] ] = 0;
		}

		return $data['table_name'] . '_' . ++$this->aliases[ $data['table_name'] ];
	}

	public function enter_join( $join ) {
		$alias = $this->get_alias( $join );
		$this->query->push( $alias, $join );
	}

	public function exit_join() {
		$this->query->pop();
	}

	public function where( $condition ) {

		$where = $this->query->get_field( 'where' );

		if ( ! is_array( $where ) ) {
			$where = array();
		}

		$where[] = $condition;

		$this->query->set_field( 'where', $where );
	}
}

class WordPoints_Query_Builder_Exception extends Exception {}

class WordPoints_Query_Builder_DB_MySQL extends WordPoints_Query_Builder_DB {

	protected $sql;

	protected $fields;

	protected $alias;

	public function get_query() {

		$this->sql = '';

		var_dump($this->query);

		try {
			$this->build_query( $this->query->get() );
		} catch ( WordPoints_Query_Builder_Exception $e ) {
			return new WP_Error( $e->getMessage(), $e->getTraceAsString() );
		}

		return $this->sql;
	}

	protected function build_query( $query ) {

		var_dump( __METHOD__, $query );


		$this->alias = $this->get_alias( $query );

		$this->build_fields( $query );
		$this->build_from( $query );
		$this->build_joins( $query );
		$this->build_where( $query );
		$this->build_select();
	}

	protected function build_select() {

		if ( empty( $this->fields ) ) {
			throw new WordPoints_Query_Builder_Exception( 'no fields' );
		}

		$this->sql = 'SELECT' . $this->fields . $this->sql;
	}

	protected function build_fields( $query ) {

		if ( empty( $query['fields'] ) ) {
			return;
		}

		foreach ( $query['fields'] as $field ) {

			if ( ! is_array( $field ) ) {
				$field = array( 'field' => $field );
			}

			if ( ! isset( $field['field'] ) ) {
				throw new WordPoints_Query_Builder_Exception( 'invalid field' );
			}

			if ( ! empty( $this->fields ) ) {
				$this->fields .= ',';
			}

			$this->fields .= ' ' . $this->build_field( $field['field'] );

			$as = $field['field'];
			if ( isset( $field['as'] ) ) {
				$as = $field['as'];
			}

			$this->fields .= ' AS `' . $this->escape_identifier( $as ) . '`';
		}
	}

	/**
	 *
	 *
	 * @since 1.
	 *
	 * @param $field
	 *
	 * @throws WordPoints_Query_Builder_Exception
	 */
	protected function build_field( $field ) {

		$field_name = $this->get_field_name( $field );

		$sql = '`' . $this->escape_identifier( $this->alias ) . '`';
		$sql .= '.`' . $this->escape_identifier( $field_name ) . '`';

		return $sql;
	}

	protected function build_from( $query ) {

		if ( ! isset( $query['table_name'] ) ) {
			throw new WordPoints_Query_Builder_Exception( 'table_name' );
		}

		$this->sql .= "\n";
		$this->sql .= 'FROM `' . $this->escape_identifier( $query['table_name'] ) . '`';
		$this->sql .= ' AS `' . $this->escape_identifier( $this->alias ) . '`';
	}

	protected function build_joins( $query ) {

		if ( ! isset( $query['joins'] ) ) {
			return;
		}

		foreach ( $query['joins'] as $join ) {
			$this->build_join( $join );
		}
	}

	protected function build_join( $join ) {

		if ( ! isset( $join['table_name'] ) ) {
			throw new WordPoints_Query_Builder_Exception( 'join table_name' );
		}

		if ( ! isset( $join['on'] ) ) {
			throw new WordPoints_Query_Builder_Exception( 'join on' );
		}

		if ( ! isset( $join['on']['join_field'] ) ) {
			throw new WordPoints_Query_Builder_Exception( 'join on join_field' );
		}

		if ( ! isset( $join['on']['primary_field'] ) ) {
			throw new WordPoints_Query_Builder_Exception( 'join on primary_field' );
		}

		$alias = $this->get_alias( $join );

		$this->sql .= "\n";
		$this->sql .= 'INNER JOIN `' . $this->escape_identifier( $join['table_name'] ) . '`';
		$this->sql .= ' AS `' . $this->escape_identifier( $alias ) . '`';
		$this->sql .= "\n\t" . 'ON ' . $this->build_field( $join['on']['primary_field'] );

		$old_alias = $this->alias;
		$this->alias = $alias;

		$this->sql .= ' = ' . $this->build_field( $join['on']['join_field'] );

		$this->build_fields( $join );

		if ( isset( $join['where'] ) ) {
			foreach ( $join['where'] as $condition ) {
				$this->build_condition( $condition );
			}
		}

		$this->build_joins( $join );

		$this->alias = $old_alias;
	}

	protected function build_where( $query ) {

		if ( empty( $query['where'] ) ) {
			return;
		}

		$this->sql .= "\n";
		$this->sql .= 'WHERE 1=1';

		foreach ( $query['where'] as $condition ) {
			$this->build_condition( $condition );
		}
	}

	protected function build_condition( $condition ) {

		global $wpdb;

		if ( ! isset( $condition['field'], $condition['value'] ) ) {
			var_dump($condition);

			throw new WordPoints_Query_Builder_Exception( 'bad condition' );
		}

		if ( ! isset( $condition['compare'] ) ) {
			$condition['compare'] = '=';
		}

		$this->sql .= "\n\t";

		$this->build_condition_type( $condition );

		$field_type = $this->get_field_type( $condition['field'] );
		if ( 'serialized_array' === $field_type ) {
			if ( is_array( $condition['value'] ) ) {
				if ( isset( $condition['compare'] ) && 'in' === $condition['compare'] ) {
					$this->sql .= '( 1=0 ';
					foreach ( $condition['value'] as $index => $value ) {
						$this->build_condition(
							array(
								'type' => 'or',
								'value' => "%{$value}%",
								'field' => $condition['field'],
								'compare' => 'like',
							)
						);
					}
					$this->sql .= ')';
					return;
				}
			} else {
				$condition['value'] = $this->serialize_value( $condition['value'] );
			}
		}

		$this->sql .= $this->build_field( $condition['field'] );

		switch ( $condition['compare'] ) {

			case '=':
				$this->sql .= ' = ';
				break;

			case 'like':
				$this->sql .= ' LIKE ';
				break;

			case 'in':
				$this->sql .= ' IN (' . wordpoints_prepare__in( $condition['value'] ) . ')';
				return;

			default:
				throw new WordPoints_Query_Builder_Exception( 'bad condition comparison' );
		}

		if ( ! is_scalar( $condition['value'] ) ) {
			throw new WordPoints_Query_Builder_Exception( 'bad condition value' );
		}

		$this->sql .= $wpdb->prepare( '%s', $condition['value'] );
	}

	/**
	 *
	 *
	 * @since 1.
	 *
	 * @param $condition
	 *
	 * @throws WordPoints_Query_Builder_Exception
	 */
	protected function build_condition_type( $condition ) {

		if ( ! isset( $condition['type'] ) ) {
			$condition['type'] = 'and';
		}

		switch ( $condition['type'] ) {

			case 'and':
				$this->sql .= 'AND ';
				break;

			case 'or':
				$this->sql .= 'OR ';
				break;

			default:
				throw new WordPoints_Query_Builder_Exception( 'bad condition type' );
		}
	}

	protected function escape_identifier( $identifier ) {

		return str_replace( '`', '``', $identifier );
	}

	protected function get_field_name( $field ) {

		if ( is_array( $field ) ) {

			if ( ! isset( $field['name'] ) ) {
				throw new WordPoints_Query_Builder_Exception( 'field name' );
			}

			$field = $field['name'];
		}

		return $field;
	}

	protected function get_field_type( $field ) {

		if ( is_array( $field ) && isset( $field['type'] ) ) {
			return $field['type'];
		}

		return 'string';
	}

	protected function serialize_value( $value ) {

		if ( is_string( $value ) ) {
			$value = '"' . $value . '"';
		}

		return '%:' . $value . ';%';
	}
}

// EOF


1			<?php
2
3			/**
4			* .
5			*
6			* @package wordpoints-hooks-api
7			* @since 1.
8			*/
9
10
11			interface WordPoints_Query_BuilderI {
12			public function set_fields( $fields );
13			public function add_field( $field );
14			public function set_table( $table_name );
15			public function get_table();
16			public function enter_join( $join );
17			public function exit_join();
18			public function where( $condition );
19			public function get_query();
20			}
21
22			abstract class WordPoints_Query_Builder_DB implements WordPoints_Query_BuilderI {
23
24			/**
25			*
26			*
27			* @since 1.
28			*
29			* @var WordPoints_Hierarchy
30			*/
31			protected $query;
32
33			protected $aliases = array();
34
35			public function __construct() {
36			$this->query = new WordPoints_Hierarchy( 'joins' );
37			$this->query->push( '', array() );
38			}
39
40			public function set_fields( $fields ) {
41			$this->query->set_field( 'fields', $fields );
42			}
43
44			public function add_field( $field ) {
45			$this->query->push_to( 'fields', $field );
46			}
47
48			public function set_table( $table_name ) {
49			$this->query->set_field( 'table_name', $table_name );
50			}
51
52			public function get_table() {
53			return $this->query->get_field( 'table_name' );
54			}
55
56			protected function get_alias( $data ) {
57
58			if ( ! isset( $this->aliases[ $data['table_name'] ] ) ) {
59			$this->aliases[ $data['table_name'] ] = 0;
60			}
61
62			return $data['table_name'] . '_' . ++$this->aliases[ $data['table_name'] ];
63			}
64
65			public function enter_join( $join ) {
66			$alias = $this->get_alias( $join );
67			$this->query->push( $alias, $join );
68			}
69
70			public function exit_join() {
71			$this->query->pop();
72			}
73
74			public function where( $condition ) {
75
76			$where = $this->query->get_field( 'where' );
77
78			if ( ! is_array( $where ) ) {
79			$where = array();
80			}
81
82			$where[] = $condition;
83
84			$this->query->set_field( 'where', $where );
85			}
86			}
87
88			class WordPoints_Query_Builder_Exception extends Exception {}
89
90			class WordPoints_Query_Builder_DB_MySQL extends WordPoints_Query_Builder_DB {
91
92			protected $sql;
93
94			protected $fields;
95
96			protected $alias;
97
98			public function get_query() {
99
100			$this->sql = '';
101
102			var_dump($this->query);
			0 ignored issues – show Security Debugging Code introduced 2015-11-24 21:58 UTC by Report Bug Copy Issue Report Show Similar Issues like this `var_dump($this->query);` looks like debug code. Are you sure you do not want to remove it? This might expose sensitive data. Loading history...
103			try {
104			$this->build_query( $this->query->get() );
105			} catch ( WordPoints_Query_Builder_Exception $e ) {
106			return new WP_Error( $e->getMessage(), $e->getTraceAsString() );
107			}
108
109			return $this->sql;
110			}
111
112			protected function build_query( $query ) {
113
114			var_dump( __METHOD__, $query );
			0 ignored issues – show Security Debugging Code introduced 2015-11-24 21:58 UTC by Report Bug Copy Issue Report Show Similar Issues like this `var_dump(__METHOD__, $query);` looks like debug code. Are you sure you do not want to remove it? This might expose sensitive data. Loading history...
115
116			$this->alias = $this->get_alias( $query );
117
118			$this->build_fields( $query );
119			$this->build_from( $query );
120			$this->build_joins( $query );
121			$this->build_where( $query );
122			$this->build_select();
123			}
124
125			protected function build_select() {
126
127			if ( empty( $this->fields ) ) {
128			throw new WordPoints_Query_Builder_Exception( 'no fields' );
129			}
130
131			$this->sql = 'SELECT' . $this->fields . $this->sql;
132			}
133
134			protected function build_fields( $query ) {
135
136			if ( empty( $query['fields'] ) ) {
137			return;
138			}
139
140			foreach ( $query['fields'] as $field ) {
141
142			if ( ! is_array( $field ) ) {
143			$field = array( 'field' => $field );
144			}
145
146			if ( ! isset( $field['field'] ) ) {
147			throw new WordPoints_Query_Builder_Exception( 'invalid field' );
148			}
149
150			if ( ! empty( $this->fields ) ) {
151			$this->fields .= ',';
152			}
153
154			$this->fields .= ' ' . $this->build_field( $field['field'] );
155
156			$as = $field['field'];
157			if ( isset( $field['as'] ) ) {
158			$as = $field['as'];
159			}
160
161			$this->fields .= ' AS `' . $this->escape_identifier( $as ) . '`';
162			}
163			}
164
165			/**
166			*
167			*
168			* @since 1.
169			*
170			* @param $field
171			*
172			* @throws WordPoints_Query_Builder_Exception
173			*/
174			protected function build_field( $field ) {
175
176			$field_name = $this->get_field_name( $field );
177
178			$sql = '`' . $this->escape_identifier( $this->alias ) . '`';
179			$sql .= '.`' . $this->escape_identifier( $field_name ) . '`';
180
181			return $sql;
182			}
183
184			protected function build_from( $query ) {
185
186			if ( ! isset( $query['table_name'] ) ) {
187			throw new WordPoints_Query_Builder_Exception( 'table_name' );
188			}
189
190			$this->sql .= "\n";
191			$this->sql .= 'FROM `' . $this->escape_identifier( $query['table_name'] ) . '`';
192			$this->sql .= ' AS `' . $this->escape_identifier( $this->alias ) . '`';
193			}
194
195			protected function build_joins( $query ) {
196
197			if ( ! isset( $query['joins'] ) ) {
198			return;
199			}
200
201			foreach ( $query['joins'] as $join ) {
202			$this->build_join( $join );
203			}
204			}
205
206			protected function build_join( $join ) {
207
208			if ( ! isset( $join['table_name'] ) ) {
209			throw new WordPoints_Query_Builder_Exception( 'join table_name' );
210			}
211
212			if ( ! isset( $join['on'] ) ) {
213			throw new WordPoints_Query_Builder_Exception( 'join on' );
214			}
215
216			if ( ! isset( $join['on']['join_field'] ) ) {
217			throw new WordPoints_Query_Builder_Exception( 'join on join_field' );
218			}
219
220			if ( ! isset( $join['on']['primary_field'] ) ) {
221			throw new WordPoints_Query_Builder_Exception( 'join on primary_field' );
222			}
223
224			$alias = $this->get_alias( $join );
225
226			$this->sql .= "\n";
227			$this->sql .= 'INNER JOIN `' . $this->escape_identifier( $join['table_name'] ) . '`';
228			$this->sql .= ' AS `' . $this->escape_identifier( $alias ) . '`';
229			$this->sql .= "\n\t" . 'ON ' . $this->build_field( $join['on']['primary_field'] );
230
231			$old_alias = $this->alias;
232			$this->alias = $alias;
233
234			$this->sql .= ' = ' . $this->build_field( $join['on']['join_field'] );
235
236			$this->build_fields( $join );
237
238			if ( isset( $join['where'] ) ) {
239			foreach ( $join['where'] as $condition ) {
240			$this->build_condition( $condition );
241			}
242			}
243
244			$this->build_joins( $join );
245
246			$this->alias = $old_alias;
247			}
248
249			protected function build_where( $query ) {
250
251			if ( empty( $query['where'] ) ) {
252			return;
253			}
254
255			$this->sql .= "\n";
256			$this->sql .= 'WHERE 1=1';
257
258			foreach ( $query['where'] as $condition ) {
