Issues in ReturnTypeDeclarationSniff.php (master) - Issues in master - bestit/PHP_CodeSniffer - Measure and Improve Code Quality continuously with Scrutinizer

Issues (51)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Sniffs/TypeHints/ReturnTypeDeclarationSniff.php (1 issue)

Labels

Bug 1

Severity

Critical 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

declare(strict_types=1);

namespace BestIt\Sniffs\TypeHints;

use BestIt\CodeSniffer\CodeError;
use BestIt\CodeSniffer\CodeWarning;
use BestIt\Sniffs\AbstractSniff;
use BestIt\Sniffs\DocPosProviderTrait;
use BestIt\Sniffs\FunctionRegistrationTrait;
use BestIt\Sniffs\SuppressingTrait;
use SlevomatCodingStandard\Helpers\Annotation;
use SlevomatCodingStandard\Helpers\Annotation\ReturnAnnotation;
use SlevomatCodingStandard\Helpers\FunctionHelper;
use SlevomatCodingStandard\Helpers\TypeHintHelper;
use function array_filter;
use function array_intersect;
use function count;
use function explode;
use function in_array;
use function phpversion;
use function strtolower;
use function substr;
use function version_compare;

/**
 * Class ReturnTypeDeclarationSniff
 *
 * @author Stephan Weber <[email protected]>
 * @package BestIt\Sniffs\TypeHints
 */
class ReturnTypeDeclarationSniff extends AbstractSniff
{
    use DocPosProviderTrait;
    use FunctionRegistrationTrait;
    use SuppressingTrait;

    /**
     * Every function or method MUST have a type hint if the return annotation is valid.
     */
    public const CODE_MISSING_RETURN_TYPE = 'MissingReturnTypeHint';

    /**
     * The simple message of a return type is missing.
     */
    private const MESSAGE_MISSING_RETURN_TYPE = 'Function/Method %s does not have a return type.';

    /**
     * The return types which match null.
     */
    private const NULL_TYPES = ['null', 'void'];

    /**
     * Null as a return has no real return type, so we use this as a fallback.
     *
     * @var string
     */
    public string $defaultNullReturn = '?string';


    /**
     * The name of the function.
     *
     * @var string|null
     */
    private ?string $functionName = null;

    /**
     * Has this function a return type?
     *
     * @var null|bool
     */
    private ?bool $hasReturnType = null;

    /**
     * This methods should be ignored.
     *
     * @var array
     */
    public array $methodsWithoutVoid = ['__construct', '__destruct', '__clone'];

    /**
     * Caches the types which can be used for an automatic fix.
     *
     * This array is only filled, if the return annotation situation of the phpdoc is usable for a fix.
     *
     * @var null|array
     */
    private ?array $typesForFix = null;

    /**
     * Adds the return type to fix the error.
     *
     * @return void
     */
    private function addReturnType(): void
    {
        $file = $this->getFile();
        $returnTypeHint = $this->createReturnType();

        $file->fixer->beginChangeset();

        if ($this->isCustomArrayType($returnTypeHint)) {
            $returnTypeHint = ($returnTypeHint[0] === '?' ? '?' : '') . 'array';
        }

        $file->fixer->addContent(
            $this->token['parenthesis_closer'],
            ': ' . $returnTypeHint
        );

        $file->fixer->endChangeset();
    }

    /**
     * Returns true if this sniff may run.
     *
     * @return bool
     */
    protected function areRequirementsMet(): bool
    {
        return !$this->isSniffSuppressed(static::CODE_MISSING_RETURN_TYPE) && !$this->hasReturnType() &&
            !in_array($this->getFunctionName(), $this->methodsWithoutVoid);
    }

    /**
     * Creates the new return type for fixing or returns a null if not possible.
     *
     * @return string
     */
    private function createReturnType(): string
    {
        $returnTypeHint = '';
        $typeCount = count($this->typesForFix);

        foreach ($this->typesForFix as $type) {
            // We add the default value if only null is used (which has no real native return type).
            if ($type === 'null' && ($typeCount === 1)) {
                $returnTypeHint = $this->defaultNullReturn;
                break; // We still need this break to prevent further execution of the default value.
            }

            // We add the question mark if there is a nullable type.
            if (in_array($type, self::NULL_TYPES, true) && ($typeCount > 1)) {
                $returnTypeHint = '?' . $returnTypeHint;
                continue; // We still need this continue to prevent further execution of the questionmark.
            }

            // We add a fixable "native" type. We do not fix custom classes (because it would have side effects to the
            // imported usage of classes.
            $returnTypeHint .= (TypeHintHelper::isSimpleTypeHint($type))
                ? TypeHintHelper::convertLongSimpleTypeHintToShort($type)
                : $type;
        }

        return $returnTypeHint;
    }

    /**
     * Fixes the return type error.
     *
     * @param CodeWarning $exception
     *
     * @return void
     */
    protected function fixDefaultProblem(CodeWarning $exception): void
    {
        // Satisfy PHPMD
        unset($exception);

        // This method is called, if it the error is not marked as fixable. So check our internal marker again.
        if ($this->typesForFix) {
            $this->addReturnType();
        }
    }

    /**
     * Returns the name of the function.
     *
     * @return string
     */
    private function getFunctionName(): string
    {
        if (!$this->functionName) {
            $this->functionName = $this->loadFunctionName();
        }

        return $this->functionName;
    }

    /**
     * Returns the return types of the annotation.
     *
     * @param null|ReturnAnnotation $annotation
     *
     * @return array
     */
    private function getReturnsFromAnnotation(?ReturnAnnotation $annotation): array
    {
        return $this->isFilledReturnAnnotation($annotation)
            ? explode('|', preg_split('~\\s+~', $annotation->getContent())[0])
            : [];
    }

    /**
     * Returns the types of the annotation, if the types are usable.
     *
     * Usable means, that there should be one type != mixed in the return-annotation or a nullable type, which means
     * 2 types like null|$ANYTYPE.
     *
     * @param ReturnAnnotation $annotation
     *
     * @return array|null Null if there are no usable types or the usable types.
     */
    private function getUsableReturnTypes(ReturnAnnotation $annotation): ?array
    {
        $return = null;

        $returnTypes = $this->getReturnsFromAnnotation($annotation);
        $returnTypeCount = count($returnTypes);
        $justOneReturn = $returnTypeCount === 1;

        if (!$justOneReturn || strtolower($returnTypes[0]) !== 'mixed') {
            $isNullableType = ($returnTypeCount === 2) &&
                version_compare(phpversion(), '7.1.0', '>=') &&
                (count(array_intersect($returnTypes, self::NULL_TYPES)) === 1);

            $return = ($justOneReturn || $isNullableType) ? $returnTypes : null;
        }

        return $return;
    }

    /**
     * Check if there is a return type.
     *
     * @return bool
     */
    private function hasReturnType(): bool
    {
        if ($this->hasReturnType === null) {
            $this->hasReturnType = FunctionHelper::hasReturnTypeHint($this->file, $this->stackPos);
        }

        return $this->hasReturnType;
    }

    /**
     * Is the given array a custom array with the "[]" suffix?
     *
     * @param string $returnTypeHint
     *
     * @return bool
     */
    private function isCustomArrayType(string $returnTypeHint): bool
    {
        return substr($returnTypeHint, -2) === '[]';
    }

    /**
     * Check if function has a return annotation
     *
     * @param ReturnAnnotation|null $returnAnnotation Annotation of the function
     *
     * @return bool Function has a annotation
     */
    private function isFilledReturnAnnotation(?ReturnAnnotation $returnAnnotation = null): bool
    {
        return $returnAnnotation && $returnAnnotation->getContent();
    }

