Issues in PulseUser.php (master) - Issues in master - allejo/PhpPulse - Measure and Improve Code Quality continuously with Scrutinizer

Issues (40)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/PulseUser.php (1 issue)

Labels

Severity

Minor 1

allejo 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

/**
 * @copyright 2017 Vladimir Jimenez
 * @license   https://github.com/allejo/PhpPulse/blob/master/LICENSE.md MIT
 */

namespace allejo\DaPulse;

use allejo\DaPulse\Objects\ApiObject;

/**
 * The PulseUser class contains all of the functions related to accessing information about a user
 *
 * @api
 * @package allejo\DaPulse
 * @since   0.1.0
 */
class PulseUser extends ApiObject
{
    const API_PREFIX = "users";

    /**
     * The resource's URL.
     *
     * @var string
     */
    protected $url;

    /**
     * The user's name.
     *
     * @var string
     */
    protected $name;

    /**
     * The user's email.
     *
     * @var string
     */
    protected $email;

    /**
     * The user's photo_url.
     *
     * @var string
     */
    protected $photo_url;

    /**
     * The user's title.
     *
     * @var string
     */
    protected $title;

    /**
     * The user's position.
     *
     * @var string
     */
    protected $position;

    /**
     * The user's phone.
     *
     * @var string
     */
    protected $phone;

    /**
     * The user's location.
     *
     * @var string
     */
    protected $location;

    /**
     * The user's status.
     *
     * @var string
     */
    protected $status;

    /**
     * The user's birthday.
     *
     * @var string
     */
    protected $birthday;

    /**
     * True if the user is guest, false otherwise
     *
     * @var bool
     */
    protected $is_guest;

    /**
     * The user's skills.
     *
     * @var string[]
     */
    protected $skills;

    /**
     * Creation time.
     *
     * @var \DateTime
     */
    protected $created_at;

    /**
     * Last update time.
     *
     * @var \DateTime
     */
    protected $updated_at;

    /**
     * The URL pattern used for all calls
     *
     * @var string
     */
    private $urlSyntax = "%s/%s/%s.json";

    // ================================================================================================================
    //   Getter functions
    // ================================================================================================================

    /**
     * The resource's URL.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return string
     */
    public function getUrl ()
    {
        $this->lazyLoad();

        return $this->url;
    }

    /**
     * The user's unique identifier.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return int
     */
    public function getId ()
    {
        return $this->id;
    }

    /**
     * The user's name.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return string
     */
    public function getName ()
    {
        $this->lazyLoad();

        return $this->name;
    }

    /**
     * The user's email.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return string
     */
    public function getEmail ()
    {
        $this->lazyLoad();

        return $this->email;
    }

    /**
     * The user's photo_url.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return string
     */
    public function getPhotoUrl ()
    {
        $this->lazyLoad();

        return $this->photo_url;
    }

    /**
     * The user's title.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return string
     */
    public function getTitle ()
    {
        $this->lazyLoad();

        return $this->title;
    }

    /**
     * The user's position.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return string
     */
    public function getPosition ()
    {
        $this->lazyLoad();

        return $this->position;
    }

    /**
     * The user's phone.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return string
     */
    public function getPhone ()
    {
        $this->lazyLoad();

        return $this->phone;
    }

    /**
     * The user's location.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return string
     */
    public function getLocation ()
    {
        $this->lazyLoad();

        return $this->location;
    }

    /**
     * The user's status.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return string
     */
    public function getStatus ()
    {
        $this->lazyLoad();

        return $this->status;
    }

    /**
     * The user's birthday.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return string
     */
    public function getBirthday ()
    {
        $this->lazyLoad();

        return $this->birthday;
    }

    /**
     * The user's skills.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return string[]
     */
    public function getSkills ()
    {
        $this->lazyLoad();

        return $this->skills;
    }

    /**
     * Creation time.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return \DateTime
     */
    public function getCreatedAt ()
    {
        $this->lazyLoad();
        self::lazyCast($this->created_at, '\DateTime');

        return $this->created_at;
    }

    /**
     * Last update time.
     *
     * @api
     *
     * @since  0.1.0
     *
     * @return \DateTime
     */
    public function getUpdatedAt ()
    {
        $this->lazyLoad();
        self::lazyCast($this->updated_at, '\DateTime');

        return $this->updated_at;
    }

    /**
     * True if the user is guest, false otherwise
     *
     * @api
     *
     * @since  0.3.0
     *
     * @return bool
     */
    public function isGuest ()
    {
        $this->lazyLoad();

        return $this->is_guest;
    }

    /**
     * Get the user's newsfeed
     *
     * @api
     *
     * @param  array $params GET parameters that need to be passed in the URL
     *
     * @since  0.1.0
     *
     * @return PulseUpdate[] An array of PulseUpdates that make up the user's newsfeed
     */
    public function getNewsFeed ($params = [])
    {
        $url = sprintf($this->urlSyntax, parent::apiEndpoint(), $this->id, "newsfeed");

        return parent::fetchAndCastToObjectArray($url, "PulseUpdate", $params);
    }

    /**
     * Get the user's posts
     *
     * @api
     *
     * @param  array $params GET parameters that need to be passed in the URL
     *
     * @since  0.1.0
     *
     * @return PulseUpdate[] An array of PulseUpdates for each of the posts
     */
    public function getPosts ($params = [])
    {
        $url = sprintf($this->urlSyntax, parent::apiEndpoint(), $this->id, "posts");

        return parent::fetchAndCastToObjectArray($url, "PulseUpdate", $params);
    }

    /**
     * Get the user's unread posts
     *
     * @api
     *
     * @param  array $params GET parameters that need to be passed in the URL
     *
     * @since  0.1.0
     *
     * @return PulseUpdate[] An array of PulseUpdates for each of the posts
     */
    public function getUnreadFeed ($params = [])
    {
        $url = sprintf($this->urlSyntax, parent::apiEndpoint(), $this->id, "unread_feed");

        return parent::fetchAndCastToObjectArray($url, "PulseUpdate", $params);
    }

    /**
     * Get all of the users
     *
     * @api
     *
     * @param  array $params GET parameters that need to be passed in the URL
     *
     * @since  0.1.0
     *
     * @return PulseUser[] An array of PulseUsers for each of the users
     */
    public static function getUsers ($params = [])
    {
        $url = sprintf("%s.json", parent::apiEndpoint());
class Daddy
{
    protected function getFirstName()
    {
        return "Eidur";
    }

    protected function getSurName()
    {
        return "Gudjohnsen";
    }
}

class Son
{
    public function getFirstName()
    {
        return parent::getSurname();
    }
}

        return parent::fetchAndCastToObjectArray($url, "PulseUser", $params);
    }

    // =================================================================================================================
    //   Convenience functions
    // =================================================================================================================

    /**
     * Check whether a given value can be casted or used to get a user ID
     *
     * @internal
     *
     * @param int|PulseUser $user
     *
     * @since 0.3.0
     *
     * @throws \InvalidArgumentException if $user is not an integer, is not positive, or is not a PulseUser object
     */
    public static function _isCastable ($user)
    {
        if ((!is_int($user) || (is_int($user) && $user < 1)) && !($user instanceof PulseUser))
        {
            throw new \InvalidArgumentException('$user is expected to be a positive integer or a PulseUser object');
        }
    }

    /**
     * @internal
     *
     * @param  int|PulseUser $user
     *
     * @since  0.3.0
     *
     * @throws \InvalidArgumentException
     *
     * @return int
     */
    public static function _castToInt ($user)
    {
        self::_isCastable($user);

        return ($user instanceof PulseUser) ? $user->getId() : $user;
    }
}


1		<?php
2
3		/**
4		* @copyright 2017 Vladimir Jimenez
5		* @license https://github.com/allejo/PhpPulse/blob/master/LICENSE.md MIT
6		*/
7
8		namespace allejo\DaPulse;
9
10		use allejo\DaPulse\Objects\ApiObject;
11
12		/**
13		* The PulseUser class contains all of the functions related to accessing information about a user
14		*
15		* @api
16		* @package allejo\DaPulse
17		* @since 0.1.0
18		*/
19		class PulseUser extends ApiObject
20		{
21		const API_PREFIX = "users";
22
23		/**
24		* The resource's URL.
25		*
26		* @var string
27		*/
28		protected $url;
29
30		/**
31		* The user's name.
32		*
33		* @var string
34		*/
35		protected $name;
36
37		/**
38		* The user's email.
39		*
40		* @var string
41		*/
42		protected $email;
43
44		/**
45		* The user's photo_url.
46		*
47		* @var string
48		*/
49		protected $photo_url;
50
51		/**
52		* The user's title.
53		*
54		* @var string
55		*/
56		protected $title;
57
58		/**
59		* The user's position.
60		*
61		* @var string
62		*/
63		protected $position;
64
65		/**
66		* The user's phone.
67		*
68		* @var string
69		*/
70		protected $phone;
71
72		/**
73		* The user's location.
74		*
75		* @var string
76		*/
77		protected $location;
78
79		/**
80		* The user's status.
81		*
82		* @var string
83		*/
84		protected $status;
85
86		/**
87		* The user's birthday.
88		*
89		* @var string
90		*/
91		protected $birthday;
92
93		/**
94		* True if the user is guest, false otherwise
95		*
96		* @var bool
97		*/
98		protected $is_guest;
99
100		/**
101		* The user's skills.
102		*
103		* @var string[]
104		*/
105		protected $skills;
106
107		/**
108		* Creation time.
109		*
110		* @var \DateTime
111		*/
112		protected $created_at;
113
114		/**
115		* Last update time.
116		*
117		* @var \DateTime
118		*/
119		protected $updated_at;
120
121		/**
122		* The URL pattern used for all calls
123		*
124		* @var string
125		*/
126		private $urlSyntax = "%s/%s/%s.json";
127
128		// ================================================================================================================
129		// Getter functions
130		// ================================================================================================================
131
132		/**
133		* The resource's URL.
134		*
135		* @api
136		*
137		* @since 0.1.0
138		*
139		* @return string
140		*/
141		public function getUrl ()
142		{
143		$this->lazyLoad();
144
145		return $this->url;
146		}
147
148		/**
149		* The user's unique identifier.
150		*
151		* @api
152		*
153		* @since 0.1.0
154		*
155		* @return int
156		*/
157	8	public function getId ()
158		{
159	8	return $this->id;
160		}
161
162		/**
163		* The user's name.
164		*
165		* @api
166		*
167		* @since 0.1.0
168		*
169		* @return string
170		*/
171		public function getName ()
172		{
173		$this->lazyLoad();
174
175		return $this->name;
176		}
177
178		/**
179		* The user's email.
180		*
181		* @api
182		*
183		* @since 0.1.0
184		*
185		* @return string
186		*/
187		public function getEmail ()
188		{
189		$this->lazyLoad();
190
191		return $this->email;
192		}
193
194		/**
195		* The user's photo_url.
196		*
197		* @api
198		*
199		* @since 0.1.0
200		*
201		* @return string
202		*/
203		public function getPhotoUrl ()
204		{
205		$this->lazyLoad();
206
207		return $this->photo_url;
208		}
209
210		/**
211		* The user's title.
212		*
213		* @api
214		*
215		* @since 0.1.0
216		*
217		* @return string
218		*/
219		public function getTitle ()
220		{
221		$this->lazyLoad();
222
223		return $this->title;
224		}
225
226		/**
227		* The user's position.
228		*
229		* @api
230		*
231		* @since 0.1.0
232		*
233		* @return string
234		*/
235		public function getPosition ()
236		{
237		$this->lazyLoad();
238
239		return $this->position;
240		}
241
242		/**
243		* The user's phone.
244		*
245		* @api
246		*
247		* @since 0.1.0
248		*
249		* @return string
250		*/
251		public function getPhone ()
252		{
253		$this->lazyLoad();
254
255		return $this->phone;
256		}
257
258		/**
259		* The user's location.
260		*
261		* @api
262		*
263		* @since 0.1.0
264		*
265		* @return string
266		*/
267		public function getLocation ()
268		{
269		$this->lazyLoad();
270
271		return $this->location;
272		}
273
274		/**
275		* The user's status.
276		*
277		* @api
278		*
279		* @since 0.1.0
280		*
281		* @return string
282		*/
283		public function getStatus ()
284		{
285		$this->lazyLoad();
286
287		return $this->status;
288		}
289
290		/**
291		* The user's birthday.
292		*
293		* @api
294		*
295		* @since 0.1.0
296		*
297		* @return string
298		*/
299		public function getBirthday ()
300		{
301		$this->lazyLoad();
302
303		return $this->birthday;
304		}
305
306		/**
307		* The user's skills.
308		*
309		* @api
310		*
311		* @since 0.1.0
312		*
313		* @return string[]
314		*/
315		public function getSkills ()
316		{
317		$this->lazyLoad();
318
