We could not synchronize checks via GitHub's checks API since Scrutinizer's GitHub App is not installed for this repository.
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | declare(strict_types=1); |
||
4 | |||
5 | namespace denis660\Centrifugo; |
||
6 | |||
7 | use Exception; |
||
8 | use Illuminate\Broadcasting\Broadcasters\Broadcaster; |
||
9 | use Illuminate\Broadcasting\BroadcastException; |
||
10 | use Symfony\Component\HttpKernel\Exception\HttpException; |
||
11 | |||
12 | class CentrifugoBroadcaster extends Broadcaster |
||
13 | { |
||
14 | /** |
||
15 | * The Centrifugo SDK instance. |
||
16 | * |
||
17 | * @var Contracts\CentrifugoInterface |
||
18 | */ |
||
19 | protected $centrifugo; |
||
20 | |||
21 | /** |
||
22 | * Create a new broadcaster instance. |
||
23 | * |
||
24 | * @param Centrifugo $centrifugo |
||
25 | */ |
||
26 | public function __construct(Centrifugo $centrifugo) |
||
27 | { |
||
28 | $this->centrifugo = $centrifugo; |
||
29 | } |
||
30 | |||
31 | /** |
||
32 | * Authenticate the incoming request for a given channel. |
||
33 | * |
||
34 | * @param \Illuminate\Http\Request $request |
||
35 | * @return mixed |
||
36 | */ |
||
37 | public function auth($request) |
||
38 | { |
||
39 | if ($request->user()) { |
||
40 | $client = $this->getClientFromRequest($request); |
||
41 | $channels = $this->getChannelsFromRequest($request); |
||
42 | |||
43 | $response = []; |
||
44 | $privateResponse = []; |
||
45 | foreach ($channels as $channel) { |
||
46 | $channelName = $this->getChannelName($channel); |
||
47 | |||
48 | try { |
||
49 | $is_access_granted = $this->verifyUserCanAccessChannel($request, $channelName); |
||
50 | } catch (HttpException $e) { |
||
51 | $is_access_granted = false; |
||
52 | } |
||
53 | |||
54 | if ($private = $this->isPrivateChannel($channel)) { |
||
55 | $privateResponse['channels'][] = $this->makeResponseForPrivateClient($is_access_granted, $channel, $client); |
||
56 | } else { |
||
57 | $response[$channel] = $this->makeResponseForClient($is_access_granted, $client); |
||
58 | } |
||
59 | } |
||
60 | |||
61 | return response($private ? $privateResponse : $response); |
||
0 ignored issues
–
show
|
|||
62 | } else { |
||
63 | throw new HttpException(401); |
||
64 | } |
||
65 | } |
||
66 | |||
67 | /** |
||
68 | * Return the valid authentication response. |
||
69 | * |
||
70 | * @param \Illuminate\Http\Request $request |
||
71 | * @param mixed $result |
||
72 | * @return mixed |
||
73 | */ |
||
74 | public function validAuthenticationResponse($request, $result) |
||
75 | { |
||
76 | return $result; |
||
77 | } |
||
78 | |||
79 | /** |
||
80 | * Broadcast the given event. |
||
81 | * |
||
82 | * @param array $channels |
||
83 | * @param string $event |
||
84 | * @param array $payload |
||
85 | * @return void |
||
86 | */ |
||
87 | public function broadcast(array $channels, $event, array $payload = []) |
||
88 | { |
||
89 | $payload['event'] = $event; |
||
90 | $channels = array_map(function ($channel) { |
||
91 | return str_replace('private-', '$', $channel); |
||
92 | }, $channels); |
||
93 | |||
94 | $response = $this->centrifugo->broadcast($this->formatChannels($channels), $payload); |
||
95 | |||
96 | if (is_array($response) && ! isset($response['error'])) { |
||
97 | return; |
||
98 | } |
||
99 | |||
100 | throw new BroadcastException( |
||
101 | $response['error'] instanceof Exception ? $response['error']->getMessage() : $response['error'] |
||
102 | ); |
||
103 | } |
||
104 | |||
105 | /** |
||
106 | * Get client from request. |
||
107 | * |
||
108 | * @param \Illuminate\Http\Request $request |
||
109 | * @return string |
||
110 | */ |
||
111 | private function getClientFromRequest($request) |
||
112 | { |
||
113 | return $request->get('client', ''); |
||
114 | } |
||
115 | |||
116 | /** |
||
117 | * Get channels from request. |
||
118 | * |
||
119 | * @param \Illuminate\Http\Request $request |
||
120 | * @return array |
||
121 | */ |
||
122 | private function getChannelsFromRequest($request) |
||
123 | { |
||
124 | $channels = $request->get('channels', []); |
||
125 | |||
126 | return is_array($channels) ? $channels : [$channels]; |
||
127 | } |
||
128 | |||
129 | /** |
||
130 | * Get channel name without $ symbol (if present). |
||
131 | * |
||
132 | * @param string $channel |
||
133 | * @return string |
||
134 | */ |
||
135 | private function getChannelName(string $channel) |
||
136 | { |
||
137 | return $this->isPrivateChannel($channel) ? substr($channel, 1) : $channel; |
||
138 | } |
||
139 | |||
140 | /** |
||
141 | * Check channel name by $ symbol. |
||
142 | * |
||
143 | * @param string $channel |
||
144 | * @return bool |
||
145 | */ |
||
146 | private function isPrivateChannel(string $channel): bool |
||
147 | { |
||
148 | return substr($channel, 0, 1) === '$'; |
||
149 | } |
||
150 | |||
151 | /** |
||
152 | * Make response for client, based on access rights. |
||
153 | * |
||
154 | * @param bool $access_granted |
||
155 | * @param string $client |
||
156 | * @return array |
||
157 | */ |
||
158 | private function makeResponseForClient(bool $access_granted, string $client) |
||
159 | { |
||
160 | $info = []; |
||
161 | |||
162 | return $access_granted ? [ |
||
163 | 'sign' => $this->centrifugo->generateConnectionToken($client, 0, $info), |
||
164 | 'info' => $info, |
||
165 | ] : [ |
||
166 | 'status' => 403, |
||
167 | ]; |
||
168 | } |
||
169 | |||
170 | /** |
||
171 | * Make response for client, based on access rights of private channel. |
||
172 | * |
||
173 | * @param bool $access_granted |
||
174 | * @param string $channel |
||
175 | * @param string $client |
||
176 | * @return array |
||
177 | */ |
||
178 | private function makeResponseForPrivateClient(bool $access_granted, string $channel, string $client) |
||
179 | { |
||
180 | $info = []; |
||
181 | |||
182 | return $access_granted ? [ |
||
183 | |||
184 | 'channel' => $channel, |
||
185 | 'token' => $this->centrifugo->generatePrivateChannelToken($client, $channel, 0, $info), |
||
186 | 'info' => $this->centrifugo->info(), |
||
187 | |||
188 | ] : [ |
||
189 | 'status' => 403, |
||
190 | ]; |
||
191 | } |
||
192 | } |
||
193 |
If you define a variable conditionally, it can happen that it is not defined for all execution paths.
Let’s take a look at an example:
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined.
Available Fixes
Check for existence of the variable explicitly:
Define a default value for the variable:
Add a value for the missing path: