Issues (67)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/UpdateQuery/UpdateQueryBuilder.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace BenTools\Where\UpdateQuery;
4
5
use BenTools\Where\Expression\Expression;
6
use BenTools\Where\Helper\Previewer;
7
use function BenTools\Where\valuesOf;
8
9
/**
10
 * Class UpdateQueryBuilder
11
 *
12
 * @property $mainKeyword
13
 * @property $flags
14
 * @property $from
15
 * @property $set
16
 * @property $joins
17
 * @property $where
18
 * @property $orderBy
19
 * @property $limit
20
 * @property $end
21
 */
22
final class UpdateQueryBuilder
23
{
24
    /**
25
     * @var string
26
     */
27
    private $mainKeyword = 'UPDATE';
28
29
    /**
30
     * @var array
31
     */
32
    private $flags = [];
33
34
    /**
35
     * @var string
36
     */
37
    private $from;
38
39
    /**
40
     * @var Expression
41
     */
42
    private $set;
43
44
    /**
45
     * @var array
46
     */
47
    private $joins = [];
48
49
    /**
50
     * @var Expression
51
     */
52
    private $where;
53
54
    /**
55
     * @var array
56
     */
57
    private $orderBy = [];
58
59
    /**
60
     * @var int
61
     */
62
    private $limit;
63
64
    /**
65
     * @var string
66
     */
67
    private $end = ';';
68
69
    /**
70
     * @param string $table
71
     * @return UpdateQueryBuilder
72
     */
73
    public static function make(string $table): self
74
    {
75
        $query = new self;
76
        $query->from = $table;
77
        return $query;
78
    }
79
80
    /**
81
     * @param string $table
82
     * @return UpdateQueryBuilder
83
     */
84
    public function table(string $table): self
85
    {
86
        $clone = clone $this;
87
        $clone->from = $table;
88
        return $clone;
89
    }
90
91
    /**
92
     * @param string $keyword
93
     * @return UpdateQueryBuilder
94
     */
95
    public function withMainKeyword(string $keyword): self
96
    {
97
        $clone = clone $this;
98
        $clone->mainKeyword = $keyword;
99
        return $clone;
100
    }
101
102
    /**
103
     * @param string[] ...$flags
104
     * @return UpdateQueryBuilder
105
     */
106
    public function withFlags(string ...$flags): self
107
    {
108
        $clone = clone $this;
109
        $clone->flags = $flags;
110
        return $clone;
111
    }
112
113
    /**
114
     * @param string[] ...$flags
115
     * @return UpdateQueryBuilder
116
     */
117
    public function withAddedFlags(string ...$flags): self
118
    {
119
        $clone = clone $this;
120
        $existingFlags = \array_map('strtoupper', $clone->flags);
121
        foreach ($flags as $flag) {
122
            if (!\in_array(\strtoupper($flag), $existingFlags, true)) {
123
                $clone->flags[] = $flag;
124
            }
125
        }
126
        return $clone;
127
    }
128
129
    /**
130
     * @param string                 $table
131
     * @param string|Expression|null $expression
132
     * @param array                  ...$values
133
     * @return UpdateQueryBuilder
134
     * @throws \InvalidArgumentException
135
     */
136
    public function join(string $table, $expression = null, ...$values): self
137
    {
138
        $clone = clone $this;
139
        $clone->joins[$table] = [
140
            't' => 'JOIN',
141
            'c' => null !== $expression ? Expression::where($expression, ...$values) : null,
142
        ];
143
        return $clone;
144
    }
145
146
    /**
147
     * @param string                 $table
148
     * @param string|Expression|null $expression
149
     * @param array                  ...$values
150
     * @return UpdateQueryBuilder
151
     * @throws \InvalidArgumentException
152
     */
153
    public function innerJoin(string $table, $expression = null, ...$values): self
154
    {
155
        $clone = clone $this;
156
        $clone->joins[$table] = [
157
            't' => 'INNER JOIN',
158
            'c' => null !== $expression ? Expression::where($expression, ...$values) : null,
159
        ];
160
        return $clone;
161
    }
162
163
    /**
164
     * @param string                 $table
165
     * @param string|Expression|null $expression
166
     * @param array                  ...$values
167
     * @return UpdateQueryBuilder
168
     * @throws \InvalidArgumentException
169
     */
170
    public function outerJoin(string $table, $expression = null, ...$values): self
171
    {
172
        $clone = clone $this;
173
        $clone->joins[$table] = [
174
            't' => 'OUTER JOIN',
175
            'c' => null !== $expression ? Expression::where($expression, ...$values) : null,
176
        ];
177
        return $clone;
178
    }
179
180
    /**
181
     * @param string                 $table
182
     * @param string|Expression|null $expression
183
     * @param array                  ...$values
184
     * @return UpdateQueryBuilder
185
     * @throws \InvalidArgumentException
186
     */
187
    public function leftJoin(string $table, $expression = null, ...$values): self
188
    {
189
        $clone = clone $this;
190
        $clone->joins[$table] = [
191
            't' => 'LEFT JOIN',
192
            'c' => null !== $expression ? Expression::where($expression, ...$values) : null,
193
        ];
194
        return $clone;
195
    }
196
197
    /**
198
     * @param string                 $table
199
     * @param string|Expression|null $expression
200
     * @param array                  ...$values
201
     * @return UpdateQueryBuilder
202
     * @throws \InvalidArgumentException
203
     */
204
    public function leftOuterJoin(string $table, $expression = null, ...$values): self
205
    {
206
        $clone = clone $this;
207
        $clone->joins[$table] = [
208
            't' => 'LEFT OUTER JOIN',
209
            'c' => null !== $expression ? Expression::where($expression, ...$values) : null,
210
        ];
211
        return $clone;
212
    }
213
214
    /**
215
     * @param string                 $table
216
     * @param string|Expression|null $expression
217
     * @param array                  ...$values
218
     * @return UpdateQueryBuilder
219
     * @throws \InvalidArgumentException
220
     */
221
    public function rightJoin(string $table, $expression = null, ...$values): self
222
    {
223
        $clone = clone $this;
224
        $clone->joins[$table] = [
225
            't' => 'RIGHT JOIN',
226
            'c' => null !== $expression ? Expression::where($expression, ...$values) : null,
227
        ];
228
        return $clone;
229
    }
230
231
    /**
232
     * @param string                 $table
233
     * @param string|Expression|null $expression
234
     * @param array                  ...$values
235
     * @return UpdateQueryBuilder
236
     * @throws \InvalidArgumentException
237
     */
238
    public function rightOuterJoin(string $table, $expression = null, ...$values): self
239
    {
240
        $clone = clone $this;
241
        $clone->joins[$table] = [
242
            't' => 'RIGHT OUTER JOIN',
243
            'c' => null !== $expression ? Expression::where($expression, ...$values) : null,
244
        ];
245
        return $clone;
246
    }
247
248
    /**
249
     * @param string                 $table
250
     * @param string|Expression|null $expression
251
     * @param array                  ...$values
252
     * @return UpdateQueryBuilder
253
     * @throws \InvalidArgumentException
254
     */
255
    public function fullJoin(string $table, $expression = null, ...$values): self
256
    {
257
        $clone = clone $this;
258
        $clone->joins[$table] = [
259
            't' => 'FULL JOIN',
260
            'c' => null !== $expression ? Expression::where($expression, ...$values) : null,
261
        ];
262
        return $clone;
263
    }
264
265
    /**
266
     * @param string                 $table
267
     * @param string|Expression|null $expression
268
     * @param array                  ...$values
269
     * @return UpdateQueryBuilder
270
     * @throws \InvalidArgumentException
271
     */
272
    public function fullOuterJoin(string $table, $expression = null, ...$values): self
273
    {
274
        $clone = clone $this;
275
        $clone->joins[$table] = [
276
            't' => 'FULL OUTER JOIN',
277
            'c' => null !== $expression ? Expression::where($expression, ...$values) : null,
278
        ];
279
        return $clone;
280
    }
281
282
    /**
283
     * Reset all JOIN clauses.
284
     *
285
     * @return UpdateQueryBuilder
286
     */
287
    public function resetJoins(): self
288
    {
289
        $clone = clone $this;
290
        $clone->joins = [];
291
        return $clone;
292
    }
293
294
    /**
295
     * Remove a specific JOIN clause.
296
     *
297
     * @param string $table
298
     * @return UpdateQueryBuilder
299
     */
300
    public function withoutJoin(string $table)
301
    {
302
        $clone = clone $this;
303
        unset($clone->joins[$table]);
304
        return $clone;
305
    }
306
307
    /**
308
     * @param null  $expression
309
     * @param array ...$values
310
     * @return UpdateQueryBuilder
311
     * @throws \InvalidArgumentException
312
     */
313
    public function set($expression = null, ...$values): self
314
    {
315
        $clone = clone $this;
316
        $clone->set = null !== $expression ? Expression::where($expression, ...$values) : null;
0 ignored issues
show
Documentation Bug introduced by
It seems like null !== $expression ? \...ion, ...$values) : null can also be of type object<self>. However, the property $set is declared as type object<BenTools\Where\Expression\Expression>. Maybe add an additional type check?

Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly.

For example, imagine you have a variable $accountId that can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to the id property of an instance of the Account class. This class holds a proper account, so the id value must no longer be false.

Either this assignment is in error or a type check should be added for that assignment.

class Id
{
    public $id;

    public function __construct($id)
    {
        $this->id = $id;
    }

}

class Account
{
    /** @var  Id $id */
    public $id;
}

$account_id = false;

if (starsAreRight()) {
    $account_id = new Id(42);
}

$account = new Account();
if ($account instanceof Id)
{
    $account->id = $account_id;
}
Loading history...
317
        return $clone;
318
    }
319
320
    /**
321
     * @param null  $expression
322
     * @param array ...$values
323
     * @return UpdateQueryBuilder
324
     * @throws \InvalidArgumentException
325
     */
326
    public function andSet($expression = null, ...$values): self
327
    {
328
        if (null === $this->set) {
329
            return $this->set(Expression::where($expression, ...$values));
330
        }
331
        $clone = clone $this;
332
        $clone->set = $clone->set->plus(Expression::where($expression, ...$values));
333
        return $clone;
334
    }
335
336
    /**
337
     * @param string|Expression|null $expression
338
     * @param array                  ...$values
339
     * @return UpdateQueryBuilder
340
     * @throws \InvalidArgumentException
341
     */
342
    public function where($expression = null, ...$values): self
343
    {
344
        $clone = clone $this;
345
        $clone->where = null !== $expression ? Expression::where($expression, ...$values) : null;
0 ignored issues
show
Documentation Bug introduced by
It seems like null !== $expression ? \...ion, ...$values) : null can also be of type object<self>. However, the property $where is declared as type object<BenTools\Where\Expression\Expression>. Maybe add an additional type check?

Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly.

For example, imagine you have a variable $accountId that can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to the id property of an instance of the Account class. This class holds a proper account, so the id value must no longer be false.

Either this assignment is in error or a type check should be added for that assignment.

class Id
{
    public $id;

    public function __construct($id)
    {
        $this->id = $id;
    }

}

class Account
{
    /** @var  Id $id */
    public $id;
}

$account_id = false;

if (starsAreRight()) {
    $account_id = new Id(42);
}

$account = new Account();
if ($account instanceof Id)
{
    $account->id = $account_id;
}
Loading history...
346
        return $clone;
347
    }
348
349
    /**
350
     * @param string|Expression $expression
351
     * @param array             ...$values
352
     * @return UpdateQueryBuilder
353
     * @throws \InvalidArgumentException
354
     */
355
    public function andWhere($expression, ...$values): self
356
    {
357
        if (null === $this->where) {
358
            return $this->where(Expression::where($expression, ...$values));
359
        }
360
        $clone = clone $this;
361
        $clone->where = $clone->where->and(Expression::where($expression, ...$values));
362
        return $clone;
363
    }
364
365
    /**
366
     * @param string|Expression $expression
367
     * @param array             ...$values
368
     * @return UpdateQueryBuilder
369
     * @throws \InvalidArgumentException
370
     */
371
    public function orWhere($expression, ...$values): self
372
    {
373
        if (null === $this->where) {
374
            return $this->where(Expression::where($expression, ...$values));
375
        }
376
        $clone = clone $this;
377
        $clone->where = $clone->where->or(Expression::where($expression, ...$values));
378
        return $clone;
379
    }
380
381
    /**
382
     * @param string[] ...$groupBy
383
     * @return UpdateQueryBuilder
384
     */
385
    public function orderBy(string ...$orderBy): self
386
    {
387
        $clone = clone $this;
388
        $clone->orderBy = $orderBy;
389
        return $clone;
390
    }
391
392
    /**
393
     * @param string[] ...$groupBy
394
     * @return UpdateQueryBuilder
395
     */
396
    public function andOrderBy(string ...$orderBy): self
397
    {
398
        $clone = clone $this;
399
        $clone->orderBy = \array_merge($clone->orderBy, $orderBy);
400
        return $clone;
401
    }
402
403
    /**
404
     * @param int|null $limit
405
     * @return UpdateQueryBuilder
406
     */
407
    public function limit(int $limit = null): self
408
    {
409
        $clone = clone $this;
410
        $clone->limit = $limit;
411
        return $clone;
412
    }
413
414
    /**
415
     * @param string|null $end
416
     * @return UpdateQueryBuilder
417
     */
418
    public function end(string $end = null): self
419
    {
420
        $clone = clone $this;
421
        $clone->end = $end;
422
        return $clone;
423
    }
424
425
    /**
426
     * @return string
427
     */
428
    public function __toString(): string
429
    {
430
        return UpdateQueryStringifier::stringify($this);
431
    }
432
433
    /**
434
     * @return array
435
     */
436
    public function getValues(): array
437
    {
438
        $expressions = \array_filter(\array_merge(\array_column($this->joins, 'c'), [$this->set, $this->where]), function ($expression) {
439
            return $expression instanceof Expression;
440
        });
441
        return valuesOf(...$expressions);
442
    }
443
444
    /**
445
     * @return string
446
     */
447
    public function preview(): string
448
    {
449
        return Previewer::preview((string) $this, $this->getValues());
450
    }
451
452
    /**
453
     * Read-only properties.
454
     *
455
     * @param $property
456
     * @return mixed
457
     * @throws \InvalidArgumentException
458
     */
459
    public function __get($property)
460
    {
461
        if (!\property_exists($this, $property)) {
462
            throw new \InvalidArgumentException(\sprintf('Property %s::$%s does not exist.', __CLASS__, $property));
463
        }
464
        return $this->{$property};
465
    }
466
}
467