SqlInjection::__construct() - Code Metrics - aszone/vulnerabilities - Measure and Improve Code Quality continuously with Scrutinizer

SqlInjection::__construct() A
last analyzed 2016-11-02 14:18 UTC

↳ Parent: SqlInjection

Complexity

Conditions	2
Paths	2

Size

Total Lines	11
Code Lines	6

Duplication

Lines	11
Ratio	100 %

Importance

Changes

Metric	Value
c	0
b	0
f	0
dl	11
loc	11
rs	9.4285
cc	2
eloc	6
nc	2
nop	3

<?php

namespace Aszone\Vulnerabilities;

use GuzzleHttp\ClientInterface;
use Psr\Log\LoggerInterface;
use Aszone\Vulnerabilities\Log\Logger;

class SqlInjection implements VulnerabilityScanner
{
    const EXPLOIT = "'";

    private $errors;

    private $client;

    private $logger;

    public function __construct(ClientInterface $client, array $errors, LoggerInterface $logger = null)

    {
        $this->client = $client;
        $this->errors = $errors;

        if (empty($logger)) {
            $logger = new Logger;
        }

        $this->logger = $logger;
    }

    public function isVulnerable($target)
    {
        if ($this->isSqlInjectionPossible($target)) {
            return $this->verify($target);
        }

        return false;
    }

    protected function isSqlInjectionPossible($target)
    {
        return isset(parse_url($target)['query']);
    }

    protected function verify($target)

    {
        $urls = $this->generateUrlByExploit($target);

        foreach ($urls as $url) {
            $this->logger->info("\n url =>".$url."\n");

            if ($this->attack($url)) {
                $this->logger->info('Is Vull');

                return true;
            }
        }

        return false;
    }

    public function generateUrlByExploit($target)
    {
        $explodeUrl = parse_url($target);
        $explodeQuery = explode('&', $explodeUrl['query']);

        foreach ($explodeQuery as $keyQuery => $query) {

            $explodeQueryEqual = explode('=', $query);
            $wordsValue[$explodeQueryEqual[0]] = $explodeQueryEqual[1];
foreach ($collection as $item) {
    $myArray['foo'] = $item->getFoo();

    if ($item->hasBar()) {
        $myArray['bar'] = $item->getBar();
    }

    // do something with $myArray
}
        }

        foreach ($wordsValue as $keyValue => $value) {
function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}
            $urls[] = str_replace($keyValue.'='.$value, $keyValue.'='.$value.static::EXPLOIT, $target);
foreach ($collection as $item) {
    $myArray['foo'] = $item->getFoo();

    if ($item->hasBar()) {
        $myArray['bar'] = $item->getBar();
    }

    // do something with $myArray
}
        }

        return $urls;
function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}
    }

    public function attack($url)
    {
        try {
            $body = $this->client->get($url)->getBody()->getContents();

            if ($body) {
                if ($this->checkError($body)) {
                    return $url;
                }
            }
        } catch (\Exception $e) {
            if ($e->getCode() != '404' and $e->getCode() != '403') {
// Logical operators have lower precedence:
$f = false or true;

// is executed like this:
($f = false) or true;


// Boolean operators have higher precedence:
$f = false || true;

// is executed like this:
$f = (false || true);
                return $url;
            }

            $this->logger->error('Error code => '.$e->getCode()."\n");
        }

        return false;
    }

    public function checkError($body)
    {
        foreach ($this->errors as $error) {
            $isValid = strpos($body, $error);

            if ($isValid !== false) {
                return true;
            }
        }

        return false;
    }
}


SqlInjection::__construct() A
last analyzed 2016-11-02 14:18 UTC

Complexity

Size

Duplication

Importance

Available Fixes

Available Fixes

Logical Operators are used for Control-Flow

aszone / vulnerabilities

SqlInjection::__construct() A last analyzed 2016-11-02 14:18 UTC

Complexity

Size

Duplication

Importance

Available Fixes

Available Fixes

Logical Operators are used for Control-Flow

Duplication Side-by-Side

Filter issues like

SqlInjection::__construct() A
last analyzed 2016-11-02 14:18 UTC