| 1 | <?php |
||
| 14 | class DefaultRoute |
||
| 15 | { |
||
| 16 | /** |
||
| 17 | * DefaultRoute constructor. |
||
| 18 | * |
||
| 19 | * @param string $packageRoot |
||
| 20 | * @param Request $request |
||
| 21 | */ |
||
| 22 | public function __construct($packageRoot, Request $request) |
||
| 48 | |||
| 49 | /** |
||
| 50 | * Get object of Response. |
||
| 51 | * |
||
| 52 | * @return Response|null |
||
| 53 | */ |
||
| 54 | public function getResponse() |
||
| 58 | |||
| 59 | private $response; |
||
| 60 | } |
$controllerClasscan contain request data and is used in code execution context(s) leading to a potential security vulnerability.General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }For numeric data, we recommend to explicitly cast the data: