This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * @license MIT |
||
4 | */ |
||
5 | namespace Pivasic\Bundle\Template; |
||
6 | |||
7 | use Pivasic\Bundle\Template\Exception\FileNotFoundException; |
||
8 | |||
9 | /** |
||
10 | * Class Native |
||
11 | * @package Pivasic\Bundle\Template |
||
12 | */ |
||
13 | class Native |
||
14 | { |
||
15 | /** |
||
16 | * @param string $packageRoot |
||
17 | * @param string $language |
||
18 | * @param bool $cache |
||
19 | */ |
||
20 | public function __construct(string $packageRoot, string $language = '', bool $cache = true) |
||
21 | { |
||
22 | $this->packageRoot = rtrim($packageRoot, '/'); |
||
23 | $this->language = $language; |
||
24 | $this->cache = $cache; |
||
25 | $this->isRouteView = false; |
||
26 | $this->title = ''; |
||
27 | } |
||
28 | |||
29 | /** |
||
30 | * Create content from template and data. |
||
31 | * |
||
32 | * @param string $name |
||
33 | * @param array $data |
||
34 | * @return string |
||
35 | * @throws FileNotFoundException |
||
36 | * @throws \RuntimeException |
||
37 | */ |
||
38 | public function getContent(string $name, array $data = []): string |
||
39 | { |
||
40 | $cacheName = $name; |
||
41 | if ('' == $name) { |
||
42 | $this->isRouteView = true; |
||
43 | |||
44 | $stack = debug_backtrace(); |
||
45 | foreach ($stack as $item) { |
||
46 | if (false !== stripos($item['file'], DIRECTORY_SEPARATOR . 'Route' . DIRECTORY_SEPARATOR)) { |
||
47 | $cacheName = pathinfo($item['file'], PATHINFO_DIRNAME) . '/' . $name; |
||
48 | $cacheName = explode('Route' . DIRECTORY_SEPARATOR, $cacheName)[1]; |
||
49 | $cacheName = 'route_' . str_replace(['/', '\\'], '_', $cacheName); |
||
50 | break; |
||
51 | } |
||
52 | } |
||
53 | } |
||
54 | $cacheName .= '_' . $this->language . '.html.php'; |
||
55 | $path = $this->packageRoot . '/view/_cache/' . str_replace('/', '_', $cacheName); |
||
56 | |||
57 | $exist = file_exists($path); |
||
58 | if (!$this->cache || !$exist) { |
||
59 | $code = $this->compile($name . '/view.html.php', true, true, true); |
||
60 | |||
61 | $code = preg_replace(['/\>[^\S ]+/s', '/[^\S ]+\</s', '/(\s)+/s'], ['>', '<', '\\1'], $code); |
||
62 | |||
63 | if ($exist) { |
||
64 | $fh = fopen($path, 'r+b'); |
||
65 | } else { |
||
66 | $fh = fopen($path, 'wb'); |
||
67 | } |
||
68 | if (flock($fh, LOCK_EX)) { |
||
69 | ftruncate($fh, 0); |
||
70 | fwrite($fh, $code); |
||
71 | flock($fh, LOCK_UN); |
||
72 | } |
||
73 | fclose($fh); |
||
74 | } |
||
75 | |||
76 | $fh = fopen($path, 'rb'); |
||
77 | if (flock($fh, LOCK_SH)) { |
||
78 | $html = self::renderTemplate($path, $data); |
||
79 | |||
80 | flock($fh, LOCK_UN); |
||
81 | fclose($fh); |
||
82 | |||
83 | return $html; |
||
84 | } |
||
85 | |||
86 | throw new \RuntimeException('Can\'t render template'); |
||
87 | } |
||
88 | |||
89 | /** |
||
90 | * Create solid template. |
||
91 | * |
||
92 | * @param string $name |
||
93 | * @param bool $processLang |
||
94 | * @param bool $processInclude |
||
95 | * @param bool $processExtends |
||
96 | * @return string |
||
97 | * @throws FileNotFoundException |
||
98 | */ |
||
99 | private function compile(string $name, bool $processLang, bool $processInclude, bool $processExtends): string |
||
100 | { |
||
101 | if ($this->isRouteView) { |
||
102 | $this->isRouteView = false; |
||
103 | $path = ''; |
||
104 | $stack = debug_backtrace(); |
||
105 | foreach ($stack as $item) { |
||
106 | if (false !== stripos($item['file'], DIRECTORY_SEPARATOR . 'Route' . DIRECTORY_SEPARATOR)) { |
||
107 | $path = pathinfo($item['file'], PATHINFO_DIRNAME) . '/view.html.php'; |
||
108 | if ($processLang) { |
||
109 | $storagePath = str_replace('view.html.php', '_lang/' . $this->language . '.php', $path); |
||
110 | } |
||
111 | break; |
||
112 | } |
||
113 | } |
||
114 | } else { |
||
115 | $path = $this->packageRoot . '/view/' . $name; |
||
116 | if ($processLang) { |
||
117 | $storagePath = str_replace('view.html.php', '', $path) . '_lang/' . $this->language . '.php'; |
||
118 | } |
||
119 | } |
||
120 | |||
121 | if (file_exists($path)) { |
||
122 | ob_start(); |
||
123 | readfile($path); |
||
124 | $code = ob_get_clean(); |
||
125 | } else { |
||
126 | throw new FileNotFoundException($path); |
||
127 | } |
||
128 | |||
129 | if ($processLang && file_exists($storagePath)) { |
||
130 | $storage = include $storagePath; |
||
0 ignored issues
–
show
|
|||
131 | if ('' == $this->title) { |
||
132 | $this->title = $storage['title'] ?? ''; |
||
133 | } |
||
134 | preg_match_all('/<!-- lang (.*) -->/', $code, $matchList); |
||
135 | View Code Duplication | if (isset($matchList[1])) { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
136 | foreach ($matchList[1] as $key => $index) { |
||
137 | $name = explode('>', $index); |
||
138 | $default = trim($name[1] ?? ''); |
||
139 | $name = trim($name[0]); |
||
140 | if (!empty($matchList[0][$key]) && false !== strpos($code, $matchList[0][$key])) { |
||
141 | $code = str_replace($matchList[0][$key], $storage[$name] ?? $default, $code); |
||
142 | } |
||
143 | } |
||
144 | } |
||
145 | View Code Duplication | } else { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
146 | preg_match_all('/<!-- lang (.*) -->/', $code, $matchList); |
||
147 | if (isset($matchList[1])) { |
||
148 | foreach ($matchList[1] as $key => $index) { |
||
149 | $name = explode('>', $index); |
||
150 | $default = trim($name[1] ?? ''); |
||
151 | $name = trim($name[0]); |
||
152 | if (!empty($matchList[0][$key]) && false !== strpos($code, $matchList[0][$key])) { |
||
153 | $code = str_replace($matchList[0][$key], $this->$name ?? $default, $code); |
||
154 | } |
||
155 | } |
||
156 | } |
||
157 | } |
||
158 | |||
159 | if ($processInclude) { |
||
160 | preg_match_all('/<!-- include (.*) -->/', $code, $matchList); |
||
161 | if (isset($matchList[1])) { |
||
162 | foreach ($matchList[1] as $key => $template) { |
||
163 | if (!empty($matchList[0][$key]) && false !== strpos($code, $matchList[0][$key])) { |
||
164 | $template = trim($template); |
||
165 | $code = str_replace($matchList[0][$key], $this->compile($template . '/view.html.php', true, true, false), $code); |
||
166 | } |
||
167 | } |
||
168 | } |
||
169 | } |
||
170 | |||
171 | if ($processExtends) { |
||
172 | preg_match_all('/<!-- extends (.*) -->/', $code, $matchList); |
||
173 | if (isset($matchList[1][0])) { |
||
174 | $template = trim($matchList[1][0]); |
||
175 | $parentHtml = $this->compile($template . '/view.html.php', true, true, false); |
||
176 | |||
177 | $code = str_replace($matchList[0][0], '', $code); |
||
178 | $parentHtml = str_replace('<!-- section -->', $code, $parentHtml); |
||
179 | $code = $parentHtml; |
||
180 | } |
||
181 | } |
||
182 | |||
183 | return $code; |
||
184 | } |
||
185 | |||
186 | /** |
||
187 | * Safe include. Used for scope isolation. |
||
188 | * |
||
189 | * @param string $__file__ File to include |
||
190 | * @param array $data Data passed to template |
||
191 | * @return string |
||
192 | */ |
||
193 | private static function renderTemplate(string $__file__, array $data): string |
||
194 | { |
||
195 | ob_start(); |
||
196 | extract($data); |
||
197 | include $__file__; |
||
198 | return ob_get_clean(); |
||
199 | } |
||
200 | |||
201 | private $packageRoot; |
||
202 | private $language; |
||
203 | private $cache; |
||
204 | private $isRouteView; |
||
205 | |||
206 | private $title; |
||
207 | } |
If you define a variable conditionally, it can happen that it is not defined for all execution paths.
Let’s take a look at an example:
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined.
Available Fixes
Check for existence of the variable explicitly:
Define a default value for the variable:
Add a value for the missing path: