Issues (1626)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/xml/class.SimpleXMLExtended.inc.php (8 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * modified XML Element
4
 *
5
 * PHP version 5
6
 *
7
 * @category  PHP
8
 * @package   PSI_XML
9
 * @author    Michael Cramer <[email protected]>
10
 * @copyright 2009 phpSysInfo
11
 * @license   http://opensource.org/licenses/gpl-2.0.php GNU General Public License
12
 * @version   SVN: $Id: class.SimpleXMLExtended.inc.php 610 2012-07-11 19:12:12Z namiltd $
13
 * @link      http://phpsysinfo.sourceforge.net
14
 */
15
 /**
16
 * class extends the SimpleXML element for including some special functions, like encoding stuff and cdata support
17
 *
18
 * @category  PHP
19
 * @package   PSI_XML
20
 * @author    Michael Cramer <[email protected]>
21
 * @copyright 2009 phpSysInfo
22
 * @license   http://opensource.org/licenses/gpl-2.0.php GNU General Public License
23
 * @version   Release: 3.0
24
 * @link      http://phpsysinfo.sourceforge.net
25
 */
26
class SimpleXMLExtended
0 ignored issues
show
Coding Style Compatibility introduced by
PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions.

You can fix this by adding a namespace to your class:

namespace YourVendor;

class YourClass { }

When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.

Loading history...
27
{
28
    /**
29
     * store the encoding that is used for conversation to utf8
30
     *
31
     * @var String base encoding
32
     */
33
    private $_encoding = null;
34
35
    /**
36
     * SimpleXMLElement to which every call is delegated
37
     *
38
     * @var SimpleXMLElement delegated SimpleXMLElement
39
     */
40
    private $_SimpleXmlElement = null;
41
42
    /**
43
     * _CP437toUTF8Table for code page conversion for CP437
44
     *
45
     * @var _CP437toUTF8Table array
46
     */
47
    private static $_CP437toUTF8Table = array(
0 ignored issues
show
The property $_CP437toUTF8Table is not used and could be removed.

This check marks private properties in classes that are never used. Those properties can be removed.

