Issues (5)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Tests/Managers/SandboxResponseManagerTest.php (4 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
namespace SandboxBundle\Tests\Managers;
3
4
use danrevah\SandboxBundle\Managers\SandboxResponseManager;
5
use Doctrine\Common\Annotations\AnnotationReader;
6
use Doctrine\Common\Collections\ArrayCollection;
7
use ShortifyPunit\ShortifyPunit;
8
use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
9
use Symfony\Component\HttpFoundation\ParameterBag;
10
11
// Fake appKernel for testing
12
class AppKernel {
13
    public function locateResource($a) {
14
        return $a;
15
    }
16
}
17
18
class testObject
0 ignored issues
show
Coding Style Compatibility introduced by
PSR1 recommends that each class should be in its own file to aid autoloaders.

Having each class in a dedicated file usually plays nice with PSR autoloaders and is therefore a well established practice. If you use other autoloaders, you might not want to follow this rule.

Loading history...
19
{
20
21
    public function notAnnotatedFunction() {
22
        return 'not-annotated-function';
23
    }
24
25
    /**
26
     * @ApiSandboxResponse(
27
     *      responseCode=200,
28
     *      type="json",
29
     *      parameters={
30
     *          {"name"="some_parameter", "required"=true}
31
     *      },
32
     *      resource="@SandboxBundle/Resources/responses/token.json"
33
     * )
34
     */
35
    public function annotatedResponseFunction() {
36
        return 'annotated-response-function';
37
    }
38
39
    /**
40
     * @ApiSandboxMultiResponse(
41
     *      responseCode=200,
42
     *      type="json",
43
     *      parameters={
44
     *          {"name"="some_parameter", "required"=true}
45
     *      },
46
     *      responseFallback={
47
     *          "type"="xml",
48
     *          "responseCode"=500,
49
     *          "resource"="@SandboxBundle/Resources/responses/error.xml"
50
     *      },
51
     *      multiResponse={
52
     *          {
53
     *              "type"="xml",
54
     *              "resource"="@SandboxBundle/Resources/responses/token.xml",
55
     *              "caseParams": {"some_parameter"="1", "some_parameter2"="2"}
56
     *          },
57
     *          {
58
     *              "resource"="@SandboxBundle/Resources/responses/token.json",
59
     *              "caseParams": {"some_parameter"="3", "some_parameter2"="4"}
60
     *          }
61
     *      }
62
     * )
63
     */
64
    public function annotatedMultiResponseFunction() {
65
        return 'annotated-multi-response-function';
66
    }
67
}
68
69
class SandboxResponseManagerTest extends WebTestCase
0 ignored issues
show
Coding Style Compatibility introduced by
PSR1 recommends that each class should be in its own file to aid autoloaders.

Having each class in a dedicated file usually plays nice with PSR autoloaders and is therefore a well established practice. If you use other autoloaders, you might not want to follow this rule.

Loading history...
70
{
71
    private static $XML_PATH = 'Resources/responses/token.xml';
72
    private static $JSON_PATH = 'Resources/responses/token.json';
73
74
    /**
75
     * @expectedException \Exception
76
     */
77
    public function testSandboxResponseForced()
78
    {
79
        $sandboxResponseManager = $this->createManager(false);
80
81
        $request = new ParameterBag();
82
        $query = new ParameterBag();
83
        $rawRequest = new ArrayCollection();
84
85
        $object = new testObject();
86
        $method = 'notAnnotatedFunction';
87
88
        $response = $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
89
        $this->assertFalse($response);
90
91
        // another test for exception with force
92
        $sandboxResponseManager = $this->createManager(true);
93
        $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
94
    }
95
96
    /**
97
     * @expectedException \RuntimeException
98
     */
99
    public function testConfigurationFallbackException()
100
    {
101
        $request = new ParameterBag(['some_parameter' => 1, 'some_parameter2'=>2]);
102
        $query = new ParameterBag();
103
        $rawRequest = new ArrayCollection();
104
105
        $object = new testObject();
106
        $method = 'annotatedResponseFunction';
107
108
        $annotationsReader = ShortifyPunit::mock('Doctrine\Common\Annotations\AnnotationReader');
109
110
        $responseObj = new \StdClass();
111
        $responseObj->parameters = [['name'=>'some_parameter', 'required'=>true]];
112
        $responseObj->type = 'json';
113
        $responseObj->responseCode = 200;
114
115
        $responseObj->multiResponse = [
116
            [
117
                'resource' => '@SandboxBundle/Resources/responses/token.json',
118
                'caseParams' => ['some_parameter'=>3, 'some_parameter2'=>4]
119
            ]
120
        ];
121
122
        $responseObj->responseFallback = [
123
            'responseCode' => 404,
124
        ];
125
126
        ShortifyPunit::when($annotationsReader)->
127
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxResponse')->
128
            returns(false);
129
130
        ShortifyPunit::when($annotationsReader)->
131
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxMultiResponse')->
132
            returns($responseObj);
133
134
        $sandboxResponseManager = $this->createManager(true, $annotationsReader);
135
        $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
136
    }
137
138
    public function testUnknownResponseType()
139
    {
140
        $request = new ParameterBag(['some_parameter' => 1, 'some_parameter2'=>2]);
141
        $query = new ParameterBag();
142
        $rawRequest = new ArrayCollection();
143
144
        $object = new testObject();
145
        $method = 'annotatedResponseFunction';
146
147
        $annotationsReader = ShortifyPunit::mock('Doctrine\Common\Annotations\AnnotationReader');
148
149
        $responseObj = new \StdClass();
150
        $responseObj->parameters = [['name'=>'some_parameter', 'required'=>true]];
151
        $responseObj->type = 'some_unknown_response_type';
152
        $responseObj->responseCode = 200;
153
154
        $responseObj->multiResponse = [
155
            [
156
                'resource' => '@SandboxBundle/Resources/responses/token.json',
157
                'caseParams' => ['some_parameter'=>3, 'some_parameter2'=>4]
158
            ]
159
        ];
160
161
        $responseObj->responseFallback = [
162
            'resource' => '@SandboxBundle/Resources/responses/token.json',
163
            'responseCode' => 404,
164
        ];
165
166
        ShortifyPunit::when($annotationsReader)->
167
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxResponse')->
168
            returns(false);
169
170
        ShortifyPunit::when($annotationsReader)->
171
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxMultiResponse')->
172
            returns($responseObj);
173
        $this->setExpectedException('\RuntimeException');
174
        $sandboxResponseManager = $this->createManager(true, $annotationsReader);
175
        $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
176
    }
177
178
179 View Code Duplication
    public function testMissingParameters()
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
180
    {
181
        $request = new ParameterBag();
182
        $query = new ParameterBag();
183
        $rawRequest = new ArrayCollection();
184
185
        $object = new testObject();
186
        $method = 'annotatedResponseFunction';
187
188
        $annotationsReader = ShortifyPunit::mock('Doctrine\Common\Annotations\AnnotationReader');
189
190
        $responseObj = new \StdClass();
191
        $responseObj->parameters = [['name'=>'some_parameter', 'required'=>true]];
192
        $responseObj->type = 'json';
193
        $responseObj->responseCode = 200;
194
195
        $responseObj->multiResponse = [
196
            [
197
                'resource' => '@SandboxBundle/Resources/responses/token.json',
198
                'caseParams' => ['some_parameter'=>3, 'some_parameter2'=>4]
199
            ]
200
        ];
201
202
        $responseObj->responseFallback = [
203
            'responseCode' => 404,
204
        ];
205
206
        ShortifyPunit::when($annotationsReader)->
207
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxResponse')->
208
            returns(false);
209
210
        ShortifyPunit::when($annotationsReader)->
211
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxMultiResponse')->
212
            returns($responseObj);
213
214
        $this->setExpectedException('\InvalidArgumentException');
215
        $sandboxResponseManager = $this->createManager(true, $annotationsReader);
216
        $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
217
    }
218
219 View Code Duplication
    public function testConfigurationResourceFallbackException()
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
220
    {
221
        $request = new ParameterBag(['some_parameter' => 1, 'some_parameter2'=>2]);
222
        $query = new ParameterBag();
223
        $rawRequest = new ArrayCollection();
224
225
        $object = new testObject();
226
        $method = 'annotatedResponseFunction';
227
228
        $annotationsReader = ShortifyPunit::mock('Doctrine\Common\Annotations\AnnotationReader');
229
230
        $responseObj = new \StdClass();
231
        $responseObj->parameters = [['name'=>'some_parameter', 'required'=>true]];
232
        $responseObj->type = 'json';
233
        $responseObj->responseCode = 200;
234
235
        $responseObj->multiResponse = [
236
            [
237
                'resource' => '@SandboxBundle/Resources/responses/token.json',
238
                'caseParams' => ['some_parameter'=>3, 'some_parameter2'=>4]
239
            ]
240
        ];
241
242
        ShortifyPunit::when($annotationsReader)->
243
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxResponse')->
244
            returns(false);
245
246
        ShortifyPunit::when($annotationsReader)->
247
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxMultiResponse')->
248
            returns($responseObj);