319		return $this->skills;
320		}
321
322		/**
323		* Creation time.
324		*
325		* @api
326		*
327		* @since 0.1.0
328		*
329		* @return \DateTime
330		*/
331		public function getCreatedAt ()
332		{
333		$this->lazyLoad();
334		self::lazyCast($this->created_at, '\DateTime');
335
336		return $this->created_at;
337		}
338
339		/**
340		* Last update time.
341		*
342		* @api
343		*
344		* @since 0.1.0
345		*
346		* @return \DateTime
347		*/
348		public function getUpdatedAt ()
349		{
350		$this->lazyLoad();
351		self::lazyCast($this->updated_at, '\DateTime');
352
353		return $this->updated_at;
354		}
355
356		/**
357		* True if the user is guest, false otherwise
358		*
359		* @api
360		*
361		* @since 0.3.0
362		*
363		* @return bool
364		*/
365		public function isGuest ()
366		{
367		$this->lazyLoad();
368
369		return $this->is_guest;
370		}
371
372		/**
373		* Get the user's newsfeed
374		*
375		* @api
376		*
377		* @param array $params GET parameters that need to be passed in the URL
378		*
379		* @since 0.1.0
380		*
381		* @return PulseUpdate[] An array of PulseUpdates that make up the user's newsfeed
382		*/
383		public function getNewsFeed ($params = [])
384		{
385		$url = sprintf($this->urlSyntax, parent::apiEndpoint(), $this->id, "newsfeed");
386
387		return parent::fetchAndCastToObjectArray($url, "PulseUpdate", $params);
388		}
389
390		/**
391		* Get the user's posts
392		*
393		* @api
394		*
395		* @param array $params GET parameters that need to be passed in the URL
396		*
397		* @since 0.1.0
398		*
399		* @return PulseUpdate[] An array of PulseUpdates for each of the posts
400		*/
401		public function getPosts ($params = [])
402		{
403		$url = sprintf($this->urlSyntax, parent::apiEndpoint(), $this->id, "posts");
404
405		return parent::fetchAndCastToObjectArray($url, "PulseUpdate", $params);
406		}
407
408		/**
409		* Get the user's unread posts
410		*
411		* @api
412		*
413		* @param array $params GET parameters that need to be passed in the URL
414		*
415		* @since 0.1.0
416		*
417		* @return PulseUpdate[] An array of PulseUpdates for each of the posts
418		*/
419		public function getUnreadFeed ($params = [])
420		{
421		$url = sprintf($this->urlSyntax, parent::apiEndpoint(), $this->id, "unread_feed");
422
423		return parent::fetchAndCastToObjectArray($url, "PulseUpdate", $params);
424		}
425
426		/**
427		* Get all of the users
428		*
429		* @api
430		*
431		* @param array $params GET parameters that need to be passed in the URL
432		*
433		* @since 0.1.0
434		*
435		* @return PulseUser[] An array of PulseUsers for each of the users
436		*/
437		public static function getUsers ($params = [])
438		{
439		$url = sprintf("%s.json", parent::apiEndpoint());
		0 ignored issues – show Comprehensibility Bug introduced 2015-11-24 07:30 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like you call parent on a different method (`apiEndpoint()` instead of `getUsers()`). Are you sure this is correct? If so, you might want to change this to `$this->apiEndpoint()`. This check looks for a call to a parent method whose name is different than the method from which it is called. Consider the following code: class Daddy { protected function getFirstName() { return "Eidur"; } protected function getSurName() { return "Gudjohnsen"; } } class Son { public function getFirstName() { return parent::getSurname(); } } The `getFirstName()` method in the `Son` calls the wrong method in the parent class. Loading history...
440
441		return parent::fetchAndCastToObjectArray($url, "PulseUser", $params);
442		}
443
444		// =================================================================================================================
445		// Convenience functions
446		// =================================================================================================================
447
448		/**
449		* Check whether a given value can be casted or used to get a user ID
450		*
451		* @internal
452		*
453		* @param int\|PulseUser $user
454		*
455		* @since 0.3.0
456		*
457		* @throws \InvalidArgumentException if $user is not an integer, is not positive, or is not a PulseUser object
458		*/
459	14	public static function _isCastable ($user)
460		{
461	14	if ((!is_int($user) \|\| (is_int($user) && $user < 1)) && !($user instanceof PulseUser))
462		{
463	6	throw new \InvalidArgumentException('$user is expected to be a positive integer or a PulseUser object');
464		}
465	8	}
466
467		/**
468		* @internal
469		*
470		* @param int\|PulseUser $user
471		*
472		* @since 0.3.0
473		*
474		* @throws \InvalidArgumentException
475		*
476		* @return int
477		*/
478	14	public static function _castToInt ($user)
479		{
480	14	self::_isCastable($user);
481
482	8	return ($user instanceof PulseUser) ? $user->getId() : $user;
483		}
484		}
485

allejo / PhpPulse

Issues (40)

Security Analysis no request data

src/PulseUser.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like