Issues in FluentSetterSniff.php (master) - Issues in master - bestit/PHP_CodeSniffer - Measure and Improve Code Quality continuously with Scrutinizer

Issues (51)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

BestIt/Sniffs/Functions/FluentSetterSniff.php (1 issue)

Labels

Bug 1

Severity

Critical 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

declare(strict_types=1);

namespace BestIt\Sniffs\Functions;

use BestIt\CodeSniffer\Helper\PropertyHelper;
use BestIt\CodeSniffer\Helper\TokenHelper;
use BestIt\Sniffs\SuppressingTrait;
use PHP_CodeSniffer\Files\File;
use PHP_CodeSniffer\Standards\Squiz\Sniffs\Scope\MethodScopeSniff;
use function in_array;
use function substr;

/**
 * Checks if a fluent setter is used per default.
 *
 * @package BestIt\Sniffs\Functions
 *
 * @author Nick Lubisch <[email protected]>
 * @author Björn Lange <[email protected]>
 */
class FluentSetterSniff extends MethodScopeSniff
{
    use SuppressingTrait;

    /**
     * Every setter function MUST return $this if nothing else is returned.
     */
    public const CODE_MUST_RETURN_THIS = 'MustReturnThis';

    /**
     * Your method MUST contain a return.
     */
    public const CODE_NO_RETURN_FOUND = 'NoReturnFound';

    /**
     * Error message when the method does not return $this.
     */
    private const ERROR_MUST_RETURN_THIS = 'The method "%s" must return $this';

    /**
     * Error message when no return statement is found.
     */
    private const ERROR_NO_RETURN_FOUND = 'Method "%s" has no return statement';

    /**
     * Specifies how an identation looks like.
     *
     * @var string
     */
    public string $identation = '    ';


    /**
     * The used file decorated for the interface.
     *
     * @var File
     */
    private File $file;

    /**
     * The position of this node.
     *
     * @var int
     */
    private int $stackPos;

    /**
     * Registers an error if an empty return (return null; or return;) is given.
     *
     * @param File $file The sniffed file.
     * @param int $functionPos The position of the function.
     * @param int $returnPos The position of the return call.
     * @param string $methodIdent The ident for the method to given in an error.
     *
     * @return void
     */
    private function checkAndRegisterEmptyReturnErrors(
        File $file,
        int $functionPos,
        int $returnPos,
        string $methodIdent
    ): void {
        $nextToken = $file->getTokens()[TokenHelper::findNextEffective($file, $returnPos + 1)];

        if (!$nextToken || (in_array($nextToken['content'], ['null', ';']))) {
            $fixMustReturnThis = $file->addFixableError(
                self::ERROR_MUST_RETURN_THIS,
                $functionPos,
                static::CODE_MUST_RETURN_THIS,
                $methodIdent
            );

            if ($fixMustReturnThis) {
                $this->fixMustReturnThis($file, $returnPos);
            }
        }
    }

    /**
     * Checks if there are fluent setter errors and registers errors if needed.
     *
     * @param File $phpcsFile The file for this sniff.
     * @param int $functionPos The position of the used token.
     * @param int $classPos The position of the class.
     *
     * @return void
     */
    private function checkForFluentSetterErrors(File $phpcsFile, int $functionPos, int $classPos): void
    {
        $tokens = $phpcsFile->getTokens();
        $errorData = $phpcsFile->getDeclarationName($classPos) . '::' . $phpcsFile->getDeclarationName($functionPos);

        $functionToken = $tokens[$functionPos];
        $openBracePtr = $functionToken['scope_opener'];
        $closeBracePtr = $functionToken['scope_closer'];

        $returnPtr = $phpcsFile->findNext(T_RETURN, $openBracePtr, $closeBracePtr);

        if ($returnPtr === false) {
            $fixNoReturnFound = $phpcsFile->addFixableError(
                self::ERROR_NO_RETURN_FOUND,
                $functionPos,
                static::CODE_NO_RETURN_FOUND,
                $errorData
            );

            if ($fixNoReturnFound) {
                $this->fixNoReturnFound($phpcsFile, $closeBracePtr);
            }

            return;
        }

        $this->checkAndRegisterEmptyReturnErrors($phpcsFile, $functionPos, $returnPtr, $errorData);
    }

    /**
     * Returns the used file decorated for the interface.
     *
     * @return File
     */
    public function getFile(): File
    {
        return $this->file;
    }

    /**
     * Returns the position of this node.
     *
     * @return int
     */
    public function getStackPos(): int
    {
        return $this->stackPos;
    }

    /**
     * Processes the tokens that this test is listening for.
     *
     * @phpcsSuppress SlevomatCodingStandard.TypeHints.TypeHintDeclaration.MissingParameterTypeHint
     *
     * @param File $file The file where this token was found.
     * @param int $functionPos The position in the stack where this token was found.
     * @param int $classPos The position in the tokens array that opened the scope that this test is listening for.
     *
     * @return void
     */
    protected function processTokenWithinScope(
        File $file,
        $functionPos,
        $classPos
    ): void {
        $this->file = $file;
        $this->stackPos = $functionPos;

        $isSuppressed = $this->isSniffSuppressed(static::CODE_NO_RETURN_FOUND);

        if (!$isSuppressed && $this->checkIfSetterFunction($classPos, $file, $functionPos)) {
            $this->checkForFluentSetterErrors($file, $functionPos, $classPos);
        }
    }

    /**
     * Checks if the given method name relates to a setter function of a property.
     *
     * @param int $classPosition The position of the class token.
     * @param File $file The file of the sniff.
     * @param int $methodPosition The position of the method token.
     *
     * @return bool Indicator if the given method is a setter function
     */
    private function checkIfSetterFunction(int $classPosition, File $file, int $methodPosition): bool
    {
        $isSetter = false;
        $methodName = $file->getDeclarationName($methodPosition);

        if (substr($methodName, 0, 3) === 'set') {
            // We define in our styleguide, that there is only one class per file!
            $properties = (new PropertyHelper($file))->getProperties(
                $file->getTokens()[$classPosition]
            );

            // We require camelCase for methods and properties,
            // so there should be an "lcfirst-Method" without set-prefix.
            $isSetter = in_array(lcfirst(substr($methodName, 3)), $properties, true);
        }

        return $isSetter;
    }

    /**
     * Fixes if no return statement is found.
     *
     * @param File $phpcsFile The php cs file
     * @param int $closingBracePtr Pointer to the closing curly brace of the function
     *
     * @return void
     */
    private function fixNoReturnFound(File $phpcsFile, int $closingBracePtr): void
    {
        $tokens = $phpcsFile->getTokens();
        $closingBraceToken = $tokens[$closingBracePtr];

        $expectedReturnSpaces = str_repeat($this->identation, $closingBraceToken['level'] + 1);

        $phpcsFile->fixer->beginChangeset();
        $phpcsFile->fixer->addNewlineBefore($closingBracePtr - 1);
        $phpcsFile->fixer->addContentBefore($closingBracePtr - 1, $expectedReturnSpaces . 'return $this;');
        $phpcsFile->fixer->addNewlineBefore($closingBracePtr - 1);
        $phpcsFile->fixer->endChangeset();
    }

    /**
     * Fixes the return value of a function to $this.
     *
     * @param File $phpcsFile The php cs file
     * @param int $returnPtr Pointer to the return token
     *
     * @return void
     */
    private function fixMustReturnThis(File $phpcsFile, int $returnPtr): void
    {
        $returnSemicolonPtr = $phpcsFile->findEndOfStatement($returnPtr);

        for ($i = $returnPtr + 1; $i < $returnSemicolonPtr; $i++) {
            $phpcsFile->fixer->replaceToken($i, '');
        }

        $phpcsFile->fixer->beginChangeset();
        $phpcsFile->fixer->addContentBefore(
            $returnSemicolonPtr,
            ' $this'
        );
        $phpcsFile->fixer->endChangeset();
    }
}


1		<?php
2
3		declare(strict_types=1);
4
5		namespace BestIt\Sniffs\Functions;
6
7		use BestIt\CodeSniffer\Helper\PropertyHelper;
8		use BestIt\CodeSniffer\Helper\TokenHelper;
9		use BestIt\Sniffs\SuppressingTrait;
10		use PHP_CodeSniffer\Files\File;
11		use PHP_CodeSniffer\Standards\Squiz\Sniffs\Scope\MethodScopeSniff;
12		use function in_array;
13		use function substr;
14
15		/**
16		* Checks if a fluent setter is used per default.
17		*
18		* @package BestIt\Sniffs\Functions
19		*
20		* @author Nick Lubisch <[email protected]>
21		* @author Björn Lange <[email protected]>
22		*/
23		class FluentSetterSniff extends MethodScopeSniff
24		{
25		use SuppressingTrait;
26
27		/**
28		* Every setter function MUST return $this if nothing else is returned.
29		*/
30		public const CODE_MUST_RETURN_THIS = 'MustReturnThis';
31
32		/**
33		* Your method MUST contain a return.
34		*/
35		public const CODE_NO_RETURN_FOUND = 'NoReturnFound';
36
37		/**
38		* Error message when the method does not return $this.
39		*/
40		private const ERROR_MUST_RETURN_THIS = 'The method "%s" must return $this';
41
42		/**
43		* Error message when no return statement is found.
44		*/
45		private const ERROR_NO_RETURN_FOUND = 'Method "%s" has no return statement';
46
47		/**
48		* Specifies how an identation looks like.
49		*
50		* @var string
51		*/
52		public string $identation = ' ';
		0 ignored issues – show Bug introduced 2020-06-12 10:39 UTC by Report Bug Copy Issue Report Show Similar Issues like this This code did not parse for me. Apparently, there is an error somewhere around this line: Syntax error, unexpected T_STRING, expecting T_FUNCTION or T_CONST Loading history...
53
54		/**
55		* The used file decorated for the interface.
56		*
57		* @var File
58		*/
59		private File $file;
60
61		/**
62		* The position of this node.
63		*
64		* @var int
65		*/
66		private int $stackPos;
67
68		/**
69		* Registers an error if an empty return (return null; or return;) is given.
70		*
71	4	* @param File $file The sniffed file.
72		* @param int $functionPos The position of the function.
73	4	* @param int $returnPos The position of the return call.
74	4	* @param string $methodIdent The ident for the method to given in an error.
75		*
76		* @return void
77		*/
78		private function checkAndRegisterEmptyReturnErrors(
79		File $file,
80		int $functionPos,
81		int $returnPos,
82		string $methodIdent
83		): void {
84		$nextToken = $file->getTokens()[TokenHelper::findNextEffective($file, $returnPos + 1)];
85	4
86		if (!$nextToken \|\| (in_array($nextToken['content'], ['null', ';']))) {
87		$fixMustReturnThis = $file->addFixableError(
88		self::ERROR_MUST_RETURN_THIS,
89		$functionPos,
90	4	static::CODE_MUST_RETURN_THIS,
91	4	$methodIdent
92		);
93	4
94	1	if ($fixMustReturnThis) {
95		$this->fixMustReturnThis($file, $returnPos);
96		}
97	4	}
98	4	}
99
100	4	/**
101	4	* Checks if there are fluent setter errors and registers errors if needed.
102	4	*
103		* @param File $phpcsFile The file for this sniff.
104	4	* @param int $functionPos The position of the used token.
105		* @param int $classPos The position of the class.
106	4	*
107	1	* @return void
108	1	*/
109	1	private function checkForFluentSetterErrors(File $phpcsFile, int $functionPos, int $classPos): void
110	1	{
111	1	$tokens = $phpcsFile->getTokens();
112		$errorData = $phpcsFile->getDeclarationName($classPos) . '::' . $phpcsFile->getDeclarationName($functionPos);
113
114	1	$functionToken = $tokens[$functionPos];
115	1	$openBracePtr = $functionToken['scope_opener'];
116		$closeBracePtr = $functionToken['scope_closer'];
117
118	1	$returnPtr = $phpcsFile->findNext(T_RETURN, $openBracePtr, $closeBracePtr);
119
120		if ($returnPtr === false) {
121	4	$fixNoReturnFound = $phpcsFile->addFixableError(
122	4	self::ERROR_NO_RETURN_FOUND,
123	4	$functionPos,
124	4	static::CODE_NO_RETURN_FOUND,
125		$errorData
126		);
127	4
128	1	if ($fixNoReturnFound) {
129	1	$this->fixNoReturnFound($phpcsFile, $closeBracePtr);
130	1	}
131	1
132	1	return;
133		}
134	1
135		$this->checkAndRegisterEmptyReturnErrors($phpcsFile, $functionPos, $returnPtr, $errorData);
136		}
137	3
138		/**
139	3	* Returns the used file decorated for the interface.
140	1	*
141	1	* @return File
142	1	*/
143	1	public function getFile(): File
144	1	{
145		return $this->file;
146		}
147	1
148	1	/**
149		* Returns the position of this node.
150		*
151	1	* @return int
152		*/
153	3	public function getStackPos(): int
154		{
155		return $this->stackPos;
156		}
157
158		/**
159		* Processes the tokens that this test is listening for.
160		*
161		* @phpcsSuppress SlevomatCodingStandard.TypeHints.TypeHintDeclaration.MissingParameterTypeHint
162		*
163		* @param File $file The file where this token was found.
164		* @param int $functionPos The position in the stack where this token was found.
165		* @param int $classPos The position in the tokens array that opened the scope that this test is listening for.
166	4	*
167		* @return void
168	4	*/
169		protected function processTokenWithinScope(
170	4	File $file,
171		$functionPos,
172		$classPos
173		): void {
174		$this->file = $file;
175		$this->stackPos = $functionPos;
176
177		$isSuppressed = $this->isSniffSuppressed(static::CODE_NO_RETURN_FOUND);
178
179		if (!$isSuppressed && $this->checkIfSetterFunction($classPos, $file, $functionPos)) {
180		$this->checkForFluentSetterErrors($file, $functionPos, $classPos);
181	1	}
182		}
183	1
184	1	/**
185		* Checks if the given method name relates to a setter function of a property.
186	1	*
187		* @param int $classPosition The position of the class token.
188	1	* @param File $file The file of the sniff.
189	1	* @param int $methodPosition The position of the method token.
190	1	*
191	1	* @return bool Indicator if the given method is a setter function
192	1	*/
193	1	private function checkIfSetterFunction(int $classPosition, File $file, int $methodPosition): bool
194		{
195		$isSetter = false;
196		$methodName = $file->getDeclarationName($methodPosition);
197
198		if (substr($methodName, 0, 3) === 'set') {
199		// We define in our styleguide, that there is only one class per file!
200		$properties = (new PropertyHelper($file))->getProperties(
201		$file->getTokens()[$classPosition]
202		);
203	1
204		// We require camelCase for methods and properties,
205	1	// so there should be an "lcfirst-Method" without set-prefix.
206		$isSetter = in_array(lcfirst(substr($methodName, 3)), $properties, true);
207	1	}
208	1
209		return $isSetter;
210		}
211	1
212	1	/**
213	1	* Fixes if no return statement is found.
214	1	*
215		* @param File $phpcsFile The php cs file
216	1	* @param int $closingBracePtr Pointer to the closing curly brace of the function
217	1	*
218		* @return void
219		*/
220		private function fixNoReturnFound(File $phpcsFile, int $closingBracePtr): void
221		{
222		$tokens = $phpcsFile->getTokens();
223		$closingBraceToken = $tokens[$closingBracePtr];
224
225		$expectedReturnSpaces = str_repeat($this->identation, $closingBraceToken['level'] + 1);
226
227		$phpcsFile->fixer->beginChangeset();
228		$phpcsFile->fixer->addNewlineBefore($closingBracePtr - 1);
229		$phpcsFile->fixer->addContentBefore($closingBracePtr - 1, $expectedReturnSpaces . 'return $this;');
230		$phpcsFile->fixer->addNewlineBefore($closingBracePtr - 1);
231		$phpcsFile->fixer->endChangeset();
232		}
233
234		/**
235		* Fixes the return value of a function to $this.
236		*
237		* @param File $phpcsFile The php cs file
238		* @param int $returnPtr Pointer to the return token
239		*
240		* @return void
241		*/
242		private function fixMustReturnThis(File $phpcsFile, int $returnPtr): void
243		{
244		$returnSemicolonPtr = $phpcsFile->findEndOfStatement($returnPtr);
245
246		for ($i = $returnPtr + 1; $i < $returnSemicolonPtr; $i++) {
247		$phpcsFile->fixer->replaceToken($i, '');
248		}
249
250		$phpcsFile->fixer->beginChangeset();
251		$phpcsFile->fixer->addContentBefore(
252		$returnSemicolonPtr,
253		' $this'
254		);
255		$phpcsFile->fixer->endChangeset();
256		}
257		}
258

bestit / PHP_CodeSniffer

Issues (51)

Security Analysis no request data

BestIt/Sniffs/Functions/FluentSetterSniff.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like