This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | namespace PhpBoot\Utils; |
||
3 | /** |
||
4 | * Class AnnotationParams |
||
5 | */ |
||
6 | class AnnotationParams implements \Countable, \ArrayAccess |
||
7 | { |
||
8 | 22 | public function __construct($text, $limit) |
|
9 | { |
||
10 | 22 | if($limit == 1){ |
|
11 | 2 | $this->rawParams[] = $text; |
|
12 | 2 | return; |
|
13 | } |
||
14 | 21 | if($limit <= 0){ |
|
15 | 1 | return; |
|
16 | } |
||
17 | 21 | $text = ltrim($text); |
|
18 | 21 | $pos = 0; |
|
19 | 21 | $state = 'stateNormal'; |
|
20 | 21 | $len = strlen($text); |
|
21 | 21 | if($len == 0){ |
|
22 | 16 | return; |
|
23 | } |
||
24 | 21 | while (true){ |
|
25 | 21 | if($state == 'stateNormal' && count($this->rawParams)+1 == $limit){ |
|
26 | 5 | break; |
|
27 | } |
||
28 | 21 | $pos = $this->$state($text, $pos, $state); |
|
29 | 21 | if($pos === false || $pos>= $len){ |
|
30 | 21 | break; |
|
31 | } |
||
32 | 7 | }; |
|
33 | 21 | if($this->prePos != strlen($text)){ |
|
34 | 5 | $this->rawParams[] = substr($text,$this->prePos); |
|
35 | 5 | } |
|
36 | 21 | } |
|
37 | |||
38 | /** |
||
39 | * 普通状态 |
||
40 | */ |
||
41 | 21 | private function stateNormal($text, $pos, &$next) |
|
42 | { |
||
43 | //查找引号或者空格 |
||
44 | 21 | $found = []; |
|
45 | 21 | $todo = substr($text,$pos); |
|
46 | 21 | if(!preg_match('/[\s"\']/', $todo, $found, PREG_OFFSET_CAPTURE) || |
|
47 | 21 | count($found)==0){ |
|
48 | 21 | $this->rawParams[] = substr($text,$this->prePos); |
|
49 | 21 | $this->prePos = strlen($text); |
|
50 | 21 | return false; |
|
51 | } |
||
52 | 7 | list($chars, $offset) = $found[0]; |
|
53 | |||
54 | 7 | if($chars == '"'){ |
|
55 | 3 | $next = 'stateDoubleQ'; |
|
56 | 3 | return $pos + $offset + 1; |
|
57 | } |
||
58 | // elseif ($chars == '\''){ |
||
59 | // $next = 'stateSingleQ'; |
||
60 | // return $pos + $offset + 1; |
||
61 | // } |
||
62 | else{ |
||
63 | 7 | $this->rawParams[] = substr($text,$this->prePos, $pos-$this->prePos+$offset); |
|
64 | 7 | $next = 'stateSpace'; |
|
65 | 7 | $this->prePos = $pos + $offset + 1; |
|
0 ignored issues
–
show
|
|||
66 | 7 | return $this->prePos; |
|
67 | } |
||
68 | |||
69 | } |
||
70 | /** |
||
71 | * 进入空格状态 |
||
72 | */ |
||
73 | 7 | private function stateSpace($text, $pos, &$next) |
|
74 | { |
||
75 | 7 | $found = []; |
|
76 | 7 | $todo = substr($text,$pos); |
|
77 | 7 | View Code Duplication | if(!preg_match('/\S/', $todo, $found, PREG_OFFSET_CAPTURE) || |
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
78 | 7 | count($found)==0){ |
|
79 | return false; |
||
80 | } |
||
81 | 7 | list($chars, $offset) = $found[0]; |
|
0 ignored issues
–
show
The assignment to
$chars is unused. Consider omitting it like so list($first,,$third) .
This checks looks for assignemnts to variables using the Consider the following code example. <?php
function returnThreeValues() {
return array('a', 'b', 'c');
}
list($a, $b, $c) = returnThreeValues();
print $a . " - " . $c;
Only the variables Instead, the list call could have been. list($a,, $c) = returnThreeValues();
![]() |
|||
82 | 7 | $this->prePos = $pos + $offset; |
|
83 | 7 | $next = 'stateNormal'; |
|
84 | 7 | return $this->prePos; |
|
85 | } |
||
86 | // /** |
||
87 | // * 进入单引号状态 |
||
88 | // */ |
||
89 | // private function stateSingleQ($text, $pos, &$next){ |
||
90 | // |
||
91 | // $found = []; |
||
92 | // $todo = substr($text,$pos); |
||
93 | // if(!preg_match('/[\\\\\']/', $todo, $found, PREG_OFFSET_CAPTURE) || |
||
94 | // count($found)==0){ |
||
95 | // return false; |
||
96 | // } |
||
97 | // list($chars, $offset) = $found[0]; |
||
98 | // if($chars == '\\'){ |
||
99 | // return $pos+$offset+2; |
||
100 | // }else{ |
||
101 | // $next = 'stateNormal'; |
||
102 | // return $pos+$offset+1; |
||
103 | // } |
||
104 | // } |
||
105 | /** |
||
106 | * 进入双引号状态 |
||
107 | */ |
||
108 | 3 | private function stateDoubleQ($text, $pos, &$next){ |
|
109 | |||
110 | 3 | $found = []; |
|
111 | 3 | $todo = substr($text,$pos); |
|
112 | 3 | View Code Duplication | if(!preg_match('/[\\\\"]/', $todo, $found, PREG_OFFSET_CAPTURE) || |
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
113 | 3 | count($found)==0){ |
|
114 | 1 | return false; |
|
115 | } |
||
116 | 3 | list($chars, $offset) = $found[0]; |
|
117 | 3 | if($chars == '\\'){ |
|
118 | 1 | return $pos+$offset+2; |
|
119 | }else{ |
||
120 | 3 | $next = 'stateNormal'; |
|
121 | 3 | return $pos+$offset+1; |
|
122 | } |
||
123 | } |
||
124 | |||
125 | 21 | public function count() |
|
126 | { |
||
127 | 21 | return count($this->rawParams); |
|
128 | } |
||
129 | |||
130 | 22 | public function getParam($pos, $default = null, $ignoreError=false) |
|
131 | { |
||
132 | 22 | if(isset($this->cachedParams[$pos])){ |
|
133 | 5 | return $this->cachedParams[$pos]; |
|
134 | } |
||
135 | 22 | if(isset($this->rawParams[$pos])){ |
|
136 | 22 | $param = $this->rawParams[$pos]; |
|
137 | 22 | $param = $this->stripSlashes($param, $ignoreError); |
|
138 | 22 | $this->cachedParams[$pos] = $param; |
|
139 | 22 | return $param; |
|
140 | }else{ |
||
141 | return $default; |
||
142 | } |
||
143 | } |
||
144 | |||
145 | 6 | public function getRawParam($pos, $default = null) |
|
146 | { |
||
147 | 6 | if(isset($this->rawParams[$pos])){ |
|
148 | 5 | return $this->rawParams[$pos]; |
|
149 | }else{ |
||
150 | 5 | return $default; |
|
151 | } |
||
152 | } |
||
153 | |||
154 | 22 | private function stripSlashes($text, $ignoreError) |
|
155 | { |
||
156 | 22 | if(strlen($text)>=2 && substr($text,0,1) == '"'){ |
|
157 | 1 | $decoded = json_decode($text); |
|
158 | 1 | if(json_last_error()){ |
|
159 | 1 | if($ignoreError){ |
|
160 | 1 | return $text; |
|
161 | }else{ |
||
162 | 1 | \PhpBoot\abort('json_decode failed with '.json_last_error_msg(), [$text]); |
|
163 | } |
||
164 | } |
||
165 | 1 | return $decoded; |
|
166 | } |
||
167 | 22 | return $text; |
|
168 | } |
||
169 | private $cachedParams = []; |
||
170 | private $rawParams = []; |
||
171 | private $prePos = 0; |
||
172 | |||
173 | /** |
||
174 | * Whether a offset exists |
||
175 | * @link http://php.net/manual/en/arrayaccess.offsetexists.php |
||
176 | * @param mixed $offset <p> |
||
177 | * An offset to check for. |
||
178 | * </p> |
||
179 | * @return boolean true on success or false on failure. |
||
180 | * </p> |
||
181 | * <p> |
||
182 | * The return value will be casted to boolean if non-boolean was returned. |
||
183 | * @since 5.0.0 |
||
184 | */ |
||
185 | public function offsetExists($offset) |
||
186 | { |
||
187 | return $this->getParam($offset, $this) != $this; |
||
188 | } |
||
189 | |||
190 | /** |
||
191 | * Offset to retrieve |
||
192 | * @link http://php.net/manual/en/arrayaccess.offsetget.php |
||
193 | * @param mixed $offset <p> |
||
194 | * The offset to retrieve. |
||
195 | * </p> |
||
196 | * @return mixed Can return all value types. |
||
197 | * @since 5.0.0 |
||
198 | */ |
||
199 | 17 | public function offsetGet($offset) |
|
200 | { |
||
201 | 17 | return $this->getParam($offset); |
|
202 | } |
||
203 | |||
204 | /** |
||
205 | * Offset to set |
||
206 | * @link http://php.net/manual/en/arrayaccess.offsetset.php |
||
207 | * @param mixed $offset <p> |
||
208 | * The offset to assign the value to. |
||
209 | * </p> |
||
210 | * @param mixed $value <p> |
||
211 | * The value to set. |
||
212 | * </p> |
||
213 | * @return void |
||
214 | * @since 5.0.0 |
||
215 | */ |
||
216 | public function offsetSet($offset, $value) |
||
217 | { |
||
218 | \PhpBoot\abort(new \BadMethodCallException('not impl')); |
||
219 | } |
||
220 | |||
221 | /** |
||
222 | * Offset to unset |
||
223 | * @link http://php.net/manual/en/arrayaccess.offsetunset.php |
||
224 | * @param mixed $offset <p> |
||
225 | * The offset to unset. |
||
226 | * </p> |
||
227 | * @return void |
||
228 | * @since 5.0.0 |
||
229 | */ |
||
230 | public function offsetUnset($offset) |
||
231 | { |
||
232 | \PhpBoot\abort(new \BadMethodCallException('not impl')); |
||
233 | } |
||
234 | } |
||
235 |
This check looks for assignments to scalar types that may be of the wrong type.
To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.