Issues in PropertyParserTrait.php (master) - Issues in master - appserver-io/doppelgaenger - Measure and Improve Code Quality continuously with Scrutinizer

Issues (245)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Parser/PropertyParserTrait.php (9 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

/**
 * \AppserverIo\Doppelgaenger\Parser\PropertyParserTrait
 *
 * NOTICE OF LICENSE
 *
 * This source file is subject to the Open Software License (OSL 3.0)
 * that is available through the world-wide-web at this URL:
 * http://opensource.org/licenses/osl-3.0.php
 *
 * PHP version 5
 *
 * @author    Bernhard Wick <[email protected]>
 * @copyright 2015 TechDivision GmbH - <[email protected]>
 * @license   http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
 * @link      https://github.com/appserver-io/doppelgaenger
 * @link      http://www.appserver.io/
 */

namespace AppserverIo\Doppelgaenger\Parser;

use AppserverIo\Doppelgaenger\Entities\Definitions\AttributeDefinition;
use AppserverIo\Doppelgaenger\Entities\Lists\AttributeDefinitionList;
use AppserverIo\Doppelgaenger\Entities\Lists\TypedListList;

/**
 * Trait which will allow the re-usability of methods for parsing structure properties
 *
 * @author    Bernhard Wick <[email protected]>
 * @copyright 2015 TechDivision GmbH - <[email protected]>
 * @license   http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
 * @link      https://github.com/appserver-io/doppelgaenger
 * @link      http://www.appserver.io/
 *
 * @property \AppserverIo\Doppelgaenger\Interfaces\StructureDefinitionInterface $currentDefinition The current definition we are working on. Assumed to be present in parent
 */
trait PropertyParserTrait
{

    /**
     * Retrieves class attributes from token array.
     *
     * This method will search for any attributes a class might have. Just pass the token array of the class.
     * Work is done using token definitions and common sense in regards to PHP syntax.
     * To retrieve the different properties of an attribute it relies on getAttributeProperties().
     * We need the list of invariants to mark attributes wo are under surveillance.
     *
     * @param array         $tokens     Array of tokens for this class
     * @param TypedListList $invariants List of invariants so we can compare the attributes to
     *
     * @return AttributeDefinitionList
     */
    public function getAttributes(array $tokens, TypedListList $invariants = null)
    {
        // Check the tokens
        $attributes = new AttributeDefinitionList();
        for ($i = 0; $i < count($tokens); $i++) {
for ($i=0; $i<count($array); $i++) { // calls count() on each iteration
}

// Better
for ($i=0, $c=count($array); $i<$c; $i++) { // calls count() just once
}
            // If we got a variable we will check if there is any function definition above it.
            // If not, we got an attribute, if so we will check if there is an even number of closing and opening
            // brackets above it, which would mean we are not in the function.
            if (is_array($tokens[$i]) && $tokens[$i][0] === T_VARIABLE) {
                for ($j = $i - 1; $j >= 0; $j--) {
                    if (is_array($tokens[$j]) && $tokens[$j][0] === T_FUNCTION) {
                        // Initialize our counter and also the check if we even started counting
                        $bracketCounter = 0;
                        $usedCounter = false;

                        // We got something, lets count the brackets between it and our variable's position
                        for ($k = $j + 1; $k < $i; $k++) {
                            if ($tokens[$k] === '{' || $tokens[$k][0] === T_CURLY_OPEN) {
                                $usedCounter = true;
                                $bracketCounter++;


                            } elseif ($tokens[$k] === '}') {
                                $usedCounter = true;
                                $bracketCounter--;
                            }
                        }

                        // If we got an even number of brackets (the counter is 0 and got used), we got an attribute
                        if ($bracketCounter === 0 && $usedCounter === true) {
                            $attributes->set($tokens[$i][1], $this->getAttributeProperties($tokens, $i));
                        }

                        break;


                    } elseif (is_array($tokens[$j]) && $tokens[$j][0] === $this->getToken()) {
                        // If we reach the class definition without passing a function we definitely got an attribute
                        $attributes->set($tokens[$i][1], $this->getAttributeProperties($tokens, $i));
                        break;
                    }
                }
            }
        }

