for testing and deploying your application
for finding and fixing issues
for empowering human code reviews
<?php
/**
* @license MIT
* @author Igor Sorokin <[email protected]>
*/
namespace Dspbee\Core;
* Base routing.
*
* Class DefaultRoute
* @package Dspbee\Core
class DefaultRoute
{
* DefaultRoute constructor.
* @param string $packageRoot
* @param Request $request
public function __construct($packageRoot, Request $request)
$this->response = null;
$packageRoot = rtrim($packageRoot, '/');
$path = $packageRoot . '/Route/' . $request->route() . '/' . $request->method() . '.php';
if (file_exists($path)) {
require $path;
$controllerClass = $request->package() . '\\Route_' . str_replace('/', '_', $request->route()) . '\\' . $request->method();
* @var BaseController $controller
$controller = new $controllerClass($packageRoot, $request);
$controllerClass
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }
For numeric data, we recommend to explicitly cast the data:
$sanitized = (integer) $tainted;
* Call handler.
$handler = $_POST['handler'] ?? $_GET['handler'] ?? 'index';
$handler = str_replace('.', '', $handler);
if (method_exists($controllerClass, $handler)) {
$controller->$handler();
$handler
$this->response = $controller->getResponse();
}
* Get object of Response.
* @return Response|null
public function getResponse()
return $this->response;
private $response;
dspbee /
pivasic
Loading history...
$controllerClasscan contain request data and is used in code execution context(s) leading to a potential security vulnerability.General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }For numeric data, we recommend to explicitly cast the data: