Issues (1)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Helpers/BaseController.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Ibonly\EtextMail\Helpers;
4
5
use Illuminate\Support\Facades\Config;
6
use Ibonly\EtextMail\Exception\EtextMailException;
7
8
class BaseController
9
{
10
    /**
11
     * Get senderid from environment variable
12
     * @access public
13
     * @return string
14
     */
15
    public function getSenderId()
16
    {
17
        return Config::get('etextmail.senderid');
18
    }
19
20
    /**
21
     * get username from environment variables
22
     * 
23
     * @return string
24
     */
25
    public function getUsername()
26
    {
27
        return Config::get('etextmail.username');
28
    }
29
30
    /**
31
     * get password from environment variables
32
     * @access public
33
     * @return string
34
     */
35
    public function getPassword()
36
    {
37
        return Config::get('etextmail.password');
38
    }
39
40
    /**
41
     * get url from environment variables
42
     * @access public
43
     * @return string
44
     */
45
    public function getDomain()
46
    {
47
        return Config::get('etextmail.url');
48
    }
49
50
    /**
51
     * Set the data required to get credit balance
52
     * @access public
53
     * @return array
54
     */
55
    public function setBalanceData()
56
    {
57
        return [
58
                'UN' => $this->getUsername(), 
59
                'p'  => $this->getPassword()
60
            ];
61
    }
62
63
    /**
64
     * Set the data required to send sms
65
     * @param  integer $destination
66
     * @param  string $message
67
     * @param  integer $long
68
     * @access public
69
     * @return array
70
     */
71
    public function setSendData($destination, $message, $long)
72
    {
73
        $longSms = $long === null ? 0 : $long;
74
75
        return [     
76
                'UN' => $this->getUsername(), 
77
                'p'  => $this->getPassword(),
78
                'SA' => $this->getSenderId(),
79
                'DA' => $destination,
80
                'L'  => $longSms, 
81
                'M'  => $message
82
            ];
83
    }
84
85
    /**
86
     * Set the data required to get message details
87
     * @param  string $message
88
     * @access public
89
     * @return array
90
     */
91
    public function setMessageCountData($message)
92
    {
93
        return [
94
                'UN' => $this->getUsername(), 
95
                'p'  => $this->getPassword(),
96
                'M'  => $message
97
            ];
98
    }
99
100
    /**
101
     * Build sms send api url
102
     * @access public
103
     * @return string
104
     */
105
    public function sendSMSBaseUrl()
106
    {
107
        return $this->getDomain() . "/smsapi/Send.aspx?";
108
    }
109
110
    /**
111
     * Build credit balance api url
112
     * @access public
113
     * @return string
114
     */
115
    public function creditBalanceBaseUrl()
116
    {
117
        return $this->getDomain() . '/smsapi/GetCreditBalance.aspx?';
118
    }
119
120
    /**
121
     * Build character count api url
122
     * @access public
123
     * @return string
124
     */
125
    public function characterCountBaseUrl()
126
    {
127
        return $this->getDomain() . "/smsapi/GetCharacterCount.aspx?";
128
    }
129
130
    /**
131
     * Build message count api url
132
     * @access public
133
     * @return string
134
     */
135
    public function messageCountBaseUrl()
136
    {
137
        return $this->getDomain() . "/smsapi/GetMessageCount.aspx?";
138
    }
139
140
    /**
141
     * Build the query string parameter
142
     * @param  array $sData
143
     * @access public
144
     * @return string      
145
     */
146
    public function queryString($sData)
147
    {
148
        $data = array();
149
150
        while (list($var, $value) = each($sData)) {
151
            $data[] = "$var=$value";
152
        }
153
154
        return implode('&', $data);
155
    }
156
157
    /**
158
     * Validate api url
159
     * @param  string $url
160
     * @access public
161
     * @return string
162
     */
163
    public function parseUrl($url)
164
    {
165
        $url = parse_url($url);
166
        if ($url['scheme'] != 'http') {
167
            throw new EtextMailException();
168
        }
169
170
        return $url;
171
    }
172
173
    /**
174
     * Process http request
175
     * @param  string $url
176
     * @param  $sData
177
     * @access public
178
     * @return resource
179
     */
180
    public function sendRequest($url, $sData)
181
    {
182
        $data = $this->queryString($sData);
183
        $host = $this->parseUrl($url)['host']; // extract host and path:
184
        $path = $this->parseUrl($url)['path'];
185
        $socket = fsockopen($host, 80); // open a socket connection on port 80
186
     
187
        fputs($socket, "POST $path HTTP/1.1\r\n"); // send the request headers:
188
        fputs($socket, "Host: $host\r\n");
189
        fputs($socket, "Content-type: application/x-www-form-urlencoded\r\n");
190
        fputs($socket, "Content-length: " . strlen($data) . "\r\n");
191
        fputs($socket, "Connection: close\r\n\r\n");
192
        fputs($socket, $data);
193
194
        return $socket;
195
    }
196
197
    /**
198
     * Recieve result from the request
199
     * @param  string $url
200
     * @param  array $sData
201
     * @access public
202
     * @return array
203
     */
204
    public function postRequest($url, $sData) 
205
    {
206
        $socket = $this->sendRequest($url, $sData);
207
        $result = ''; 
208
209
        while (!feof($socket)) {
210
            $result .= fgets($socket, 128);
211
        }
212
213
        fclose($socket);
214
     
215
        $result = explode("\r\n\r\n", $result, 2); // split the result header from the content
216
        $header = isset($result[0]) ? $result[0] : '';
217
        $content = isset($result[1]) ? $result[1] : '';
218
     
219
        return [$header, $content];
220
    }
221
222
    /**
223
     * @param string $senderId
224
     * @access public
225
     * @return boolean
226
     */
227
    public function validateSenderId($senderId)
228
    {
229
        return strlen($senderId) <= 11 != 0 && strlen($senderId) >= 2 ? true : false;
230
    }
231
232
    /**
233
     * Get the response data from the result
234
     * @param  string $url
235
     * @param  array $data
236
     * @access public
237
     * @return string
238
     */
239
    public function getResponse($url, $data)
240
    {
241
        list($header, $content) = $this->postRequest($url, $data);
0 ignored issues
show
The assignment to $header is unused. Consider omitting it like so list($first,,$third).

This checks looks for assignemnts to variables using the list(...) function, where not all assigned variables are subsequently used.

Consider the following code example.

<?php

function returnThreeValues() {
    return array('a', 'b', 'c');
}

list($a, $b, $c) = returnThreeValues();

print $a . " - " . $c;

Only the variables $a and $c are used. There was no need to assign $b.

Instead, the list call could have been.

list($a,, $c) = returnThreeValues();
Loading history...
242
        $tok = strtok($content, " "); //Split the $content result into words
243
        $errorCode = explode(' ', $content)[1];
244
245
        if (!$this->validateSenderId($this->getSenderId())) {
246
            throw new EtextMailException($errorCode);
247
        }
248
249
        return $this->successErrorMessage($tok, $errorCode);
250
    }
251
252
    /**
253
     * Output function for call
254
     * @param  string $tok
255
     * @param  integer $errorCode
256
     * @access public
257
     * @return string
258
     */
259
    public function successErrorMessage($tok, $errorCode)
260
    {
261
        if ($tok == "OK") {
262
            $tok = strtok(" ");
263
            return $tok;
264
        }
265
        
266
        throw new EtextMailException($errorCode);
267
    }
268
}