Issues (4069)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

jssource/minify.php (9 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
if(!defined('sugarEntry'))define('sugarEntry', true);
3
4
//assumes jsmin.php is in same directory
5
    if(isset($_REQUEST['root_directory'])){
6
        require_once('jssource/minify_utils.php');
7
    }else{
8
        require_once('minify_utils.php');
9
    }
10
11
//if we are coming from browser
12
13
if(isset($_REQUEST['root_directory'])){
14
	if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
15
16
    require_once('include/utils/sugar_file_utils.php');
17
18
    //get the root directory to process
19
    $from = $_REQUEST['root_directory'];
20
    $forceReb = false;
21
    //make sure that the rebuild option has been chosen
22
    if(isset($_REQUEST['js_rebuild_concat'])){
23
        if($_REQUEST['js_rebuild_concat'] == 'rebuild'){
24
             //rebuild if files have changed
25
             $js_groupings = array();
26
            if(isset($_REQUEST['root_directory'])){
27
                require('jssource/JSGroupings.php');
28
                require_once('jssource/minify_utils.php');
29
            }else{
30
                require('JSGroupings.php');
31
                require_once('minify_utils.php');
32
            }
33
34
            //iterate through array of grouped files
35
            $grp_array = $js_groupings;//from JSGroupings.php;
36
37
            //for each item in array, concatenate the source files
38
            foreach($grp_array as $grp){
39
                foreach($grp as $original =>$concat){
40
                    $concat = sugar_cached($concat);
41
                    //make sure both files are still valid
42
                    if(is_file($original)  &&  is_file($concat)){
43
                        //if individual file has been modifed date later than modified date of
44
                        //concatenated file, then force a rebuild
45
                        if(filemtime($original) > filemtime($concat)){
46
                            $forceReb = true;
47
                            //no need to continue, we will rebuild
48
                            break;
49
                        }
50
                    }else{
51
                        //if files are not valid, rebuild as one file could have been deleted
52
                        $forceReb = true;
53
                        //no need to continue, we will rebuild
54
                        break;
55
                    }
56
                }
57
            }
58
59
        }
60
        //if boolean has been set, concatenate files
61
        if($forceReb){
62
        ConcatenateFiles("$from");
63
64
        }
65
66
    }else{
0 ignored issues
show
This else statement is empty and can be removed.

This check looks for the else branches of if statements that have no statements or where all statements have been commented out. This may be the result of changes for debugging or the code may simply be obsolete.

These else branches can be removed.

if (rand(1, 6) > 3) {
print "Check failed";
} else {
    //print "Check succeeded";
}

could be turned into

if (rand(1, 6) > 3) {
    print "Check failed";
}

This is much more concise to read.

Loading history...
67
        //We are only allowing rebuilding of concat files from browser.
68
69
    }
70
    return;
71
}else{
72
    //run via command line
73
    //print_r($argv);
74
    $from="";
75
76
    if(isset($argv[1]) && !empty($argv[1])){
77
         $from = $argv[1];
78
    }else{
79
     //Root Directory was not specified
80
     echo 'Root Directory Input was not provided';
81
     return;
82
    }
83
84
    if ($argv[1] != '-?') {
85
        chdir($from);
86
        require_once('include/utils.php');
87
        require_once('include/utils/file_utils.php');
88
        require_once('include/utils/sugar_file_utils.php');
89
    }
90
    if(!function_exists('sugar_cached')) {
91
        if ($argv[1] != '-?') {
92
            require_once($from.'/./include/utils.php');
93
            require_once($from.'/./include/utils/file_utils.php');
94
            require_once($from.'/./include/utils/sugar_file_utils.php');
95
        }
96
        if(!function_exists('sugar_cached')) {
97
            function sugar_cached($dir) { return "cache/$dir"; }
0 ignored issues
show
The function sugar_cached() has been defined more than once; this definition is ignored, only the first definition in include/utils/sugar_file_utils.php (L391-401) is considered.

This check looks for functions that have already been defined in other files.

Some Codebases, like WordPress, make a practice of defining functions multiple times. This may lead to problems with the detection of function parameters and types. If you really need to do this, you can mark the duplicate definition with the @ignore annotation.

/**
 * @ignore
 */
function getUser() {

}

function getUser($id, $realm) {

}

See also the PhpDoc documentation for @ignore.

Loading history...
98
        }
99
    }
100
101
    if($argv[1] == '-?'){
102
        $argv[2] = '-?';
103
    }
104
105
    //if second argument is set, then process commands
106
    if(!empty($argv[2])){
107
108
           if($argv[2] == '-r'){
109
                //replace the compressed scripts with the backed up version
110
                reverseScripts("$from/jssource/src_files",$from);
111
112
           }elseif($argv[2] == '-m'){
113
                //replace the scripts, and then minify the scripts again
114
                reverseScripts("$from/jssource/src_files",$from);
115
                BackUpAndCompressScriptFiles($from,"",false,true);
0 ignored issues
show
The call to BackUpAndCompressScriptFiles() has too many arguments starting with true.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
116
117
           }elseif($argv[2] == '-c'){
118
                //replace the scripts, concatenate the files, and then minify the scripts again
119
                reverseScripts("$from/jssource/src_files",$from);
120
                BackUpAndCompressScriptFiles($from,"",false,true);
0 ignored issues
show
The call to BackUpAndCompressScriptFiles() has too many arguments starting with true.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
121
                ConcatenateFiles($from,true);
0 ignored issues
show
The call to ConcatenateFiles() has too many arguments starting with true.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
122
           }elseif($argv[2] == '-mo'){
123
                //do not replace the scriptsjust minify the existing scripts again
124
                BackUpAndCompressScriptFiles($from,"",false,true);
0 ignored issues
show
The call to BackUpAndCompressScriptFiles() has too many arguments starting with true.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
125
126
           }elseif($argv[2] == '-co'){
127
                //concatenate the files only
128
                ConcatenateFiles($from,true);
0 ignored issues
show
The call to ConcatenateFiles() has too many arguments starting with true.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
129
130
           }elseif($argv[2] == '-?'){
131
                die("
132
    Usage : minify <root path> [[-r]|[-m]|[-c]]
133
134
    <root path> = path of directory to process.  Should be root of sugar instance.
135
     -r  = replace javascript of root with scripts from backed up jssource/src_files directory
136
     -m  = same as r, only the script is minified and then copied
137
     -c  = same as m, only the concatenated files are processed again.
138
     -co = concatenates only the js files that are to be concatenated.  Main use is for development when files that make up a concatenated file have been modified.
139
     -mo = minifies only the existing js files.  Will not use source files and will not back up scripts.  Main use is for development, when changes have been made to working javascript and you wish to recompress your scripts.
140
141
    *** note that options are mutually exclusive.  You would use -r OR -m OR -c
142
143
    examples: say your patch is located in 'c:/sugar'
144
    You wish to have files from root directory concatenated according to file grouping array, as well as all js files compressed and backed up:
145
        minify 'c:/sugar'
146
147
    You wish to have backed up jssource files replace your current javascript files:
148
        minify 'c:/sugar' -r
149
150
    You wish to have backed up jssource files minified, and replace your current javascript files:
151
        minify 'c:/sugar' -m
152
153
    You wish to have backed up jssource files concatenated, minified, and replace your current javascript files:
154
        minify 'c:/sugar' -c
155
                                        ");
156
157
           }
158
159
    }else{
160
        //default is to concatenate the files, then back up and compress them
161
        if(empty($from)){
162
            echo("directory root to process was not specified");
163
        }
164
165
        BackUpAndCompressScriptFiles($from, '', true, true);
0 ignored issues
show
The call to BackUpAndCompressScriptFiles() has too many arguments starting with true.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
166
        ConcatenateFiles($from,true);
0 ignored issues
show
The call to ConcatenateFiles() has too many arguments starting with true.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
167
168
    }
169
}
170
171
172
?>
173