259			$this->build_condition( $condition );
260			}
261			}
262
263			protected function build_condition( $condition ) {
264
265			global $wpdb;
266
267			if ( ! isset( $condition['field'], $condition['value'] ) ) {
268			var_dump($condition);
			0 ignored issues – show Security Debugging Code introduced 2015-11-24 21:58 UTC by Report Bug Copy Issue Report Show Similar Issues like this `var_dump($condition);` looks like debug code. Are you sure you do not want to remove it? This might expose sensitive data. Loading history...
269			throw new WordPoints_Query_Builder_Exception( 'bad condition' );
270			}
271
272			if ( ! isset( $condition['compare'] ) ) {
273			$condition['compare'] = '=';
274			}
275
276			$this->sql .= "\n\t";
277
278			$this->build_condition_type( $condition );
279
280			$field_type = $this->get_field_type( $condition['field'] );
281			if ( 'serialized_array' === $field_type ) {
282			if ( is_array( $condition['value'] ) ) {
283			if ( isset( $condition['compare'] ) && 'in' === $condition['compare'] ) {
284			$this->sql .= '( 1=0 ';
285			foreach ( $condition['value'] as $index => $value ) {
286			$this->build_condition(
287			array(
288			'type' => 'or',
289			'value' => "%{$value}%",
290			'field' => $condition['field'],
291			'compare' => 'like',
292			)
293			);
294			}
295			$this->sql .= ')';
296			return;
297			}
298			} else {
299			$condition['value'] = $this->serialize_value( $condition['value'] );
300			}
301			}
302
303			$this->sql .= $this->build_field( $condition['field'] );
304
305			switch ( $condition['compare'] ) {
306
307			case '=':
308			$this->sql .= ' = ';
309			break;
310
311			case 'like':
312			$this->sql .= ' LIKE ';
313			break;
314
315			case 'in':
316			$this->sql .= ' IN (' . wordpoints_prepare__in( $condition['value'] ) . ')';
317			return;
318
319			default:
320			throw new WordPoints_Query_Builder_Exception( 'bad condition comparison' );
321			}
322
323			if ( ! is_scalar( $condition['value'] ) ) {
324			throw new WordPoints_Query_Builder_Exception( 'bad condition value' );
325			}
326
327			$this->sql .= $wpdb->prepare( '%s', $condition['value'] );
328			}
329
330			/**
331			*
332			*
333			* @since 1.
334			*
335			* @param $condition
336			*
337			* @throws WordPoints_Query_Builder_Exception
338			*/
339			protected function build_condition_type( $condition ) {
340
341			if ( ! isset( $condition['type'] ) ) {
342			$condition['type'] = 'and';
343			}
344
345			switch ( $condition['type'] ) {
346
347			case 'and':
348			$this->sql .= 'AND ';
349			break;
350
351			case 'or':
352			$this->sql .= 'OR ';
353			break;
354
355			default:
356			throw new WordPoints_Query_Builder_Exception( 'bad condition type' );
357			}
358			}
359
360			protected function escape_identifier( $identifier ) {
361
362			return str_replace( '`', '``', $identifier );
363			}
364
365			protected function get_field_name( $field ) {
366
367			if ( is_array( $field ) ) {
368
369			if ( ! isset( $field['name'] ) ) {
370			throw new WordPoints_Query_Builder_Exception( 'field name' );
371			}
372
373			$field = $field['name'];
374			}
375
376			return $field;
377			}
378
379			protected function get_field_type( $field ) {
380
381			if ( is_array( $field ) && isset( $field['type'] ) ) {
382			return $field['type'];
383			}
384
385			return 'string';
386			}
387
388			protected function serialize_value( $value ) {
389
390			if ( is_string( $value ) ) {
391			$value = '"' . $value . '"';
392			}
393
394			return '%:' . $value . ';%';
395			}
396			}
397
398			// EOF
399

WordPoints / hooks-api

Issues (96)

Security Analysis no request data

src/includes/classes/query/builder/db/mysql.php (3 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like