This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /* |
||
4 | * This file is part of the Superdesk Web Publisher Content Bundle. |
||
5 | * |
||
6 | * Copyright 2015 Sourcefabric z.u. and contributors. |
||
7 | * |
||
8 | * For the full copyright and license information, please see the |
||
9 | * AUTHORS and LICENSE files distributed with this source code. |
||
10 | * |
||
11 | * @copyright 2015 Sourcefabric z.ú |
||
12 | * @license http://www.superdesk.org/license |
||
13 | */ |
||
14 | |||
15 | namespace SWP\Bundle\ContentBundle\EventListener; |
||
16 | |||
17 | use SWP\Component\Common\Response\ResourcesListResponseInterface; |
||
18 | use SWP\Component\Common\Response\SingleResourceResponseInterface; |
||
19 | use Symfony\Component\EventDispatcher\EventDispatcherInterface; |
||
20 | use Symfony\Component\HttpFoundation\Request; |
||
21 | use Symfony\Component\HttpKernel\Controller\ArgumentResolver; |
||
22 | use Symfony\Component\HttpKernel\Controller\ControllerResolverInterface; |
||
23 | use Symfony\Component\HttpKernel\Event\ControllerEvent; |
||
24 | use Symfony\Component\HttpKernel\Event\GetResponseEvent; |
||
25 | use Symfony\Component\HttpKernel\Event\RequestEvent; |
||
26 | use Symfony\Component\HttpKernel\HttpKernelInterface; |
||
27 | use Symfony\Component\HttpKernel\KernelEvents; |
||
28 | use Symfony\Component\Routing\Matcher\UrlMatcherInterface; |
||
29 | |||
30 | class LinkRequestListener |
||
31 | { |
||
32 | /** |
||
33 | * @var ControllerResolverInterface |
||
34 | */ |
||
35 | protected $resolver; |
||
36 | |||
37 | /** |
||
38 | * @var UrlMatcherInterface |
||
39 | */ |
||
40 | protected $urlMatcher; |
||
41 | |||
42 | 96 | /** |
|
43 | * @param ControllerResolverInterface $controllerResolver |
||
44 | 96 | * @param UrlMatcherInterface $urlMatcher |
|
45 | 96 | */ |
|
46 | 96 | public function __construct(ControllerResolverInterface $controllerResolver, UrlMatcherInterface $urlMatcher) |
|
47 | { |
||
48 | $this->resolver = $controllerResolver; |
||
49 | $this->urlMatcher = $urlMatcher; |
||
50 | } |
||
51 | |||
52 | /** |
||
53 | 96 | * @param GetResponseEvent $event |
|
54 | * |
||
55 | 96 | * @return array |
|
56 | 96 | */ |
|
57 | public function onKernelRequest(RequestEvent $event, $eventName, EventDispatcherInterface $dispatcher) |
||
0 ignored issues
–
show
|
|||
58 | { |
||
59 | 2 | if (!$event->getRequest()->headers->has('link')) { |
|
60 | 2 | return; |
|
61 | } |
||
62 | |||
63 | $links = []; |
||
64 | $header = $event->getRequest()->headers->get('link'); |
||
65 | |||
66 | /* |
||
67 | * Due to limitations, multiple same-name headers are sent as comma |
||
68 | * separated values. |
||
69 | 2 | * |
|
70 | 1 | * This breaks those headers into Link headers following the format |
|
71 | 1 | * http://tools.ietf.org/html/rfc2068#section-19.6.2.4 |
|
72 | */ |
||
73 | while (preg_match('/^((?:[^"]|"[^"]*")*?),/', $header, $matches)) { |
||
74 | 2 | $header = trim(substr($header, strlen($matches[0]))); |
|
75 | 2 | $links[] = $matches[1]; |
|
76 | } |
||
77 | |||
78 | 2 | if ($header) { |
|
79 | $links[] = $header; |
||
80 | } |
||
81 | 2 | ||
82 | $requestMethod = $this->urlMatcher->getContext()->getMethod(); |
||
83 | 2 | ||
84 | // The controller resolver needs a request to resolve the controller. |
||
85 | 2 | $stubRequest = new Request(); |
|
86 | |||
87 | 2 | foreach ($links as $idx => $link) { |
|
88 | 2 | // Force the GET method to avoid the use of the previous method (LINK/UNLINK) |
|
89 | 2 | $this->urlMatcher->getContext()->setMethod('GET'); |
|
90 | 2 | ||
91 | 2 | $linkParams = explode(';', trim($link)); |
|
92 | $resourceType = null; |
||
93 | 2 | View Code Duplication | if (count($linkParams) > 1) { |
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
94 | 2 | $resourceType = trim(preg_replace('/<|>/', '', $linkParams[1])); |
|
95 | $resourceType = str_replace('"', '', str_replace('rel=', '', $resourceType)); |
||
96 | } |
||
97 | 2 | $resource = array_shift($linkParams); |
|
98 | 1 | $resource = preg_replace('/<|>/', '', $resource); |
|
99 | |||
100 | 2 | // Assume that no resource is specified here if there is no path separator, because urlMatcher will return homepage |
|
101 | if (false === strpos($resource, '/')) { |
||
102 | continue; |
||
103 | 2 | } |
|
104 | $tempRequest = Request::create($resource); |
||
105 | |||
106 | try { |
||
107 | $route = $this->urlMatcher->match($tempRequest->getRequestUri()); |
||
108 | } catch (\Exception $e) { |
||
109 | 2 | // If we don't have a matching route we return the original Link header |
|
110 | 2 | continue; |
|
111 | 2 | } |
|
112 | |||
113 | $stubRequest->attributes->replace($route); |
||
114 | $stubRequest->server = $event->getRequest()->server; |
||
115 | 2 | $stubRequest::setTrustedProxies(['192.0.0.1', '10.0.0.0/8', $event->getRequest()->server->get('REMOTE_ADDR')], Request::HEADER_X_FORWARDED_ALL); |
|
116 | 2 | // Keep server name in sync with forwarded host |
|
117 | 2 | if ($stubRequest->isFromTrustedProxy() && $stubRequest->server->has('HTTP_X_FORWARDED_HOST')) { |
|
118 | 2 | $stubRequest->server->set('SERVER_NAME', $stubRequest->server->has('HTTP_X_FORWARDED_HOST')); |
|
119 | 2 | } |
|
120 | |||
121 | 2 | if (false === $controller = $this->resolver->getController($stubRequest)) { |
|
122 | 2 | continue; |
|
123 | } |
||
124 | |||
125 | $subEvent = new ControllerEvent($event->getKernel(), $controller, $stubRequest, HttpKernelInterface::SUB_REQUEST); |
||
126 | 2 | $kernelSubEvent = new RequestEvent($event->getKernel(), $stubRequest, HttpKernelInterface::SUB_REQUEST); |
|
127 | $dispatcher->dispatch(KernelEvents::REQUEST, $kernelSubEvent); |
||
128 | 2 | $dispatcher->dispatch(KernelEvents::CONTROLLER, $subEvent); |
|
129 | $controller = $subEvent->getController(); |
||
130 | 2 | ||
131 | $argumentResolver = new ArgumentResolver(); |
||
132 | $arguments = $argumentResolver->getArguments($stubRequest, $controller); |
||
133 | |||
134 | 2 | try { |
|
135 | $result = call_user_func_array($controller, $arguments); |
||
0 ignored issues
–
show
$controller can contain request data and is used in code execution context(s) leading to a potential security vulnerability.
2 paths for user data to reach this point
1. Path:
$this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned
in ServerBag.php on line 59
2. Path:
Read from
$_POST, and $_POST is passed to Request::createRequestFromFactory()
in Request.php on line 285
General Strategies to prevent injectionIn general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
throw new \InvalidArgumentException('This input is not allowed.');
}
For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted;
![]() |
|||
136 | // Our api returns objects for single resources |
||
137 | if (!is_object($result)) { |
||
138 | 2 | continue; |
|
139 | } |
||
140 | |||
141 | // return clean object for LINK requests |
||
142 | 2 | if ($result instanceof ResourcesListResponseInterface) { |
|
143 | 2 | $result = $result->getResources(); |
|
144 | } elseif ($result instanceof SingleResourceResponseInterface) { |
||
145 | 2 | $result = $result->getResource(); |
|
146 | } |
||
147 | |||
148 | $links[$idx] = ['object' => $result, 'resourceType' => $resourceType]; |
||
149 | } catch (\Exception $e) { |
||
150 | $links[$idx] = ['object' => $e, 'resourceType' => 'exception']; |
||
151 | |||
152 | continue; |
||
153 | } |
||
154 | } |
||
155 | |||
156 | $event->getRequest()->attributes->set('links', $links); |
||
157 | $this->urlMatcher->getContext()->setMethod($requestMethod); |
||
158 | |||
159 | return $links; |
||
160 | } |
||
161 | } |
||
162 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.