Loading history...
48
        "\xC3\x87","\xC3\xBC","\xC3\xA9","\xC3\xA2",
49
        "\xC3\xA4","\xC3\xA0","\xC3\xA5","\xC3\xA7",
50
        "\xC3\xAA","\xC3\xAB","\xC3\xA8","\xC3\xAF",
51
        "\xC3\xAE","\xC3\xAC","\xC3\x84","\xC3\x85",
52
        "\xC3\x89","\xC3\xA6","\xC3\x86","\xC3\xB4",
53
        "\xC3\xB6","\xC3\xB2","\xC3\xBB","\xC3\xB9",
54
        "\xC3\xBF","\xC3\x96","\xC3\x9C","\xC3\xA2",
55
        "\xC2\xA3","\xC3\xA5","\xE2\x82\xA7","\xC6\x92",
56
        "\xC3\xA1","\xC3\xAD","\xC3\xB3","\xC3\xBA",
57
        "\xC3\xB1","\xC3\x91","\xC2\xAA","\xC2\xBA",
58
        "\xC2\xBF","\xE2\x8C\x90","\xC2\xAC","\xC2\xBD",
59
        "\xC2\xBC","\xC2\xA1","\xC2\xAB","\xC2\xBB",
60
        "\xE2\x96\x91","\xE2\x96\x92","\xE2\x96\x93","\xE2\x94\x82",
61
        "\xE2\x94\xA4","\xE2\x95\xA1","\xE2\x95\xA2","\xE2\x95\x96",
62
        "\xE2\x95\x95","\xE2\x95\xA3","\xE2\x95\x91","\xE2\x95\x97",
63
        "\xE2\x95\x9D","\xE2\x95\x9C","\xE2\x95\x9B","\xE2\x94\x90",
64
        "\xE2\x94\x94","\xE2\x94\xB4","\xE2\x94\xAC","\xE2\x94\x9C",
65
        "\xE2\x94\x80","\xE2\x94\xBC","\xE2\x95\x9E","\xE2\x95\x9F",
66
        "\xE2\x95\x9A","\xE2\x95\x94","\xE2\x95\xA9","\xE2\x95\xA6",
67
        "\xE2\x95\xA0","\xE2\x95\x90","\xE2\x95\xAC","\xE2\x95\xA7",
68
        "\xE2\x95\xA8","\xE2\x95\xA4","\xE2\x95\xA5","\xE2\x95\x99",
69
        "\xE2\x95\x98","\xE2\x95\x92","\xE2\x95\x93","\xE2\x95\xAB",
70
        "\xE2\x95\xAA","\xE2\x94\x98","\xE2\x94\x8C","\xE2\x96\x88",
71
        "\xE2\x96\x84","\xE2\x96\x8C","\xE2\x96\x90","\xE2\x96\x80",
72
        "\xCE\xB1","\xC3\x9F","\xCE\x93","\xCF\x80",
73
        "\xCE\xA3","\xCF\x83","\xC2\xB5","\xCF\x84",
74
        "\xCE\xA6","\xCE\x98","\xCE\xA9","\xCE\xB4",
75
        "\xE2\x88\x9E","\xCF\x86","\xCE\xB5","\xE2\x88\xA9",
76
        "\xE2\x89\xA1","\xC2\xB1","\xE2\x89\xA5","\xE2\x89\xA4",
77
        "\xE2\x8C\xA0","\xE2\x8C\xA1","\xC3\xB7","\xE2\x89\x88",
78
        "\xC2\xB0","\xE2\x88\x99","\xC2\xB7","\xE2\x88\x9A",
79
        "\xE2\x81\xBF","\xC2\xB2","\xE2\x96\xA0","\xC2\xA0");
80
81
    /**
82
     * create a new extended SimpleXMLElement and set encoding if specified
83
     *
84
     * @param SimpleXMLElement $xml      base xml element
85
     * @param String           $encoding base encoding that should be used for conversation to utf8
0 ignored issues
show
Should the type for parameter $encoding not be string|null?

This check looks for @param annotations where the type inferred by our type inference engine differs from the declared type.

It makes a suggestion as to what type it considers more descriptive.

Most often this is a case of a parameter that can be null in addition to its declared types.

Loading history...
86
     *
87
     * @return void
0 ignored issues
show
Comprehensibility Best Practice introduced by
Adding a @return annotation to constructors is generally not recommended as a constructor does not have a meaningful return value.

Adding a @return annotation to a constructor is not recommended, since a constructor does not have a meaningful return value.

Please refer to the PHP core documentation on constructors.

Loading history...
88
     */
89
    public function __construct($xml, $encoding = null)
90
    {
91
        if ($encoding != null) {
0 ignored issues
show
It seems like you are loosely comparing $encoding of type string|null against null; this is ambiguous if the string can be empty. Consider using a strict comparison !== instead.
Loading history...
92
            $this->_encoding = $encoding;
93
        }
94
        $this->_SimpleXmlElement = $xml;
95
    }
96
97
    /**
98
     * insert a child element with or without a value, also doing conversation of name and if value is set to utf8
99
     *
100
     * @param String $name  name of the child element
101
     * @param String $value a value that should be insert to the child
0 ignored issues
show
Should the type for parameter $value not be string|null?

This check looks for @param annotations where the type inferred by our type inference engine differs from the declared type.

It makes a suggestion as to what type it considers more descriptive.

Most often this is a case of a parameter that can be null in addition to its declared types.