    /**
     * Check if the return annotation type is valid.
     *
     * @param string $type The type value of the return annotation
     *
     * @return bool Type is valid
     */
    private function isFixableReturnType(string $type): bool
    {
        // $type === null is not valid in our slevomat helper.
        return TypeHintHelper::isSimpleTypeHint($type) || $type === 'null' || $this->isCustomArrayType($type);
    }

    /**
     * Removes the return types from the given array, which are not compatible with our fix.
     *
     * @param array|null $returnTypes
     *
     * @return array The cleaned array.
     */
    private function loadFixableTypes(?array $returnTypes): array
    {
        return array_filter($returnTypes ?? [], function (string $returnType): bool {
            return $this->isFixableReturnType($returnType);
        });
    }

    /**
     * Loads the name of the function.
     *
     * @return string
     */
    private function loadFunctionName(): string
    {
        return FunctionHelper::getName($this->getFile(), $this->stackPos);
    }

    /**
     * Loads the return annotation for this method.
     *
     * @return null\ReturnAnnotation
     */
    protected function loadReturnAnnotation(): ?ReturnAnnotation
    {
        return FunctionHelper::findReturnAnnotation($this->getFile(), $this->stackPos);
    }

    /**
     * Check method return type based with its return annotation.
     *
     * @throws CodeWarning
     *
     * @return void
     */
    protected function processToken(): void
    {
        $this->getFile()->recordMetric($this->stackPos, 'Has return type', 'no');

        $returnAnnotation = $this->loadReturnAnnotation();

        if (
            !$this->isFilledReturnAnnotation($returnAnnotation) ||
            ($returnTypes = $this->getUsableReturnTypes($returnAnnotation))
        ) {
            $this->validateReturnType($returnTypes ?? null);
        }
    }

    /**
     * Sets up the test.
     *
     * @return void
     */
    protected function setUp(): void
    {
        parent::setUp();

        if ($this->hasReturnType()) {
            $this->getFile()->recordMetric($this->stackPos, 'Has return type', 'yes');
        }
    }

    /**
     * Resets the data of this sniff.
     *
     * @return void
     */
    protected function tearDown(): void
    {
        $this->resetDocCommentPos();

        $this->hasReturnType = null;
        $this->functionName = null;
        $this->typesForFix = null;
    }

    /**
     * Validates the return type and registers an error if there is one.
     *
     * @param array|null $returnTypes
     * @throws CodeWarning
     *
     * @return void
     */
    private function validateReturnType(?array $returnTypes): void
    {
        if (!$returnTypes) {
            $returnTypes = [];
        }

        $fixableTypes = $this->loadFixableTypes($returnTypes);

        if (count($returnTypes) === count($fixableTypes)) {
            // Make sure this var is only filled, if it really is fixable for us.
            $this->typesForFix = $fixableTypes;
        }

        $exception =
            (new CodeError(static::CODE_MISSING_RETURN_TYPE, self::MESSAGE_MISSING_RETURN_TYPE, $this->stackPos))
                ->setPayload([$this->getFunctionName()]);

        $exception->isFixable((bool) $this->typesForFix);

        throw $exception;
    }
}


1			<?php
2
3			declare(strict_types=1);
4
5			namespace BestIt\Sniffs\TypeHints;
6
7			use BestIt\CodeSniffer\CodeError;
8			use BestIt\CodeSniffer\CodeWarning;
9			use BestIt\Sniffs\AbstractSniff;
10			use BestIt\Sniffs\DocPosProviderTrait;
11			use BestIt\Sniffs\FunctionRegistrationTrait;
12			use BestIt\Sniffs\SuppressingTrait;
13			use SlevomatCodingStandard\Helpers\Annotation;
14			use SlevomatCodingStandard\Helpers\Annotation\ReturnAnnotation;
15			use SlevomatCodingStandard\Helpers\FunctionHelper;
16			use SlevomatCodingStandard\Helpers\TypeHintHelper;
17			use function array_filter;
18			use function array_intersect;
19			use function count;
20			use function explode;
21			use function in_array;
22			use function phpversion;
23			use function strtolower;
24			use function substr;
25			use function version_compare;
26
27			/**
28			* Class ReturnTypeDeclarationSniff
29			*
30			* @author Stephan Weber <[email protected]>
31			* @package BestIt\Sniffs\TypeHints
32			*/
33			class ReturnTypeDeclarationSniff extends AbstractSniff
34			{
35			use DocPosProviderTrait;
36			use FunctionRegistrationTrait;
37			use SuppressingTrait;
38
39			/**
40			* Every function or method MUST have a type hint if the return annotation is valid.
41			*/
42			public const CODE_MISSING_RETURN_TYPE = 'MissingReturnTypeHint';
43
44			/**
45			* The simple message of a return type is missing.
46			*/
47			private const MESSAGE_MISSING_RETURN_TYPE = 'Function/Method %s does not have a return type.';
48
49			/**
50			* The return types which match null.
51			*/
52			private const NULL_TYPES = ['null', 'void'];
53
54			/**
55			* Null as a return has no real return type, so we use this as a fallback.
56			*
57			* @var string
58			*/
59			public string $defaultNullReturn = '?string';
			0 ignored issues – show Bug introduced 2020-06-12 10:39 UTC by Report Bug Copy Issue Report Show Similar Issues like this This code did not parse for me. Apparently, there is an error somewhere around this line: Syntax error, unexpected T_STRING, expecting T_FUNCTION or T_CONST Loading history...
60
61			/**
62			* The name of the function.
63			*
64			* @var string\|null
65			*/
66			private ?string $functionName = null;
67
68			/**
69			* Has this function a return type?
70			*
71			* @var null\|bool
72			*/
73			private ?bool $hasReturnType = null;
74
75			/**
76			* This methods should be ignored.
77			*
78			* @var array
79			*/
80			public array $methodsWithoutVoid = ['__construct', '__destruct', '__clone'];
81
82			/**
83			* Caches the types which can be used for an automatic fix.
84			*
85			* This array is only filled, if the return annotation situation of the phpdoc is usable for a fix.
86			*
87			* @var null\|array
88			*/
89			private ?array $typesForFix = null;
90
91			/**
92			* Adds the return type to fix the error.
93			*
94			* @return void
95			*/
96			private function addReturnType(): void
97			{
98			$file = $this->getFile();
99			$returnTypeHint = $this->createReturnType();
100
101			$file->fixer->beginChangeset();
102
103			if ($this->isCustomArrayType($returnTypeHint)) {
104			$returnTypeHint = ($returnTypeHint[0] === '?' ? '?' : '') . 'array';
105			}
106
107			$file->fixer->addContent(
108			$this->token['parenthesis_closer'],
109			': ' . $returnTypeHint
110			);
111
112			$file->fixer->endChangeset();
113			}
114
115			/**
116			* Returns true if this sniff may run.
117			*
118			* @return bool
119			*/
120			protected function areRequirementsMet(): bool
121			{
122			return !$this->isSniffSuppressed(static::CODE_MISSING_RETURN_TYPE) && !$this->hasReturnType() &&
123			!in_array($this->getFunctionName(), $this->methodsWithoutVoid);
124			}
125
126			/**
127			* Creates the new return type for fixing or returns a null if not possible.
128			*
129			* @return string
130			*/
131			private function createReturnType(): string
132			{
133			$returnTypeHint = '';