249
250
        $this->setExpectedException('\RuntimeException');
251
        $sandboxResponseManager = $this->createManager(true, $annotationsReader);
252
        $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
253
254
    }
255
256
    public function testSandboxResponseForceException()
257
    {
258
        $force = true;
259
        $sandboxResponseManager = $this->createManager($force);
260
261
        $request = $query = new ParameterBag();
262
        $rawRequest = new ArrayCollection();
263
        $object = new testObject();
264
        $method = 'annotated';
265
266
        $this->setExpectedException('\Exception');
267
        $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
268
    }
269
270
    /**
271
     * Testing single response annotation logic `ApiSandboxResponse`
272
     */
273
    public function testSandboxResponse()
274
    {
275
        $request = new ParameterBag(['some_parameter' => 1]);
276
        $query = new ParameterBag();
277
        $rawRequest = new ArrayCollection();
278
279
        $object = new testObject();
280
        $method = 'annotatedResponseFunction';
281
282
        $annotationsReader = ShortifyPunit::mock('Doctrine\Common\Annotations\AnnotationReader');
283
284
        $responseObj = new \StdClass();
285
        $responseObj->parameters = [['name'=>'some_parameter', 'required'=>true]];
286
        $responseObj->resource = '@SandboxBundle/Resources/responses/token.json';
287
        $responseObj->type = 'json';
288
        $responseObj->responseCode = 200;
289
290
        ShortifyPunit::when($annotationsReader)->
291
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxResponse')->
292
            returns($responseObj);
293
294
        ShortifyPunit::when($annotationsReader)->
295
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxMultiResponse')->
296
            returns(false);
297
298
        $sandboxResponseManager = $this->createManager(true, $annotationsReader);
299
        list($callable, $content, $type, $statusCode) = $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
300
        $jsonFile = json_decode(file_get_contents(self::$JSON_PATH), 1);
301
        $this->assertEquals($jsonFile, $content);
302
        $this->assertEquals($type, 'json');
303
        $this->assertEquals($statusCode, 200);
304
        $this->assertInstanceOf('Symfony\Component\HttpFoundation\JsonResponse', $callable());
305
    }
306
307
    /**
308
     * Testing single multi response annotation logic `ApiSandboxMultiResponse`
309
     */
310
    public function testSandboxMultiResponse()
311
    {
312
        // [1] Check basic multiResponse with one response by params
313
        $request = new ParameterBag(['some_parameter' => 3, 'some_parameter2'=>4]);
314
        $query = new ParameterBag();
315
        $rawRequest = new ArrayCollection();
316
317
        $object = new testObject();
318
        $method = 'annotatedResponseFunction';
319
320
        $annotationsReader = ShortifyPunit::mock('Doctrine\Common\Annotations\AnnotationReader');
321
322
        $responseObj = new \StdClass();
323
        $responseObj->parameters = [['name'=>'some_parameter', 'required'=>true]];
324
        $responseObj->type = 'json';
325
        $responseObj->responseCode = 200;
326
327
        $responseObj->multiResponse = [
328
            [
329
                'resource' => '@SandboxBundle/Resources/responses/token.json',
330
                'caseParams' => ['some_parameter'=>3, 'some_parameter2'=>4]
331
            ]
332
        ];
333
334
        ShortifyPunit::when($annotationsReader)->
335
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxResponse')->
336
            returns(false);
337
338
        ShortifyPunit::when($annotationsReader)->
339
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxMultiResponse')->
340
            returns($responseObj);
341
342
        $sandboxResponseManager = $this->createManager(true, $annotationsReader);
343
        list(, $content, $type, $statusCode) = $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
344
345
        $jsonFile = json_decode(file_get_contents(self::$JSON_PATH), 1);
346
        $xmlFile = file_get_contents(self::$XML_PATH);
347
348
        $this->assertEquals($jsonFile, $content);
349
        $this->assertEquals($type, 'json');
350
        $this->assertEquals($statusCode, 200);
351
352
353
        // [2] Checking if child inside multiResponse override the parent configuration
354
        $responseObj->multiResponse = [
355
            [
356
                'type' => 'xml',
357
                'responseCode' => 500,
358
                'resource' => '@SandboxBundle/Resources/responses/token.json',
359
                'caseParams' => ['some_parameter'=>3, 'some_parameter2'=>4]
360
            ]
361
        ];
362
363
        ShortifyPunit::when($annotationsReader)->
364
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxMultiResponse')->
365
            returns($responseObj);
366
367
        $sandboxResponseManager = $this->createManager(true, $annotationsReader);
368
        list(,, $type, $statusCode) = $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
