Issues (3882)

Security Analysis    39 potential vulnerabilities

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting (9)
Response Splitting can be used to send arbitrary responses.
  File Manipulation (2)
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure (7)
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection (13)
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting (8)
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

app/Json.php (3 issues)

1
<?php
2
3
namespace App;
4
5
/**
6
 * Json class.
7
 *
8
 * @package App
9
 *
10
 * @copyright YetiForce S.A.
11
 * @license   YetiForce Public License 6.5 (licenses/LicenseEN.txt or yetiforce.com)
12
 * @author    Mariusz Krzaczkowski <[email protected]>
13
 */
14
class Json
15
{
16
	/**
17
	 * How objects should be encoded -- arrays or as StdClass. TYPE_ARRAY is 1
18
	 * so that it is a boolean true value, allowing it to be used with
19
	 * ext/json's functions.
20
	 */
21
	const TYPE_ARRAY = 1;
22
	const TYPE_OBJECT = 0;
23
24
	/**
25
	 * Decodes the given $encodedValue string which is
26
	 * encoded in the JSON format.
27
	 *
28
	 * Uses ext/json's json_decode if available.
29
	 *
30
	 * @param string $encodedValue     Encoded in JSON format
31
	 * @param int    $objectDecodeType Optional; When TRUE, returned objects will be converted into associative arrays
32
	 *
33
	 * @see https://secure.php.net/manual/en/function.json-decode.php
34
	 *
35 62
	 * @return mixed
36
	 */
37 62
	public static function decode($encodedValue, $objectDecodeType = self::TYPE_ARRAY)
38 62
	{
39
		if (null === $encodedValue) {
0 ignored issues
show
The condition null === $encodedValue is always false.
Loading history...
40
			return '';
41
		}
42
		if (\function_exists('json_decode')) {
43
			return json_decode($encodedValue, $objectDecodeType);
0 ignored issues
show
$objectDecodeType of type integer is incompatible with the type boolean|null expected by parameter $associative of json_decode(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

43
			return json_decode($encodedValue, /** @scrutinizer ignore-type */ $objectDecodeType);
Loading history...
44
		}
45
		throw new \App\Exceptions\AppException('ERR_NO_JSON_DECODE');
46
	}
47
48
	/**
49
	 * Encode the mixed $valueToEncode into the JSON format.
50
	 *
51
	 * Encodes using ext/json's json_encode() if available.
52
	 *
53
	 * NOTE: Object should not contain cycles; the JSON format
54
	 * does not allow object reference.
55
	 *
56
	 * NOTE: Only public variables will be encoded
57
	 *
58 5798
	 * @param mixed $valueToEncode
59
	 * @param int   $options       Optional; whether or not to check for object recursion; off by default
60 5798
	 *
61 5798
	 * @return string JSON encoded object
62
	 */
63
	public static function encode($valueToEncode, $options = 0)
64
	{
65
		if (\function_exists('json_encode')) {
66
			return json_encode($valueToEncode, $options | JSON_UNESCAPED_UNICODE);
67
		}
68
		throw new \App\Exceptions\AppException('ERR_NO_JSON_ENCODE');
69
	}
70
71
	/**
72
	 * Determine whether a variable is empty.
73 5787
	 *
74
	 * @param string|null $value
75 5787
	 *
76
	 * @return bool
77
	 */
78
	public static function isEmpty(?string $value)
79
	{
80
		return empty($value) || '[]' === $value || '""' === $value;
81
	}
82
83
	/**
84
	 * Check that a string is a valid JSON string.
85
	 *
86
	 * @param string|null $value
87 1
	 *
88
	 * @return bool
89 1
	 */
90
	public static function isJson(?string $value): bool
91
	{
92
		return !(null === $value || '' === $value || null === self::decode($value) || JSON_ERROR_NONE !== \json_last_error());
93
	}
94
95
	/**
96
	 * Read json file to array.
97
	 *
98
	 * @param string $path
99
	 *
100
	 * @throws \App\Exceptions\AppException
101
	 *
102 2
	 * @return array
103
	 */
104 2
	public static function read(string $path)
105
	{
106
		return static::decode(file_get_contents($path), true) ?? [];
0 ignored issues
show
true of type true is incompatible with the type integer expected by parameter $objectDecodeType of App\Json::decode(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

106
		return static::decode(file_get_contents($path), /** @scrutinizer ignore-type */ true) ?? [];
Loading history...
107
	}
108
109
	/**
110
	 * Save json file from array.
111
	 *
112
	 * @param string $path
113
	 * @param array  $data
114
	 *
115
	 * @throws \App\Exceptions\AppException
116
	 *
117
	 * @return bool|int
118
	 */
119
	public static function save(string $path, array $data)
120
	{
121
		return \file_put_contents($path, static::encode($data, JSON_PRETTY_PRINT), LOCK_EX);
122
	}
123
}
124