134			$typeCount = count($this->typesForFix);
135
136			foreach ($this->typesForFix as $type) {
137			// We add the default value if only null is used (which has no real native return type).
138			if ($type === 'null' && ($typeCount === 1)) {
139			$returnTypeHint = $this->defaultNullReturn;
140			break; // We still need this break to prevent further execution of the default value.
141			}
142
143			// We add the question mark if there is a nullable type.
144			if (in_array($type, self::NULL_TYPES, true) && ($typeCount > 1)) {
145			$returnTypeHint = '?' . $returnTypeHint;
146			continue; // We still need this continue to prevent further execution of the questionmark.
147			}
148
149			// We add a fixable "native" type. We do not fix custom classes (because it would have side effects to the
150			// imported usage of classes.
151			$returnTypeHint .= (TypeHintHelper::isSimpleTypeHint($type))
152			? TypeHintHelper::convertLongSimpleTypeHintToShort($type)
153			: $type;
154			}
155
156			return $returnTypeHint;
157			}
158
159			/**
160			* Fixes the return type error.
161			*
162			* @param CodeWarning $exception
163			*
164			* @return void
165			*/
166			protected function fixDefaultProblem(CodeWarning $exception): void
167			{
168			// Satisfy PHPMD
169			unset($exception);
170
171			// This method is called, if it the error is not marked as fixable. So check our internal marker again.
172			if ($this->typesForFix) {
173			$this->addReturnType();
174			}
175			}
176
177			/**
178			* Returns the name of the function.
179			*
180			* @return string
181			*/
182			private function getFunctionName(): string
183			{
184			if (!$this->functionName) {
185			$this->functionName = $this->loadFunctionName();
186			}
187
188			return $this->functionName;
189			}
190
191			/**
192			* Returns the return types of the annotation.
193			*
194			* @param null\|ReturnAnnotation $annotation
195			*
196			* @return array
197			*/
198			private function getReturnsFromAnnotation(?ReturnAnnotation $annotation): array
199			{
200			return $this->isFilledReturnAnnotation($annotation)
201			? explode('\|', preg_split('~\\s+~', $annotation->getContent())[0])
202			: [];
203			}
204
205			/**
206			* Returns the types of the annotation, if the types are usable.
207			*
208			* Usable means, that there should be one type != mixed in the return-annotation or a nullable type, which means
209			* 2 types like null\|$ANYTYPE.
210			*
211			* @param ReturnAnnotation $annotation
212			*
213			* @return array\|null Null if there are no usable types or the usable types.
214			*/
215			private function getUsableReturnTypes(ReturnAnnotation $annotation): ?array
216			{
217			$return = null;
218
219			$returnTypes = $this->getReturnsFromAnnotation($annotation);
220			$returnTypeCount = count($returnTypes);
221			$justOneReturn = $returnTypeCount === 1;
222
223			if (!$justOneReturn \|\| strtolower($returnTypes[0]) !== 'mixed') {
224			$isNullableType = ($returnTypeCount === 2) &&
225			version_compare(phpversion(), '7.1.0', '>=') &&
226			(count(array_intersect($returnTypes, self::NULL_TYPES)) === 1);
227
228			$return = ($justOneReturn \|\| $isNullableType) ? $returnTypes : null;
229			}
230
231			return $return;
232			}
233
234			/**
235			* Check if there is a return type.
236			*
237			* @return bool
238			*/
239			private function hasReturnType(): bool
240			{
241			if ($this->hasReturnType === null) {
242			$this->hasReturnType = FunctionHelper::hasReturnTypeHint($this->file, $this->stackPos);
243			}
244
245			return $this->hasReturnType;
246			}
247
248			/**
249			* Is the given array a custom array with the "[]" suffix?
250			*
251			* @param string $returnTypeHint
252			*
253			* @return bool
254			*/
255			private function isCustomArrayType(string $returnTypeHint): bool
256			{
257			return substr($returnTypeHint, -2) === '[]';
258			}
259
260			/**
261			* Check if function has a return annotation
262			*
263			* @param ReturnAnnotation\|null $returnAnnotation Annotation of the function
264			*
265			* @return bool Function has a annotation
266			*/
267			private function isFilledReturnAnnotation(?ReturnAnnotation $returnAnnotation = null): bool
268			{
269			return $returnAnnotation && $returnAnnotation->getContent();
270			}
271
272			/**
273			* Check if the return annotation type is valid.
274			*
275			* @param string $type The type value of the return annotation
276			*
277			* @return bool Type is valid
278			*/
279			private function isFixableReturnType(string $type): bool
280			{
281			// $type === null is not valid in our slevomat helper.
282			return TypeHintHelper::isSimpleTypeHint($type) \|\| $type === 'null' \|\| $this->isCustomArrayType($type);
283			}
284
285			/**
286			* Removes the return types from the given array, which are not compatible with our fix.
287			*
288			* @param array\|null $returnTypes
289			*
290			* @return array The cleaned array.
291			*/
292			private function loadFixableTypes(?array $returnTypes): array
293			{
294			return array_filter($returnTypes ?? [], function (string $returnType): bool {
295			return $this->isFixableReturnType($returnType);
296			});
297			}
298
299			/**
300			* Loads the name of the function.
301			*
302			* @return string
303			*/
304			private function loadFunctionName(): string
305			{
306			return FunctionHelper::getName($this->getFile(), $this->stackPos);
307			}
308
309			/**
310			* Loads the return annotation for this method.
311			*
312			* @return null\ReturnAnnotation
313			*/
314			protected function loadReturnAnnotation(): ?ReturnAnnotation
315			{
316			return FunctionHelper::findReturnAnnotation($this->getFile(), $this->stackPos);
317			}
318
319			/**
320			* Check method return type based with its return annotation.
321			*
322			* @throws CodeWarning
323			*
324			* @return void
325			*/
326			protected function processToken(): void
327			{
328			$this->getFile()->recordMetric($this->stackPos, 'Has return type', 'no');
329
330			$returnAnnotation = $this->loadReturnAnnotation();
331
332			if (
333			!$this->isFilledReturnAnnotation($returnAnnotation) \|\|
334			($returnTypes = $this->getUsableReturnTypes($returnAnnotation))
335			) {
336			$this->validateReturnType($returnTypes ?? null);
337			}
338			}
339
340			/**
341			* Sets up the test.
342			*
343			* @return void
344			*/
345			protected function setUp(): void
346			{
347			parent::setUp();
348
349			if ($this->hasReturnType()) {
350			$this->getFile()->recordMetric($this->stackPos, 'Has return type', 'yes');
351			}
352			}
353
354			/**
355			* Resets the data of this sniff.
356			*
357			* @return void
358			*/
359			protected function tearDown(): void
360			{
361			$this->resetDocCommentPos();
362
363			$this->hasReturnType = null;
364			$this->functionName = null;
365			$this->typesForFix = null;
366			}
367
368			/**
369			* Validates the return type and registers an error if there is one.
370			*
371			* @param array\|null $returnTypes
372			* @throws CodeWarning
373			*
374			* @return void
375			*/
376			private function validateReturnType(?array $returnTypes): void
377			{
378			if (!$returnTypes) {
379			$returnTypes = [];
380			}
381
382			$fixableTypes = $this->loadFixableTypes($returnTypes);
383
384			if (count($returnTypes) === count($fixableTypes)) {
385			// Make sure this var is only filled, if it really is fixable for us.
386			$this->typesForFix = $fixableTypes;
387			}
388
389			$exception =
390			(new CodeError(static::CODE_MISSING_RETURN_TYPE, self::MESSAGE_MISSING_RETURN_TYPE, $this->stackPos))
391			->setPayload([$this->getFunctionName()]);
392
393			$exception->isFixable((bool) $this->typesForFix);
394
395			throw $exception;
396			}
397			}
398

bestit / PHP_CodeSniffer

Issues (51)

Security Analysis no request data

Sniffs/TypeHints/ReturnTypeDeclarationSniff.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like