Loading history...
102
     *
103
     * @return SimpleXMLExtended extended child SimpleXMLElement
104
     */
105
    public function addChild($name, $value = null)
106
    {
107
        $nameUtf8 = $this->_toUTF8($name);
108
        if ($value == null) {
0 ignored issues
show
It seems like you are loosely comparing $value of type string|null against null; this is ambiguous if the string can be empty. Consider using a strict comparison === instead.
Loading history...
109
            return new SimpleXMLExtended($this->_SimpleXmlElement->addChild($nameUtf8), $this->_encoding);
110
        } else {
111
            $valueUtf8 = htmlspecialchars($this->_toUTF8($value));
112
113
            return new SimpleXMLExtended($this->_SimpleXmlElement->addChild($nameUtf8, $valueUtf8), $this->_encoding);
114
        }
115
    }
116
117
    /**
118
     * insert a child with cdata section
119
     *
120
     * @param String $name  name of the child element
121
     * @param String $cdata data for CDATA section
122
     *
123
     * @return SimpleXMLExtended extended child SimpleXMLElement
124
     */
125
    public function addCData($name, $cdata)
126
    {
127
        $nameUtf8 = $this->_toUTF8($name);
128
        $node = $this->_SimpleXmlElement->addChild($nameUtf8);
129
        $domnode = dom_import_simplexml($node);
130
        $no = $domnode->ownerDocument;
131
        $domnode->appendChild($no->createCDATASection($cdata));
132
133
        return new SimpleXMLExtended($node, $this->_encoding);
134
    }
135
136
    /**
137
     * add a attribute to a child and convert name and value to utf8
138
     *
139
     * @param String $name  name of the attribute
140
     * @param String $value value of the attribute
141
     *
142
     * @return Void
143
     */
144
    public function addAttribute($name, $value)
145
    {
146
        $nameUtf8 = $this->_toUTF8($name);
147
        $valueUtf8 = htmlspecialchars($this->_toUTF8($value));
148
        $this->_SimpleXmlElement->addAttribute($nameUtf8, $valueUtf8);
149
    }
150
151
    /**
152
     * append a xml-tree to another xml-tree
153
     *
154
     * @param SimpleXMLElement $new_child child that should be appended
155
     *
156
     * @return Void
157
     */
158
    public function combinexml(SimpleXMLElement $new_child)
159
    {
160
        $node1 = dom_import_simplexml($this->_SimpleXmlElement);
161
        $dom_sxe = dom_import_simplexml($new_child);
162
        $node2 = $node1->ownerDocument->importNode($dom_sxe, true);
163
        $node1->appendChild($node2);
164
    }
165
166
    /**
167
     * convert a string into an UTF-8 string
168
     *
169
     * @param String $str string to convert
170
     *
171
     * @return String UTF-8 string
172
     */
173
    private function _toUTF8($str)
174
    {
175
        if ($this->_encoding != null) {
176
            if (strcasecmp($this->_encoding, "UTF-8") == 0) {
177
                return trim($str);
178
            } elseif (strcasecmp($this->_encoding, "CP437") == 0) {
179
                $str = trim($str);
180
                $strr = "";
181
                if (($strl = strlen($str)) > 0) for ($i = 0; $i < $strl; $i++) {
182
                    $strc = substr($str, $i, 1);
183
                    if ($strc < 128) $strr.=$strc;
184
                        else $strr.=$_CP437toUTF8Table[$strc-128];
0 ignored issues
show
The variable $_CP437toUTF8Table does not exist. Did you forget to declare it?

This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug.

Loading history...
185
                }
186
187
                 return $strr;
188
            } else {
189
                $enclist = mb_list_encodings();
190
                if (in_array($this->_encoding, $enclist)) {
191
                    return mb_convert_encoding(trim($str), 'UTF-8', $this->_encoding);
192
                } elseif (function_exists("iconv")) {
193
                    return iconv($this->_encoding, 'UTF-8', trim($str));
194
                } else {
195
                    return mb_convert_encoding(trim($str), 'UTF-8');
196
                }
197
            }
198
        } else {
199
            return mb_convert_encoding(trim($str), 'UTF-8');
200
        }
201
    }
202
203
    /**
204
     * Returns the SimpleXmlElement
205
     *
206
     * @return SimpleXmlElement entire xml as SimpleXmlElement
207
     */
208
    public function getSimpleXmlElement()
209
    {
210
        return $this->_SimpleXmlElement;
211
    }
212
}
213