369
370
        $this->assertEquals($type, 'xml');
371
        $this->assertEquals($statusCode, 500);
372
373
        // [3] Check multiple configuration
374
        $responseObj->multiResponse = [
375
            [
376
                'type' => 'xml',
377
                'responseCode' => 200,
378
                'resource' => '@SandboxBundle/Resources/responses/token.xml',
379
                'caseParams' => ['some_parameter'=>1, 'some_parameter2'=>2]
380
            ],
381
            [
382
                'type' => 'json',
383
                'responseCode' => 200,
384
                'resource' => '@SandboxBundle/Resources/responses/token.json',
385
                'caseParams' => ['some_parameter'=>3, 'some_parameter2'=>4]
386
            ]
387
        ];
388
389
        $responseObj->responseFallback = [
390
            'type' => 'json',
391
            'responseCode' => 404,
392
            'resource' => '@SandboxBundle/Resources/responses/token.json'
393
        ];
394
395
        ShortifyPunit::when($annotationsReader)->
396
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxMultiResponse')->
397
            returns($responseObj);
398
399
        $sandboxResponseManager = $this->createManager(true, $annotationsReader);
400
401
        $request = new ParameterBag(['some_parameter' => 1, 'some_parameter2'=>2]);
402
        list($callable, $content, $type, $statusCode) = $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
403
404
        $this->assertEquals($type, 'xml');
405
        $this->assertEquals($statusCode, 200);
406
        $this->assertEquals($xmlFile, $content);
407
        $this->assertInstanceOf('Symfony\Component\HttpFoundation\Response', $callable());
408
409
        $request = new ParameterBag(['some_parameter' => 3, 'some_parameter2'=>4]);
410
        list(, $content, $type, $statusCode) = $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
411
412
        $this->assertEquals($type, 'json');
413
        $this->assertEquals($statusCode, 200);
414
        $this->assertEquals($jsonFile, $content);
415
416
        // [4] Testing with fallback
417
        $request = new ParameterBag(['some_parameter' => 5, 'some_parameter2'=>6]);
418
        list(, $content, $type, $statusCode) = $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
419
420
        $this->assertEquals($type, 'json');
421
        $this->assertEquals($statusCode, 404);
422
        $this->assertEquals($jsonFile, $content);
423
424
    }
425
426
    /**
427
     * @expectedException \RuntimeException
428
     */
429
    public function testSandboxMultiResponseException()
430
    {
431
        // [1] Check basic multiResponse with one response by params
432
        $request = new ParameterBag(['some_parameter' => 3, 'some_parameter2'=>4]);
433
        $query = new ParameterBag();
434
        $rawRequest = new ArrayCollection();
435
436
        $object = new testObject();
437
        $method = 'annotatedResponseFunction';
438
439
        $annotationsReader = ShortifyPunit::mock('Doctrine\Common\Annotations\AnnotationReader');
440
441
        $responseObj = new \StdClass();
442
        $responseObj->parameters = [['name'=>'some_parameter', 'required'=>true]];
443
        $responseObj->type = 'json';
444
        $responseObj->responseCode = 200;
445
446
        $responseObj->multiResponse = [
447
            [
448
                'resource' => '@SandboxBundle/Resources/responses/token.json',
449
            ]
450
        ];
451
452
        ShortifyPunit::when($annotationsReader)->
453
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxResponse')->
454
            returns(false);
455
456
        ShortifyPunit::when($annotationsReader)->
457
            getMethodAnnotation(anInstanceOf('ReflectionMethod'), 'danrevah\SandboxBundle\Annotation\ApiSandboxMultiResponse')->
458
            returns($responseObj);
459
460
        $sandboxResponseManager = $this->createManager(true, $annotationsReader);
461
        $sandboxResponseManager->getResponseController($object, $method, $request, $query, $rawRequest);
462
    }
463
464
    /**
465
     * Creating sandboxResponseManager with dependencies
466
     *
467
     * @param $force
468
     * @param bool $annotationsReader
469
     * @return SandboxResponseManager
470
     */
471
    private function createManager($force, $annotationsReader = false)
472
    {
473
        if ( ! $annotationsReader instanceof AnnotationReader) {
474
            $annotationsReader = new AnnotationReader();
475
        }
476
477
        // Mocking the sandbox response manager dependencies
478
        $kernel = ShortifyPunit::mock('SandboxBundle\Tests\Managers\AppKernel');
479
480
        ShortifyPunit::when($kernel)->locateResource('@SandboxBundle/Resources/responses/token.xml')->returns(self::$XML_PATH);
481
        ShortifyPunit::when($kernel)->locateResource('@SandboxBundle/Resources/responses/token.json')->returns(self::$JSON_PATH);
482
        // Create manager
483
        return new SandboxResponseManager($kernel, $force, $annotationsReader);
484
    }
485
}