        // If we got invariants we will check if our attributes are used in invariants
        if ($invariants !== null) {
            // Lets iterate over all the attributes and check them against the invariants we got
            $listIterator = $invariants->getIterator();
            $listCount = $listIterator->count();
            $attributeIterator = $attributes->getIterator();
            $attributeCount = $attributeIterator->count();
            for ($i = 0; $i < $attributeCount; $i++) {
                // Do we have any of these attributes in our invariants?
                $listIterator = $invariants->getIterator();
                for ($j = 0; $j < $listCount; $j++) {
                    // Did we get anything useful?
                    if ($listIterator->current() === null) {
                        continue;
                    }

                    /** @var \AppserverIo\Doppelgaenger\Interfaces\TypedListInterface|\Iterator $invariantIterator */
                    $invariantIterator = $listIterator->current()->getIterator();

                    $invariantCount = $invariantIterator->count();
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
                    for ($k = 0; $k < $invariantCount; $k++) {
                        $attributePosition = strpos(
                            $invariantIterator->current()->getString(),
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
                            '$this->' . ltrim(
                                $attributeIterator->current()->getName(),
                                '$'
                            )
                        );

                        if ($attributePosition !== false
                        ) {
                            // Tell them we were mentioned and persist it
                            $attributeIterator->current()->setInInvariant(true);
                        }

                        $invariantIterator->next();
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
                    }
                    $listIterator->next();
                }
                $attributeIterator->next();
            }
        }

        return $attributes;
    }

    /**
     * Will return a definition of an attribute as far as we can extract it from the token array
     *
     * @param array $tokens            Array of tokens for this class
     * @param int   $attributePosition Position of the attribute within the token array
     *
     * @return AttributeDefinition
     */
    public function getAttributeProperties(array $tokens, $attributePosition)
    {
        // We got the tokens and the position of the attribute, so look in front of it for visibility and a
        // possible static keyword
        $attribute = new AttributeDefinition();
        $attribute->setName($tokens[$attributePosition][1]);
        $attribute->setLine($tokens[$attributePosition][2]);
        $attribute->setStructureName($this->currentDefinition->getQualifiedName());

        for ($i = $attributePosition; $i > $attributePosition - 6; $i--) {
            // Search for the visibility
            if (is_array($tokens[$i]) && ($tokens[$i][0] === T_PRIVATE || $tokens[$i][0] === T_PROTECTED)) {
                // Got it!
                $attribute->setVisibility($tokens[$i][1]);
            }

            // Do we get a static keyword?
            if (is_array($tokens[$i]) && $tokens[$i][0] === T_STATIC) {
                // default is false, so set it to true
                $attribute->setIsStatic(true);
            }
        }

        // Now check if there is any default value for this attribute, if so we have to get it
        $defaultValue = null;
        for ($i = $attributePosition; $i < count($tokens); $i++) {
for ($i=0; $i<count($array); $i++) { // calls count() on each iteration
}

// Better
for ($i=0, $c=count($array); $i<$c; $i++) { // calls count() just once
}
            // If we reach the semicolon we do not have anything here.
            if ($tokens[$i] === ';') {
                break;
            }

            if ($defaultValue !== null) {
                // Do we get a static keyword?
                if (is_array($tokens[$i])) {
                    $defaultValue .= $tokens[$i][1];


                } else {
                    $defaultValue .= $tokens[$i];
                }
            }

            // If we pass a = we have to get ready to make notes
            if ($tokens[$i] === '=') {
                $defaultValue = '';
            }
        }

        // Set the default Value
        $attribute->setDefaultValue($defaultValue);

        // Last but not least we have to check if got the visibility, if not, set it public.
        // This is necessary, as missing visibility in the definition will also default to public
        if ($attribute->getVisibility() === '') {
            $attribute->setVisibility('public');
        }

        return $attribute;
    }

    /**
     * We by default assume we are used to parse classes
     *
     * @return int
     */
    public function getToken()
    {
        return T_CLASS;
    }
}


Issues (245)

Security Analysis no request data

src/Parser/PropertyParserTrait.php (9 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Available Fixes

Available Fixes

Available Fixes

1		<?php
2
3		/**
4		* \AppserverIo\Doppelgaenger\Parser\PropertyParserTrait
5		*
6		* NOTICE OF LICENSE
7		*
8		* This source file is subject to the Open Software License (OSL 3.0)
9		* that is available through the world-wide-web at this URL:
10		* http://opensource.org/licenses/osl-3.0.php
11		*
12		* PHP version 5
13		*
14		* @author Bernhard Wick <[email protected]>
15		* @copyright 2015 TechDivision GmbH - <[email protected]>
16		* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
17		* @link https://github.com/appserver-io/doppelgaenger
18		* @link http://www.appserver.io/
19		*/
20
21		namespace AppserverIo\Doppelgaenger\Parser;
22
23		use AppserverIo\Doppelgaenger\Entities\Definitions\AttributeDefinition;
24		use AppserverIo\Doppelgaenger\Entities\Lists\AttributeDefinitionList;
25		use AppserverIo\Doppelgaenger\Entities\Lists\TypedListList;
26
27		/**
28		* Trait which will allow the re-usability of methods for parsing structure properties
29		*
30		* @author Bernhard Wick <[email protected]>
31		* @copyright 2015 TechDivision GmbH - <[email protected]>
32		* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
33		* @link https://github.com/appserver-io/doppelgaenger
34		* @link http://www.appserver.io/
35		*
36		* @property \AppserverIo\Doppelgaenger\Interfaces\StructureDefinitionInterface $currentDefinition The current definition we are working on. Assumed to be present in parent
37		*/
38		trait PropertyParserTrait
39		{
40
41		/**
42		* Retrieves class attributes from token array.
43		*
44		* This method will search for any attributes a class might have. Just pass the token array of the class.
45		* Work is done using token definitions and common sense in regards to PHP syntax.
46		* To retrieve the different properties of an attribute it relies on getAttributeProperties().
47		* We need the list of invariants to mark attributes wo are under surveillance.
48		*
49		* @param array $tokens Array of tokens for this class
50		* @param TypedListList $invariants List of invariants so we can compare the attributes to
51		*
52		* @return AttributeDefinitionList
53		*/
54		public function getAttributes(array $tokens, TypedListList $invariants = null)
55		{
56		// Check the tokens
57		$attributes = new AttributeDefinitionList();
58		for ($i = 0; $i < count($tokens); $i++) {
		0 ignored issues – show Performance Best Practice introduced 2016-01-05 11:21 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like you are calling the size function `count()` as part of the test condition. You might want to compute the size beforehand, and not on each iteration. If the size of the collection does not change during the iteration, it is generally a good practice to compute it beforehand, and not on each iteration: for ($i=0; $i<count($array); $i++) { // calls count() on each iteration } // Better for ($i=0, $c=count($array); $i<$c; $i++) { // calls count() just once } Loading history...
59		// If we got a variable we will check if there is any function definition above it.
60		// If not, we got an attribute, if so we will check if there is an even number of closing and opening
61		// brackets above it, which would mean we are not in the function.
62		if (is_array($tokens[$i]) && $tokens[$i][0] === T_VARIABLE) {
63		for ($j = $i - 1; $j >= 0; $j--) {
64		if (is_array($tokens[$j]) && $tokens[$j][0] === T_FUNCTION) {
65		// Initialize our counter and also the check if we even started counting
66		$bracketCounter = 0;
67		$usedCounter = false;
68
69		// We got something, lets count the brackets between it and our variable's position
70		for ($k = $j + 1; $k < $i; $k++) {
71		if ($tokens[$k] === '{' \|\| $tokens[$k][0] === T_CURLY_OPEN) {
72		$usedCounter = true;
73		$bracketCounter++;
74
		0 ignored issues – show Coding Style introduced 2016-12-02 23:50 UTC by Report Bug Copy Issue Report Show Similar Issues like this Blank line found at end of control structure Loading history...
75		} elseif ($tokens[$k] === '}') {
76		$usedCounter = true;
77		$bracketCounter--;
78		}
79		}
80
81		// If we got an even number of brackets (the counter is 0 and got used), we got an attribute
82		if ($bracketCounter === 0 && $usedCounter === true) {
83		$attributes->set($tokens[$i][1], $this->getAttributeProperties($tokens, $i));
84		}
85
86		break;
87
		0 ignored issues – show Coding Style introduced 2016-12-02 23:50 UTC by Report Bug Copy Issue Report Show Similar Issues like this Blank line found at end of control structure Loading history...
88		} elseif (is_array($tokens[$j]) && $tokens[$j][0] === $this->getToken()) {
89		// If we reach the class definition without passing a function we definitely got an attribute
90		$attributes->set($tokens[$i][1], $this->getAttributeProperties($tokens, $i));
91		break;
92		}
93		}
94		}
95		}
96
97		// If we got invariants we will check if our attributes are used in invariants
98		if ($invariants !== null) {
99		// Lets iterate over all the attributes and check them against the invariants we got
100		$listIterator = $invariants->getIterator();
101		$listCount = $listIterator->count();
102		$attributeIterator = $attributes->getIterator();
103		$attributeCount = $attributeIterator->count();
104		for ($i = 0; $i < $attributeCount; $i++) {
105		// Do we have any of these attributes in our invariants?
106		$listIterator = $invariants->getIterator();
107		for ($j = 0; $j < $listCount; $j++) {
108		// Did we get anything useful?
109		if ($listIterator->current() === null) {
110		continue;
111		}
112
113		/** @var \AppserverIo\Doppelgaenger\Interfaces\TypedListInterface\|\Iterator $invariantIterator */
114		$invariantIterator = $listIterator->current()->getIterator();
		0 ignored issues – show Bug introduced 2016-01-05 11:21 UTC by Report Bug Copy Issue Report Show Similar Issues like this The method `getIterator` cannot be called on `$listIterator->current()` (of type `null`). Methods can only be called on objects. This check looks for methods being called on variables that have been inferred to never be objects. Loading history...
115		$invariantCount = $invariantIterator->count();
		0 ignored issues – show Bug introduced 2016-01-05 11:21 UTC by Report Bug Copy Issue Report Show Similar Issues like this The method `count` does only exist in `AppserverIo\Doppelgaenge...aces\TypedListInterface`, but not in `Iterator`. It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A { public function foo() { } } class B extends A { public function bar() { } } /** * @param A\|B $x / function someFunction($x) { $x->foo(); // This call is fine as the method exists in A and B. $x->bar(); // This method only exists in B and might cause an error. } Available Fixes Add an additional type-check: /* * @param A\|B $x / function someFunction($x) { $x->foo(); if ($x instanceof B) { $x->bar(); } } Only allow a single type to be passed if the variable comes from a parameter: function someFunction(B $x) { /* ... */ } Loading history...
116		for ($k = 0; $k < $invariantCount; $k++) {
117		$attributePosition = strpos(
118		$invariantIterator->current()->getString(),
		0 ignored issues – show Bug introduced 2016-01-05 11:21 UTC by Report Bug Copy Issue Report Show Similar Issues like this The method `current` does only exist in `Iterator`, but not in `AppserverIo\Doppelgaenge...aces\TypedListInterface`. It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A { public function foo() { } } class B extends A { public function bar() { } } /** * @param A\|B $x / function someFunction($x) { $x->foo(); // This call is fine as the method exists in A and B. $x->bar(); // This method only exists in B and might cause an error. } Available Fixes Add an additional type-check: /* * @param A\|B $x / function someFunction($x) { $x->foo(); if ($x instanceof B) { $x->bar(); } } Only allow a single type to be passed if the variable comes from a parameter: function someFunction(B $x) { /* ... */ } Loading history...
119		'$this->' . ltrim(
120		$attributeIterator->current()->getName(),
121		'$'
122		)
123		);
124
125		if ($attributePosition !== false
126		) {
127		// Tell them we were mentioned and persist it
128		$attributeIterator->current()->setInInvariant(true);
129		}
130
131		$invariantIterator->next();
		0 ignored issues – show Bug introduced 2016-01-05 11:21 UTC by Report Bug Copy Issue Report Show Similar Issues like this The method `next` does only exist in `Iterator`, but not in `AppserverIo\Doppelgaenge...aces\TypedListInterface`. It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A { public function foo() { } } class B extends A { public function bar() { } } /** * @param A\|B $x / function someFunction($x) { $x->foo(); // This call is fine as the method exists in A and B. $x->bar(); // This method only exists in B and might cause an error. } Available Fixes Add an additional type-check: /* * @param A\|B $x / function someFunction($x) { $x->foo(); if ($x instanceof B) { $x->bar(); } } Only allow a single type to be passed if the variable comes from a parameter: function someFunction(B $x) { /* ... */ } Loading history...
132		}
133		$listIterator->next();
134		}
135		$attributeIterator->next();
136		}
137		}
138
139		return $attributes;
140		}
141
142		/**
143		* Will return a definition of an attribute as far as we can extract it from the token array
144		*
145		* @param array $tokens Array of tokens for this class
146		* @param int $attributePosition Position of the attribute within the token array
147		*
148		* @return AttributeDefinition
149		*/
150		public function getAttributeProperties(array $tokens, $attributePosition)
151		{
152		// We got the tokens and the position of the attribute, so look in front of it for visibility and a
153		// possible static keyword
154		$attribute = new AttributeDefinition();
155		$attribute->setName($tokens[$attributePosition][1]);
156		$attribute->setLine($tokens[$attributePosition][2]);
157		$attribute->setStructureName($this->currentDefinition->getQualifiedName());
158
159		for ($i = $attributePosition; $i > $attributePosition - 6; $i--) {
160		// Search for the visibility
161	View Code Duplication	if (is_array($tokens[$i]) && ($tokens[$i][0] === T_PRIVATE \|\| $tokens[$i][0] === T_PROTECTED)) {
162		// Got it!
163		$attribute->setVisibility($tokens[$i][1]);
164		}
165
166		// Do we get a static keyword?
167		if (is_array($tokens[$i]) && $tokens[$i][0] === T_STATIC) {
168		// default is false, so set it to true
169		$attribute->setIsStatic(true);
170		}
171		}
172
173		// Now check if there is any default value for this attribute, if so we have to get it
174		$defaultValue = null;
175		for ($i = $attributePosition; $i < count($tokens); $i++) {
		0 ignored issues – show Performance Best Practice introduced 2016-01-05 11:21 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like you are calling the size function `count()` as part of the test condition. You might want to compute the size beforehand, and not on each iteration. If the size of the collection does not change during the iteration, it is generally a good practice to compute it beforehand, and not on each iteration: for ($i=0; $i<count($array); $i++) { // calls count() on each iteration } // Better for ($i=0, $c=count($array); $i<$c; $i++) { // calls count() just once } Loading history...
176		// If we reach the semicolon we do not have anything here.
177		if ($tokens[$i] === ';') {
178		break;
179		}
180
181	View Code Duplication	if ($defaultValue !== null) {
182		// Do we get a static keyword?
183		if (is_array($tokens[$i])) {
184		$defaultValue .= $tokens[$i][1];
185
		0 ignored issues – show Coding Style introduced 2016-12-02 23:50 UTC by Report Bug Copy Issue Report Show Similar Issues like this Blank line found at end of control structure Loading history...
186		} else {
187		$defaultValue .= $tokens[$i];
188		}
189		}
190
191		// If we pass a = we have to get ready to make notes
192		if ($tokens[$i] === '=') {
193		$defaultValue = '';
194		}
195		}
196
197		// Set the default Value
198		$attribute->setDefaultValue($defaultValue);
199
200		// Last but not least we have to check if got the visibility, if not, set it public.
201		// This is necessary, as missing visibility in the definition will also default to public
202		if ($attribute->getVisibility() === '') {
203		$attribute->setVisibility('public');
204		}
205
206		return $attribute;
207		}
208
209		/**
210		* We by default assume we are used to parse classes
211		*
212		* @return int
213		*/
214		public function getToken()
215		{
216		return T_CLASS;
217		}
218		}
219

appserver-io / doppelgaenger

Issues (245)

Security Analysis no request data

src/Parser/PropertyParserTrait.php (9 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Available Fixes

Available Fixes

Available Fixes

Duplication Side-by-Side

Filter issues like