Issues (225)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Scaffolder/Commands/ServeCommand.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Scaffolder\Commands;
4
5
use Illuminate\Console\Command;
6
use Illuminate\Support\Facades\File;
7
8
use stdClass ;
9
10
// Support classes
11
use Scaffolder\Support\Directory;
12
use Scaffolder\Support\Json;
13
use Scaffolder\Support\Arrays;
14
use Scaffolder\Support\CamelCase;
15
use Scaffolder\Compilers\Support\PathParser;
16
17
18
class ServeCommand extends Command
19
{
20
	protected $signature = 'scaffolder:serve {app=webapp} {--o|overwrite : Overwrite generated files} {--g|generate : Generate files }';
21
22
	protected $description = 'Serve code for development purpose';
23
24
	// app config var
25
	private $scaffolderConfig ;
26
27
	/**
28
	 * Execute the Command.
29
	 */
30
	public function handle()
31
	{
32
		// Get app config
33
		$this->getScaffolderConfig();
34
35
		$overwrite = false;
36
37
		if($this->option('overwrite'))
38
			$overwrite = true;
39
40
		$generate = false;
41
42
		if($this->option('generate'))
43
			$generate = true;
44
45
46
		switch ($this->argument('app')) {
47
			case 'webapp':
0 ignored issues
show
The case body in a switch statement must start on the line following the statement.

According to the PSR-2, the body of a case statement must start on the line immediately following the case statement.

switch ($expr) {
case "A":
    doSomething(); //right
    break;
case "B":

    doSomethingElse(); //wrong
    break;

}

To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.

Loading history...
48
				
49
				// gera código somente se houver a opcao
50
				if($generate) {
51
					// Gera codigo da api
52
					$this->call('scaffolder:generate', array('app' => 'api', '-c' => 'clear-all'));
53
					
54
					// Se parametro --overwrite selecionado, copia arquivos para seu respectivo destino
55
					$this->copyApiFiles($overwrite);
56
					
57
					// Gera codigo da pasta webapp
58
					$this->call('scaffolder:generate', array('app' => 'angularjs', '-c' => 'clear-all'));
59
					
60
					// Se parametro --overwrite selecionado, copia arquivos para seu respectivo destino
61
					$this->copyAngularjsFiles($overwrite);
62
				}
63
				
64
				$gulpCommand = sprintf('gulp serve --cwd "%s/codificar/scaffolder-theme-material/" > null', base_path('vendor'));
65
66
				$this->info('Running gulp in serve mode, wait your browser open...');	
67
				//$handle = popen($gulpCommand, 'r');
0 ignored issues
show
Unused Code Comprehensibility introduced by
59% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
68
69
				$this->launchBackgroundProcess($gulpCommand);
70
				
71
				// php artisan serve
72
				$this->call('serve');
73
74
				break;
75
76
			default:
77
				$this->info('Invalid arguments');
78
				break;
79
		}
80
		
81
	}
82
83
	/**
84
	* Launch Background Process
85
	*
86
	* Launches a background process (note, provides no security itself, $call must be sanitized prior to use)
87
	* @param string $call the system call to make
88
	* @author raccettura
89
	*/
90
	private function launchBackgroundProcess($call) {
91
	 
92
		// Windows
93
		if($this->is_windows()){
94
			pclose(popen('start /b '.$call, 'r'));
95
		}
96
	 
97
		// Some sort of UNIX
98
		else {
99
			pclose(popen($call.' /dev/null &', 'r'));
100
		}
101
		return true;
102
	}
103
	 
104
	 
105
	/**
106
	* Is Windows
107
	*
108
	* Tells if we are running on Windows Platform
109
	* @author raccettura
110
	*/
111
	private function is_windows(){
112
		if(PHP_OS == 'WINNT' || PHP_OS == 'WIN32'){
113
			return true;
114
		}
115
		return false;
116
	}
117
118
119
	public function copyApiFiles($overwrite) {
120
121
		$command = sprintf('cp -r %s "%s/." "%s"', 
122
			(!$overwrite ? ' -u' : null) , 
123
			PathParser::parse($this->scaffolderConfig->generators->api->paths->base),
124
			base_path());
125
		
126
		shell_exec($command);
127
128
		$this->info('- Api files copied');	
129
	}
130
131
	public function copyAngularjsFiles($overwrite) {
132
133
		// resource angular js path
134
		Directory::createIfNotExists(PathParser::parse($this->scaffolderConfig->generators->angularjs->paths->resources), 0755, true);
135
136
		// copying page files
137
		$command = sprintf('cp -r %s "%s/." "%s/"', 
138
			(!$overwrite ? ' -u' : null) , 
139
			PathParser::parse($this->scaffolderConfig->generators->angularjs->paths->index),
140
			PathParser::parse($this->scaffolderConfig->generators->angularjs->paths->resources));
141
142
		shell_exec($command);
143
		
144
		$this->info('- Angularjs files copied');	
145
	}
146
147
148
	/**
149
	 * Get the app.json configuration and parse to an object
150
	 *
151
	 * @return void
152
	 */
153
	private function getScaffolderConfig(){
154
		// Get app config
155
		$this->scaffolderConfig = Json::decodeFile(base_path('scaffolder-config/app.json'));
156
157
	}
158
159
}