DefaultRoute   A
last analyzed

Complexity

Total Complexity 4

Size/Duplication

Total Lines 42
Duplicated Lines 0 %

Coupling/Cohesion

Components 0
Dependencies 2

Importance

Changes 0
Metric Value
wmc 4
lcom 0
cbo 2
dl 0
loc 42
rs 10
c 0
b 0
f 0

1 Method

Rating   Name   Duplication   Size   Complexity  
A getResponse() 0 31 4
1
<?php
2
/**
3
 * @license MIT
4
 */
5
namespace Pivasic\Core;
6
7
use Pivasic\Core\Exception\RouteException;
8
9
/**
10
 * Base routing.
11
 *
12
 * Class DefaultRoute
13
 * @package Pivasic\Core
14
 */
15
class DefaultRoute implements IRoute
16
{
17
    /**
18
     * Find and call controller, get Response object.
19
     *
20
     * @param string $packageRoot
21
     * @param Request $request
22
     * @return Response
23
     * @throws RouteException
24
     */
25
    public function getResponse(string &$packageRoot, Request &$request): Response
26
    {
27
        $packageRoot = rtrim($packageRoot, '/');
28
        $route = preg_replace('/\/\d+/u', '/D', $request->route());
29
        $path = $packageRoot . '/Route/' . $route . '/' . $request->method() . '.php';
30
        if (file_exists($path)) {
31
            require $path;
32
            $controllerClass = $request->package() . '\\Route_' . str_replace('/', '_', $route) . '\\' . $request->method();
33
            /**
34
             * @var BaseController $controller
35
             */
36
            if (class_exists($controllerClass)) {
37
                $controller = new $controllerClass($packageRoot, $request);
0 ignored issues
show
Security Code Execution introduced by
$controllerClass can contain request data and is used in code execution context(s) leading to a potential security vulnerability.

1 path for user data to reach this point

  1. filter_input_array(INPUT_SERVER)['REQUEST_URI'] seems to return tainted data, and $url is assigned
    in src/Core/Request.php on line 25
  2. $url is passed through explode(), and $url is assigned
    in src/Core/Request.php on line 33
  3. $url[0] is passed through trim(), and trim($url[0]) is passed through trim(), and $url is assigned
    in src/Core/Request.php on line 34
  4. $url is passed through explode(), and $partList is assigned
    in src/Core/Request.php on line 36
  5. $partList is passed through implode(), and Request::$route is assigned
    in src/Core/Request.php on line 60
  6. Tainted property Request::$route is read
    in src/Core/Request.php on line 115
  7. Request::route() returns tainted data, and $request->route() is passed through preg_replace(), and $route is assigned
    in src/Core/DefaultRoute.php on line 28
  8. $route is passed through str_replace(), and $controllerClass is assigned
    in src/Core/DefaultRoute.php on line 32

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
38
            } else {
39
                throw new RouteException(sprintf('Route: the class "%s" does not exist', $controllerClass));
40
            }
41
42
            /**
43
             * Call handler.
44
             */
45
            $handler = filter_input_array(INPUT_POST)['handler'] ?? filter_input_array(INPUT_GET)['handler'] ?? 'index';
46
            if (method_exists($controllerClass, $handler)) {
47
                $controller->invoke($handler);
48
                return $controller->getResponse();
49
            } else {
50
                throw new RouteException(sprintf('Route: the method "%s" does not exist', $handler));
51
            }
52
        } else {
53
            throw new RouteException(sprintf('Route: path "%s" does not exist', $request->package() . '/Route/' . $route . '/' . $request->method() . '.php'));
54
        }
55
    }
56
}