1 | <?php |
||
14 | class DefaultRoute |
||
15 | { |
||
16 | /** |
||
17 | * DefaultRoute constructor. |
||
18 | * |
||
19 | * @param string $packageRoot |
||
20 | * @param Request $request |
||
21 | */ |
||
22 | public function __construct($packageRoot, Request $request) |
||
48 | |||
49 | /** |
||
50 | * Get object of Response. |
||
51 | * |
||
52 | * @return Response|null |
||
53 | */ |
||
54 | public function getResponse() |
||
58 | |||
59 | private $response; |
||
60 | } |
$controllerClass
can contain request data and is used in code execution context(s) leading to a potential security vulnerability.General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: