This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /* |
||
4 | * This file is part of the "Kata 1" package. |
||
5 | * |
||
6 | * Copyright (c) Daniel González |
||
7 | * |
||
8 | * For the full copyright and license information, please view the LICENSE |
||
9 | * file that was distributed with this source code. |
||
10 | * |
||
11 | * @author Daniel González <[email protected]> |
||
12 | */ |
||
13 | |||
14 | namespace App; |
||
15 | |||
16 | use Negotiation\Negotiator; |
||
17 | use Pimple\Container; |
||
18 | |||
19 | |||
20 | |||
21 | use Component\Firewall\Firewall; |
||
22 | use Component\Http\JsonResponse; |
||
23 | use Component\Http\RedirectResponse; |
||
24 | use Component\Http\Request; |
||
25 | use Component\Http\Response; |
||
26 | use Component\Http\Session; |
||
27 | |||
28 | use App\Controller\Api\UserController; |
||
29 | use App\Controller\DefaultController; |
||
30 | use App\Controller\PageController; |
||
31 | use App\Controller\SecurityController; |
||
32 | use App\Negociation\Handler\ResponseHandler; |
||
33 | use App\Repository\UserRepository; |
||
34 | use App\Security\Http\HttpBasicUserProvider; |
||
35 | |||
36 | /** |
||
37 | * Application. |
||
38 | */ |
||
39 | class Application extends Container |
||
40 | { |
||
41 | /** |
||
42 | * @param array $values |
||
43 | */ |
||
44 | 17 | public function __construct(array $values = []) |
|
45 | 4 | { |
|
46 | 17 | parent::__construct($values); |
|
47 | 17 | $this['debug'] = false; |
|
48 | 17 | $this['app.cache.dir'] = __DIR__.'/../../var/cache'; |
|
49 | 17 | $this['app.views.dir'] = __DIR__.'/../../views'; |
|
50 | $this['app.session'] = function () { |
||
51 | 15 | return new Session( |
|
52 | [ |
||
53 | 15 | 'cookie_lifetime' => 5 * 60, |
|
54 | 15 | ], 5 * 60 |
|
55 | 15 | ); |
|
56 | 2 | }; |
|
57 | 17 | $this['app.user'] = $this->factory( |
|
58 | function ($app) { |
||
59 | 15 | return $app['app.session']->getUser(); |
|
60 | } |
||
61 | 17 | ); |
|
62 | $this['api.provider.user'] = function ($app) { |
||
63 | 9 | return new HttpBasicUserProvider($app['app.repository.user']); |
|
64 | }; |
||
65 | 17 | $this['api.user'] = $this->factory( |
|
66 | function ($app) { |
||
67 | 9 | return $this['api.provider.user']->getUser($app['app.request']); |
|
68 | 4 | } |
|
69 | 17 | ); |
|
70 | $this['twig.loader'] = function ($app) { |
||
71 | 15 | return new \Twig_Loader_Filesystem($app['app.views.dir']); |
|
72 | }; |
||
73 | $this['twig'] = function ($app) { |
||
74 | 15 | $twig = new \Twig_Environment( |
|
75 | 15 | $app['twig.loader'], [ |
|
76 | 15 | 'debug' => $app['debug'], |
|
77 | 15 | 'cache' => $this['app.cache.dir'].'/twig', |
|
78 | ] |
||
79 | 15 | ); |
|
80 | |||
81 | 15 | return $twig; |
|
82 | }; |
||
83 | $this['app.repository.user'] = function () { |
||
84 | 14 | return new UserRepository(); |
|
85 | }; |
||
86 | $this['app.controller.default'] = function ($app) { |
||
87 | 3 | return new DefaultController($app); |
|
88 | 2 | }; |
|
89 | $this['app.controller.security'] = function ($app) { |
||
90 | 5 | return new SecurityController($app); |
|
91 | }; |
||
92 | $this['app.controller.page'] = function ($app) { |
||
93 | 2 | return new PageController($app); |
|
94 | }; |
||
95 | $this['app.controller.api.user'] = function ($app) { |
||
96 | 7 | return new UserController($app); |
|
97 | }; |
||
98 | $this['api.response.negociator'] = function () { |
||
99 | 7 | return new ResponseHandler(new Negotiator()); |
|
100 | }; |
||
101 | $this['app.firewall'] = function () { |
||
102 | 15 | $firewall = new Firewall(); |
|
103 | 8 | $firewall->addRoute([], '/page/1', 'ROLE_PAGE_1'); |
|
104 | 8 | $firewall->addRoute([], '/page/2', 'ROLE_PAGE_2'); |
|
105 | 8 | $firewall->addRoute([], '/page/3', 'ROLE_PAGE_3'); |
|
106 | |||
107 | 8 | return $firewall; |
|
108 | 12 | }; |
|
109 | $this['api.firewall'] = function () { |
||
110 | 9 | $firewall = new Firewall(); |
|
111 | 9 | $firewall->addRoute('GET', '/api', 'ROLE_API_READ'); |
|
112 | |||
113 | 9 | return $firewall; |
|
114 | }; |
||
115 | $this['app.router'] = function ($app) { |
||
116 | 15 | return \FastRoute\simpleDispatcher( |
|
117 | 15 | function (\FastRoute\RouteCollector $router) { |
|
118 | 15 | $router->addRoute(['GET'], '/', ['default', 'index']); |
|
119 | 15 | $router->addRoute(['GET', 'POST'], '/login', ['security', 'index']); |
