This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /* |
||
3 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
||
4 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
||
5 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
||
6 | * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
||
7 | * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
||
8 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
||
9 | * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
||
10 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
||
11 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
||
12 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
||
13 | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
||
14 | * |
||
15 | * This software consists of voluntary contributions made by many individuals |
||
16 | * and is licensed under the MIT license. |
||
17 | */ |
||
18 | namespace Elastification\Client\Serializer; |
||
19 | |||
20 | use Elastification\Client\Serializer\Exception\DeserializationFailureException; |
||
21 | use Elastification\Client\Serializer\Gateway\GatewayInterface; |
||
22 | use Elastification\Client\Serializer\Gateway\NativeObjectGateway; |
||
23 | use Elastification\Client\Serializer\JmsSerializer\SourceSubscribingHandler; |
||
24 | use JMS\Serializer\Context; |
||
25 | use JMS\Serializer\DeserializationContext; |
||
26 | use JMS\Serializer\SerializationContext; |
||
27 | use JMS\Serializer\Serializer; |
||
28 | |||
29 | /** |
||
30 | * JMS Serializer. |
||
31 | * |
||
32 | * In order to use this DeSer mechanism you need to register a custom handler |
||
33 | * at the build time of your Serializer instance. As this cannot be influenced |
||
34 | * after the building process has finished, you need to do it yourself. |
||
35 | * |
||
36 | * Please have a look at the handler here {@see |
||
37 | * Elastification\Client\Serializer\JmsSerializer\SourceSubscribingHandler} |
||
38 | * and please have a look at the test here {@see Elastification\Client\Tests\Unit\Serializer\JmsSerializerTest}, esp. |
||
39 | * the setUp method tells you how to register this handler. You can pass the class to use for _source serialization |
||
40 | * into the constructor of the handler class. |
||
41 | * |
||
42 | * @package Elastification\Client\Serializer |
||
43 | * @author Mario Mueller |
||
44 | */ |
||
45 | class JmsSerializer implements SerializerInterface |
||
46 | { |
||
47 | /** |
||
48 | * @var string |
||
49 | */ |
||
50 | const SERIALIZER_FORMAT = 'json'; |
||
51 | |||
52 | /** |
||
53 | * This class is used to deserialize the response. |
||
54 | * This entity should only care about the elasticsearch part of the |
||
55 | * response, not about the source part or the results underneath hits->hits. |
||
56 | * |
||
57 | * @var string |
||
58 | */ |
||
59 | private $deserializerClass = 'Elastification\Client\Serializer\JmsSerializer\SearchResponseEntity'; |
||
60 | |||
61 | /** |
||
62 | * @var Serializer |
||
63 | */ |
||
64 | private $jms; |
||
65 | |||
66 | /** |
||
67 | * @var SerializationContext |
||
68 | */ |
||
69 | private $jmsSerializeContext; |
||
70 | |||
71 | /** |
||
72 | * @var DeserializationContext |
||
73 | */ |
||
74 | private $jmsDeserializeContext; |
||
75 | /** |
||
76 | * |
||
77 | * @var array |
||
78 | */ |
||
79 | private $indexTypeClassMap; |
||
80 | /** |
||
81 | * |
||
82 | * @var SourceSubscribingHandler |
||
83 | */ |
||
84 | private $handler; |
||
85 | |||
86 | /** |
||
87 | * @param Serializer $jms |
||
88 | * @param SourceSubscribingHandler $handler This must be the same instance as the one you used for the |
||
89 | * init of the Serializer |
||
90 | * @param array $indexTypeClassMap Represents an array of ['indexName' => ['typeName' => |
||
91 | * 'SourceClassName']] |
||
92 | */ |
||
93 | 9 | function __construct(Serializer $jms, SourceSubscribingHandler $handler, array $indexTypeClassMap) |
|
0 ignored issues
–
show
|
|||
94 | { |
||
95 | 9 | $this->jms = $jms; |
|
96 | 9 | $this->indexTypeClassMap = $indexTypeClassMap; |
|
97 | 9 | $this->handler = $handler; |
|
98 | 9 | } |
|
99 | |||
100 | /** |
||
101 | * Serializes given data to string |
||
102 | * |
||
103 | * @param mixed $data |
||
104 | * @param array $params |
||
105 | * |
||
106 | * @return string |
||
107 | */ |
||
108 | 4 | public function serialize($data, array $params = array()) |
|
109 | { |
||
110 | 4 | return $this->jms->serialize( |
|
111 | 4 | $data, |
|
112 | 4 | self::SERIALIZER_FORMAT, |
|
113 | 4 | $this->determineContext($this->jmsSerializeContext, $params) |
|
0 ignored issues
–
show
It seems like
$this->determineContext(...ializeContext, $params) targeting Elastification\Client\Se...zer::determineContext() can also be of type object<JMS\Serializer\Context> ; however, JMS\Serializer\Serializer::serialize() does only seem to accept null|object<JMS\Serializer\SerializationContext> , maybe add an additional type check?
This check looks at variables that are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. ![]() |
|||
114 | 4 | ); |
|
115 | } |
||
116 | |||
117 | /** |
||
118 | * Deserializes given data to array or object |
||
119 | * |
||
120 | * @param string $data |
||
121 | * @param array $params |
||
122 | * |
||
123 | * @return GatewayInterface |
||
124 | */ |
||
125 | 4 | public function deserialize($data, array $params = array()) |
|
126 | { |
||
127 | 4 | $sourceClass = $this->getSourceClassFromMapping($params); |
|
128 | 4 | $this->handler->setSourceDeSerClass($sourceClass); |
|
129 | |||
130 | 4 | return new NativeObjectGateway( |
|
131 | 4 | $this->jms->deserialize( |
|
132 | 4 | $data, |
|
133 | 4 | $this->deserializerClass, |
|
134 | 4 | self::SERIALIZER_FORMAT, |
|
135 | 4 | $this->determineContext($this->jmsDeserializeContext, $params) |
|
0 ignored issues
–
show
It seems like
$this->determineContext(...ializeContext, $params) targeting Elastification\Client\Se...zer::determineContext() can also be of type object<JMS\Serializer\Context> ; however, JMS\Serializer\Serializer::deserialize() does only seem to accept null|object<JMS\Serializ...DeserializationContext> , maybe add an additional type check?
This check looks at variables that are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. ![]() |
|||
136 | 4 | ) |
|
137 | 4 | ); |
|
138 | } |
||
139 | |||
140 | /** |
||
141 | * gets the source class. |
||
142 | * |
||
143 | * @param array $params |
||
144 | * |
||
145 | * @return string |
||
146 | * @author Daniel Wendlandt |
||
147 | */ |
||
148 | 4 | private function getSourceClassFromMapping(array $params) |
|
149 | { |
||
150 | 4 | $index = $params['index']; |
|
151 | 4 | $type = $params['type']; |
|
152 | 4 | if (!isset($this->indexTypeClassMap[$index])) { |
|
153 | throw new DeserializationFailureException('Cannot find index in source class map: ' . $index); |
||
154 | } |
||
155 | |||
156 | 4 | if (!isset($this->indexTypeClassMap[$index][$type])) { |
|
157 | throw new DeserializationFailureException( |
||
158 | 'Cannot find type in source class map: ' . $type . ' in index ' . $index |
||
159 | ); |
||
160 | } |
||
161 | |||
162 | 4 | return $this->indexTypeClassMap[$index][$type]; |
|
163 | } |
||
164 | |||
165 | /** |
||
166 | * Simple rule: Use internal if present but let params override any internal. |
||
167 | * |
||
168 | * @param Context $internalProperty |
||
169 | * @param array $params |
||
170 | * |
||
171 | * @return Context|null |
||
172 | * @author Mario Mueller |
||
173 | */ |
||
174 | 8 | private function determineContext($internalProperty, array $params) |
|
175 | { |
||
176 | 8 | $ctx = null; |
|
177 | 8 | if ($internalProperty !== null && isset($params['ctx']) !== true) { |
|
178 | // We need to clone it as jms contexts are not reusable. |
||
179 | 2 | $ctx = clone $internalProperty; |
|
180 | 2 | } |
|
181 | |||
182 | // When a passed context exists, override the internal one |
||
183 | 8 | if (isset($params['ctx']) === true) { |
|
184 | 4 | $ctx = $params['ctx']; |
|
185 | 4 | } |
|
186 | |||
187 | 8 | return $ctx; |
|
188 | } |
||
189 | |||
190 | /** |
||
191 | * @return SerializationContext |
||
192 | * @author Mario Mueller (autogenerated code) |
||
193 | */ |
||
194 | 1 | public function getJmsSerializeContext() |
|
195 | { |
||
196 | 1 | return $this->jmsSerializeContext; |
|
197 | } |
||
198 | |||
199 | /** |
||
200 | * @param SerializationContext $jmsContext |
||
201 | * |
||
202 | * @return void |
||
203 | * @author Mario Mueller (autogenerated code) |
||
204 | */ |
||
205 | 3 | public function setJmsSerializeContext(SerializationContext $jmsContext) |
|
206 | { |
||
207 | 3 | $this->jmsSerializeContext = $jmsContext; |
|
208 | 3 | } |
|
209 | |||
210 | /** |
||
211 | * @return DeserializationContext |
||
212 | * @author Mario Mueller (autogenerated code) |
||
213 | */ |
||
214 | 1 | public function getJmsDeserializeContext() |
|
215 | { |
||
216 | 1 | return $this->jmsDeserializeContext; |
|
217 | } |
||
218 | |||
219 | /** |
||
220 | * @param DeserializationContext $jmsDeserializeContext |
||
221 | * |
||
222 | * @return void |
||
223 | * @author Mario Mueller (autogenerated code) |
||
224 | */ |
||
225 | 3 | public function setJmsDeserializeContext($jmsDeserializeContext) |
|
226 | { |
||
227 | 3 | $this->jmsDeserializeContext = $jmsDeserializeContext; |
|
228 | 3 | } |
|
229 | |||
230 | /** |
||
231 | * @return string |
||
232 | * @author Mario Mueller (autogenerated code) |
||
233 | */ |
||
234 | 1 | public function getDeserializerClass() |
|
235 | { |
||
236 | 1 | return $this->deserializerClass; |
|
237 | } |
||
238 | |||
239 | /** |
||
240 | * @param string $deserializerClass |
||
241 | * |
||
242 | * @return void |
||
243 | * @author Mario Mueller (autogenerated code) |
||
244 | */ |
||
245 | 1 | public function setDeserializerClass($deserializerClass) |
|
246 | { |
||
247 | 1 | $this->deserializerClass = $deserializerClass; |
|
248 | 1 | } |
|
249 | } |
||
250 |
Adding explicit visibility (
private
,protected
, orpublic
) is generally recommend to communicate to other developers how, and from where this method is intended to be used.