dspbee /
pivasic
| Conditions | 4 |
| Paths | 4 |
| Total Lines | 31 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
| 1 | <?php |
||
| 23 | public function getResponse($packageRoot, Request $request) |
||
| 24 | { |
||
| 25 | $packageRoot = rtrim($packageRoot, '/'); |
||
| 26 | $route = preg_replace('/\/\d+/u', '/D', $request->route()); |
||
| 27 | $path = $packageRoot . '/Route/' . $route . '/' . $request->method() . '.php'; |
||
| 28 | if (file_exists($path)) { |
||
| 29 | require $path; |
||
| 30 | $controllerClass = $request->package() . '\\Route_' . str_replace('/', '_', $route) . '\\' . $request->method(); |
||
| 31 | /** |
||
| 32 | * @var BaseController $controller |
||
| 33 | */ |
||
| 34 | if (class_exists($controllerClass)) { |
||
| 35 | $controller = new $controllerClass($packageRoot, $request); |
||
|
|
|||
| 36 | } else { |
||
| 37 | throw new \RuntimeException(sprintf('The class "%s" does not exist', $controllerClass)); |
||
| 38 | } |
||
| 39 | |||
| 40 | /** |
||
| 41 | * Call handler. |
||
| 42 | */ |
||
| 43 | $handler = filter_input_array(INPUT_POST)['handler'] ?? filter_input_array(INPUT_GET)['handler'] ?? 'index'; |
||
| 44 | if (method_exists($controllerClass, $handler)) { |
||
| 45 | $controller->$handler(); |
||
| 46 | return $controller->getResponse(); |
||
| 47 | } else { |
||
| 48 | throw new \RuntimeException(sprintf('The method "%s" does not exist', $handler)); |
||
| 49 | } |
||
| 50 | } |
||
| 51 | |||
| 52 | return null; |
||
| 53 | } |
||
| 54 | } |
$controllerClasscan contain request data and is used in code execution context(s) leading to a potential security vulnerability.1 path for user data to reach this point
filter_input_array(INPUT_SERVER)['REQUEST_URI']seems to return tainted data, and$urlis assignedin src/Core/Request.php on line 25
$urlis passed through explode(), and$urlis assignedin src/Core/Request.php on line 33
$url[0]is passed through trim(), andtrim($url[0])is passed through trim(), and$urlis assignedin src/Core/Request.php on line 34
$urlis passed through explode(), and$partListis assignedin src/Core/Request.php on line 36
$partListis passed through implode(), and Request::$route is assignedin src/Core/Request.php on line 60
in src/Core/Request.php on line 109
$request->route()is passed through preg_replace(), and$routeis assignedin src/Core/DefaultRoute.php on line 26
$routeis passed through str_replace(), and$controllerClassis assignedin src/Core/DefaultRoute.php on line 30
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }For numeric data, we recommend to explicitly cast the data: