for testing and deploying your application
for finding and fixing issues
for empowering human code reviews
<?php
/*
* This file is part of the Laravel Lodash package.
*
* (c) Avtandil Kikabidze aka LONGMAN <[email protected]>
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
declare(strict_types=1);
namespace Longman\LaravelLodash\Middlewares;
use Closure;
use Illuminate\Http\Request;
class XssSecurity
{
public function handle(Request $request, Closure $next)
$response = $next($request);
$request_uri = $request->getUri();
$request_uri
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
$myVar = 'Value'; $higher = false; if (rand(1, 6) > 3) { $higher = true; } else { $higher = false; }
Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.
$myVar
$higher
$excluded = config('lodash.xss.exclude_uris');
if (! empty($excluded)) {
foreach ($excluded as $uri) {
if (strpos($uri, '/itdc/debug') !== false) {
return $response;
}
// http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx
$response->headers->set('X-Frame-Options', config('lodash.xss.x_frame_options'), true);
// http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
$response->headers->set('X-Content-Type-Options', config('lodash.xss.x_content_type_options'), true);
// http://msdn.microsoft.com/en-us/library/dd565647(v=vs.85).aspx
$response->headers->set('X-XSS-Protection', config('lodash.xss.x_xss_protection'), true);
akalongman /
laravel-lodash
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVarassignment in line 1 and the$higherassignment in line 2 are dead. The first because$myVaris never used and the second because$higheris always overwritten for every possible time line.