|
120 | 15 | $router->addRoute(['GET'], '/logout', ['security', 'logout']); |
|
121 | 15 | $router->addRoute(['GET'], '/page/{page:[1-3]}', ['page', 'index']); |
|
122 | 15 | $router->addRoute(['GET'], '/api/users', ['api.user', 'list']); |
|
123 | 15 | $router->addRoute(['GET'], '/api/users/{name}', ['api.user', 'get']); |
|
124 | 15 | $router->addRoute(['POST', 'PUT'], '/api/users/{name}', ['api.user', 'update']); |
|
125 | 15 | $router->addRoute(['DELETE'], '/api/users/{name}', ['api.user', 'delete']); |
|
126 | 15 | }, |
|
127 | [ |
||
128 | 15 | 'cacheFile' => $app['app.cache.dir'].'/route', |
|
129 | 15 | 'cacheDisabled' => $app['debug'], |
|
130 | ] |
||
131 | 15 | ); |
|
132 | }; |
||
133 | 17 | } |
|
134 | |||
135 | /** |
||
136 | * @param Request $request |
||
137 | * |
||
138 | * @return Response |
||
139 | */ |
||
140 | 17 | public function handle(Request $request) |
|
141 | { |
||
142 | 17 | $this['app.request'] = $request; |
|
143 | 17 | if ($this->isRequestApi($request->getUri())) { |
|
144 | 9 | $isGranted = $this['api.firewall']->isGranted($request->getMethod(), $request->getUri(), $this['api.user']); |
|
145 | 9 | if (!$isGranted) { |
|
146 | 2 | return new JsonResponse( |
|
147 | 2 | ['code' => Response::HTTP_UNAUTHORIZED, 'message' => 'Unauthorized'], |
|
0 ignored issues
–
show
|
|||
148 | Response::HTTP_UNAUTHORIZED |
||
149 | 2 | ); |
|
150 | } |
||
151 | 7 | } else { |
|
152 | 8 | $isGranted = $this['app.firewall']->isGranted($request->getMethod(), $request->getUri(), $this['app.user']); |
|
153 | 8 | if (!$isGranted) { |
|
154 | 2 | if ($this['app.user']) { |
|
155 | return new Response( |
||
156 | $this['twig']->render( |
||
157 | 'Error\\index.html.twig', |
||
158 | ['code' => Response::HTTP_UNAUTHORIZED, 'message' => 'Unauthorized'] |
||
159 | ), |
||
160 | Response::HTTP_UNAUTHORIZED |
||
161 | ); |
||
162 | } |
||
163 | 2 | $this['app.session']->set('app.redirect_on_login', $request->getUri()); |
|
164 | |||
165 | 2 | return new RedirectResponse('/login'); |
|
166 | } |
||
167 | } |
||
168 | |||
169 | try { |
||
170 | 15 | $routeInfo = $this['app.router']->dispatch($request->getMethod(), $request->getUri()); |
|
171 | 15 | switch ($routeInfo[0]) { |
|
172 | 15 | View Code Duplication | case \FastRoute\Dispatcher::NOT_FOUND: |
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
173 | 1 | return new Response( |
|
174 | 1 | $this['twig']->render( |
|
175 | 1 | 'Error\\index.html.twig', |
|
176 | [ |
||
177 | 1 | 'code' => 404, |
|
178 | 1 | 'message' => 'Not Found', |
|
179 | ] |
||
180 | 1 | ), |
|
181 | 1 | Response::HTTP_NOT_FOUND, |
|
182 | 1 | ['Content-Type' => 'text/html; charset=UTF-8'] |
|
183 | 1 | ); |
|
184 | 14 | View Code Duplication | case \FastRoute\Dispatcher::METHOD_NOT_ALLOWED: |
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
185 | 1 | return new Response( |
|
186 | 1 | $this['twig']->render( |
|
187 | 1 | 'Error\\index.html.twig', |
|
188 | [ |
||
189 | 1 | 'code' => 405, |
|
190 | 1 | 'message' => 'Not Allowed', |
|
191 | ] |
||
192 | 1 | ), |
|
193 | 1 | Response::HTTP_METHOD_NOT_ALLOWED, |
|
194 | 1 | ['Content-Type' => 'text/html; charset=UTF-8'] |
|
195 | 1 | ); |
|
196 | 13 | case \FastRoute\Dispatcher::FOUND: |
|
197 | 13 | default: |
|
198 | 13 | $handler = $routeInfo[1]; |
|
199 | 13 | $controller = 'app.controller.'.$handler[0]; |
|
200 | 13 | $method = $handler[1].'Action'; |
|
201 | 13 | $this['twig']->addGlobal('app_user', $this['app.user']); |
|
202 | |||
203 | 13 | return $this[$controller]->$method($request, $routeInfo[2]); |
|
204 | } |
||
205 | } catch (\Exception $e) { |
||
206 | $message = $this['debug'] ? $e->getMessage() : 'Internal Server Error'; |
||
207 | |||
208 | return new Response( |
||
209 | $this['twig']->render( |
||
210 | 'Error\\index.html.twig', |
||
211 | ['code' => 500, 'message' => $message] |
||
212 | ), |
||
213 | Response::HTTP_INTERNAL_SERVER_ERROR |
||
214 | ); |
||
215 | } |
||
216 | } |
||
217 | |||
218 | /** |
||
219 | * @param string $path |
||
220 | * |
||
221 | * @return bool |
||
222 | */ |
||
223 | 17 | protected function isRequestApi($path) |
|
224 | { |
||
225 | 17 | return substr($path, 0, 4) === '/api'; |
|
226 | } |
||
227 | } |
||
228 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: