Issues in Parser.php (master) - Issues in master - eserozvataf/scabbia2-yaml - Measure and Improve Code Quality continuously with Scrutinizer

Issues (37)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Yaml/Parser.php (16 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/**
 * Scabbia2 Yaml Component
 * https://github.com/eserozvataf/scabbia2
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 *
 * @link        https://github.com/eserozvataf/scabbia2-yaml for the canonical source repository
 * @copyright   2010-2016 Eser Ozvataf. (http://eser.ozvataf.com/)
 * @license     http://www.apache.org/licenses/LICENSE-2.0 - Apache License, Version 2.0
 *
 * -------------------------
 * Portions of this code are from Symfony YAML Component under the MIT license.
 *
 * (c) Fabien Potencier <[email protected]>
 *
 * For the full copyright and license information, please view the LICENSE-MIT
 * file that was distributed with this source code.
 *
 * Modifications made:
 * - Scabbia Framework code styles applied.
 * - All dump methods are moved under Dumper class.
 * - Redundant classes removed.
 * - Namespace changed.
 * - Tests ported to Scabbia2.
 * - Encoding checks removed.
 */

namespace Scabbia\Yaml;

use Scabbia\Yaml\Inline;
use Scabbia\Yaml\ParseException;

/**
 * Parser parses YAML strings to convert them to PHP arrays
 *
 * @package     Scabbia\Yaml
 * @author      Fabien Potencier <[email protected]>
 * @author      Eser Ozvataf <[email protected]>
 * @since       2.0.0
 */
class Parser
{
    /** @type string BLOCK_SCALAR_HEADER_PATTERN */
    const BLOCK_SCALAR_HEADER_PATTERN =
        "(?P<separator>\\||>)(?P<modifiers>\\+|\\-|\\d+|\\+\\d+|\\-\\d+|\\d+\\+|\\d+\\-)?(?P<comments> +#.*)?";


    /** @type int $offset */
    protected $offset         = 0;
    /** @type array $lines */
    protected $lines          = [];
    /** @type int $currentLineNb */
    protected $currentLineNb  = -1;
    /** @type string $currentLine */
    protected $currentLine    = "";
    /** @type array $refs */
    protected $refs           = [];


    /**
     * Constructor
     *
     * @param int $offset The offset of YAML document (used for line numbers in error messages)
     *
     * @return Parser

     */
    public function __construct($offset = 0)
    {
        $this->offset = $offset;
    }

    /**
     * Parses a YAML string to a PHP value
     *
     * @param string  $value                  A YAML string
     *
     * @throws ParseException If the YAML is not valid
     * @return mixed  A PHP value
     */
    public function parse($value)
    {
        $this->currentLineNb = -1;
        $this->currentLine = "";
        $value = $this->cleanup($value);
        $this->lines = explode("\n", $value);

        $data = [];
        $context = null;
        while ($this->moveToNextLine()) {
            if ($this->isCurrentLineEmpty()) {
                continue;
            }

            // tab?
            if ($this->currentLine[0] === "\t") {
                throw new ParseException(
                    "A YAML file cannot contain tabs as indentation.",
                    $this->getRealCurrentLineNb() + 1,
                    $this->currentLine
                );
            }

            $isRef = false;
            $isInPlace = false;
            $isProcessed = false;
            if (preg_match("#^\\-((?P<leadspaces>\\s+)(?P<value>.+?))?\\s*$#u", $this->currentLine, $values)) {
                if ($context && $context === "mapping") {
''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
                    throw new ParseException("You cannot define a sequence item when in a mapping");
                }
                $context = "sequence";

                if (isset($values["value"]) &&

                    preg_match("#^&(?P<ref>[^ ]+) *(?P<value>.*)#u", $values["value"], $matches)) {
                    $isRef = $matches["ref"];
                    $values["value"] = $matches["value"];
                }

                // array
                if (!isset($values["value"]) || trim($values["value"], " ") === "" ||
                    strpos(ltrim($values["value"], " "), "#") === 0) {
                    $c = $this->getRealCurrentLineNb() + 1;
                    $parser = new static($c);
                    $parser->refs =& $this->refs;
                    $data[] = $parser->parse($this->getNextEmbedBlock(null, true));
                } else {
                    if (isset($values["leadspaces"])
                        && preg_match(
                            "#^(?P<key>" .
                            Inline::REGEX_QUOTED_STRING .
                            "|[^ '\"\\{\\[].*?) *\\:(\\s+(?P<value>.+?))?\\s*$#u",
                            $values["value"],
                            $matches
                        )
                    ) {
                        // this is a compact notation element, add to next block and parse
                        $c = $this->getRealCurrentLineNb();
                        $parser = new static($c);
                        $parser->refs =& $this->refs;

                        $block = $values["value"];
                        if ($this->isNextLineIndented()) {
                            $block .= "\n" . $this->getNextEmbedBlock($this->getCurrentLineIndentation() + strlen($values["leadspaces"]) + 1);
                        }

                        $data[] = $parser->parse($block);
                    } else {
                        $data[] = $this->parseValue($values["value"], $context);
                    }
                }

                if ($isRef) {
''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
                    $this->refs[$isRef] = end($data);
                }
            } elseif (preg_match(
                "#^(?P<key>" .
                Inline::REGEX_QUOTED_STRING .
                "|[^ '\"\\[\\{].*?) *\\:(\\s+(?P<value>.+?))?\\s*$#u",
                $this->currentLine,
                $values
            ) && (strpos($values["key"], " #") === false || in_array($values["key"][0], ["\"", "'"]))) {
                if ($context && $context === "sequence") {
''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
                    throw new ParseException("You cannot define a mapping item when in a sequence");
                }
                $context = "mapping";

                // force correct settings
                Inline::parse(null, $this->refs);
                try {
                    $key = Inline::parseScalar($values["key"]);
                } catch (ParseException $e) {
                    $e->setParsedLine($this->getRealCurrentLineNb() + 1);
                    $e->setSnippet($this->currentLine);

                    throw $e;
                }

                // Convert float keys to strings, to avoid being converted to integers by PHP
                if (is_float($key)) {
                    $key = (string)$key;
                }

                if ($key === "<<") {
                    if (isset($values["value"]) && strpos($values["value"], "*") === 0) {
                        $isInPlace = substr($values["value"], 1);
                        if (!array_key_exists($isInPlace, $this->refs)) {
                            throw new ParseException(
                                sprintf(
                                    "Reference \"%s\" does not exist.",
                                    $isInPlace
                                ),
                                $this->getRealCurrentLineNb() + 1,
                                $this->currentLine
                            );
                        }
                    } else {
                        if (isset($values["value"]) && $values["value"] !== "") {
                            $value = $values["value"];
                        } else {
                            $value = $this->getNextEmbedBlock();
                        }

                        $c = $this->getRealCurrentLineNb() + 1;
                        $parser = new static($c);
                        $parser->refs =& $this->refs;
                        $parsed = $parser->parse($value);

                        $merged = [];
                        if (!is_array($parsed)) {
                            throw new ParseException(
                                "YAML merge keys used with a scalar value instead of an array.",
                                $this->getRealCurrentLineNb() + 1,
                                $this->currentLine
                            );
                        } elseif (isset($parsed[0])) {
                            // Numeric array, merge individual elements
                            foreach (array_reverse($parsed) as $parsedItem) {
                                if (!is_array($parsedItem)) {
                                    throw new ParseException(
                                        "Merge items must be arrays.",
                                        $this->getRealCurrentLineNb() + 1,
                                        $parsedItem
                                    );
                                }
                                $merged = array_merge($parsedItem, $merged);
                            }
                        } else {
                            // Associative array, merge
                            $merged = array_merge($merged, $parsed);
                        }

                        $isProcessed = $merged;
                    }
                } elseif (isset($values["value"]) &&

                    preg_match("#^&(?P<ref>[^ ]+) *(?P<value>.*)#u", $values["value"], $matches)) {
                    $isRef = $matches["ref"];
                    $values["value"] = $matches["value"];
                }

                if ($isProcessed) {
                    // Merge keys
                    $data = $isProcessed;
                } elseif (!isset($values["value"]) ||
                    trim($values["value"], " ") === "" ||
                    strpos(ltrim($values["value"], " "), "#") === 0) {
                    // if next line is less indented or equal, then it means that the current value is null
                    if (!$this->isNextLineIndented() && !$this->isNextLineUnIndentedCollection()) {
                        $data[$key] = null;
                    } else {
                        $c = $this->getRealCurrentLineNb() + 1;
                        $parser = new static($c);
                        $parser->refs =& $this->refs;
                        $data[$key] = $parser->parse($this->getNextEmbedBlock());
                    }
                } else {
                    if ($isInPlace) {
''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
                        $data = $this->refs[$isInPlace];
                    } else {
                        $data[$key] = $this->parseValue($values["value"], $context);
                    }
                }

                if ($isRef) {
''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
                    $this->refs[$isRef] = $data[$key];
                }
            } else {
                // multiple documents are not supported
                if ($this->currentLine === "---") {
                    throw new ParseException("Multiple documents are not supported.");
                }

                // 1-liner optionally followed by newline(s)
                if (is_string($value) && $this->lines[0] === trim($value)) {
                    try {
                        $value = Inline::parse($this->lines[0], $this->refs);
                    } catch (ParseException $e) {
                        $e->setParsedLine($this->getRealCurrentLineNb() + 1);
                        $e->setSnippet($this->currentLine);

                        throw $e;
                    }

                    if (is_array($value)) {
                        $first = reset($value);
                        if (is_string($first) && strpos($first, "*") === 0) {
                            $data = [];
                            foreach ($value as $alias) {
                                $data[] = $this->refs[substr($alias, 1)];
                            }
                            $value = $data;
                        }
                    }

                    return $value;
                }

                switch (preg_last_error()) {
                    case PREG_INTERNAL_ERROR:
                        $error = "Internal PCRE error.";
                        break;
                    case PREG_BACKTRACK_LIMIT_ERROR:
                        $error = "pcre.backtrack_limit reached.";
                        break;
                    case PREG_RECURSION_LIMIT_ERROR:
                        $error = "pcre.recursion_limit reached.";
                        break;
                    case PREG_BAD_UTF8_ERROR:
                        $error = "Malformed UTF-8 data.";
                        break;
                    case PREG_BAD_UTF8_OFFSET_ERROR:
                        $error = "Offset doesn't correspond to the begin of a valid UTF-8 code point.";
                        break;
                    default:
                        $error = "Unable to parse.";
                }

                throw new ParseException($error, $this->getRealCurrentLineNb() + 1, $this->currentLine);
            }

            if ($isRef) {
''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
                $this->refs[$isRef] = end($data);
            }
        }

        if (count($data) === 0) {
            return null;
        }

        return $data;
    }

    /**
     * Returns the current line number (takes the offset into account)
     *
     * @return int The current line number
     */
    protected function getRealCurrentLineNb()
    {
        return $this->currentLineNb + $this->offset;
    }

    /**
     * Returns the current line indentation
     *
     * @return int The current line indentation
     */
    protected function getCurrentLineIndentation()
    {
        return strlen($this->currentLine) - strlen(ltrim($this->currentLine, " "));
    }

    /**
     * Returns the next embed block of YAML
     *
     * @param int  $indentation The indent level at which the block is to be read, or null for default
     * @param bool $inSequence  True if the enclosing data structure is a sequence
     *
     * @throws ParseException When indentation problem are detected
     * @return string A YAML string
     */
    protected function getNextEmbedBlock($indentation = null, $inSequence = false)
    {
        $oldLineIndentation = $this->getCurrentLineIndentation();
        $blockScalarIndentations = [];

        if ($this->isBlockScalarHeader()) {
            $blockScalarIndentations[] = $this->getCurrentLineIndentation();
        }

        if (!$this->moveToNextLine()) {
            return;
        }

        if ($indentation === null) {
            $newIndent = $this->getCurrentLineIndentation();

            $unindentedEmbedBlock = $this->isStringUnIndentedCollectionItem();

            if (!$this->isCurrentLineEmpty() && $newIndent === 0 && !$unindentedEmbedBlock) {
                throw new ParseException("Indentation problem.", $this->getRealCurrentLineNb() + 1, $this->currentLine);
            }
        } else {
            $newIndent = $indentation;
        }

        $data = [];
        if ($this->getCurrentLineIndentation() >= $newIndent) {
            $data[] = substr($this->currentLine, $newIndent);
        } else {
            $this->moveToPreviousLine();
            return;
        }

        if ($inSequence && $oldLineIndentation === $newIndent && isset($data[0][0]) && $data[0][0] === "-") {
            // the previous line contained a dash but no item content, this line is a sequence item
            // with the same indentation and therefore no nested list or mapping
            $this->moveToPreviousLine();

            return;
        }

        $isItUnindentedCollection = $this->isStringUnIndentedCollectionItem();

        if (empty($blockScalarIndentations) && $this->isBlockScalarHeader()) {
            $blockScalarIndentations[] = $this->getCurrentLineIndentation();
        }

        $previousLineIndentation = $this->getCurrentLineIndentation();

        while ($this->moveToNextLine()) {
            $indent = $this->getCurrentLineIndentation();

            // terminate all block scalars that are more indented than the current line
            if (!empty($blockScalarIndentations) && $indent < $previousLineIndentation && rtrim($this->currentLine) !== "") {
                foreach ($blockScalarIndentations as $key => $blockScalarIndentation) {
                    if ($blockScalarIndentation >= $this->getCurrentLineIndentation()) {
                        unset($blockScalarIndentations[$key]);
                    }
                }
            }

            if (empty($blockScalarIndentations) && !$this->isCurrentLineComment() && $this->isBlockScalarHeader()) {
                $blockScalarIndentations[] = $this->getCurrentLineIndentation();
            }

            $previousLineIndentation = $indent;

            if ($isItUnindentedCollection && !$this->isStringUnIndentedCollectionItem() && $newIndent === $indent) {
                $this->moveToPreviousLine();
                break;
            }

            if ($this->isCurrentLineBlank()) {
                $data[] = substr($this->currentLine, $newIndent);
                continue;
            }

            // we ignore "comment" lines only when we are not inside a scalar block
            if (empty($blockScalarIndentations) && $this->isCurrentLineComment()) {
                continue;
            }

            if ($indent >= $newIndent) {
                $data[] = substr($this->currentLine, $newIndent);
            } elseif ($indent === 0) {
                $this->moveToPreviousLine();

                break;
            } else {
                throw new ParseException("Indentation problem.", $this->getRealCurrentLineNb() + 1, $this->currentLine);
            }
        }

        return implode("\n", $data);
    }

    /**
     * Moves the parser to the next line
     *
     * @return bool
     */
    protected function moveToNextLine()
    {
        if ($this->currentLineNb >= count($this->lines) - 1) {
            return false;
        }

        $this->currentLine = $this->lines[++$this->currentLineNb];

        return true;
    }

    /**
     * Moves the parser to the previous line
     *
     * @return void
     */
    protected function moveToPreviousLine()
    {
        $this->currentLine = $this->lines[--$this->currentLineNb];
    }

    /**
     * Parses a YAML value
     *
     * @param string  $value                  A YAML value
     * @param string $context                 The parser context (either sequence or mapping)
     *
     * @throws ParseException When reference does not exist
     * @return mixed  A PHP value
     */
    protected function parseValue($value, $context)
    {
        if (strpos($value, "*") === 0) {
            if (($pos = strpos($value, "#")) !== false) {

                $value = substr($value, 1, $pos - 2);
            } else {
                $value = substr($value, 1);
            }

            if (!array_key_exists($value, $this->refs)) {
                throw new ParseException(sprintf("Reference \"%s\" does not exist.", $value), $this->currentLine);
            }

            return $this->refs[$value];
        }

        if (preg_match("/^" . self::BLOCK_SCALAR_HEADER_PATTERN . "$/", $value, $matches)) {
            $modifiers = isset($matches["modifiers"]) ? $matches["modifiers"] : "";

            return $this->parseBlockScalar(
                $matches["separator"],
                preg_replace("#\\d+#", "", $modifiers),
                (int)abs($modifiers)
            );
        }

        try {
            $parsedValue = Inline::parse($value, $this->refs);

            if ($context === "mapping" && $value[0] !== "\"" && $value[0] !== "'" && $value[0] !== "[" && $value[0] !== "{" && $value[0] !== "!" && strpos($parsedValue, ": ") !== false) {
                throw new ParseException("A colon cannot be used in an unquoted mapping value.");
            }

            return $parsedValue;
        } catch (ParseException $e) {
            $e->setParsedLine($this->getRealCurrentLineNb() + 1);
            $e->setSnippet($this->currentLine);

            throw $e;
        }
    }

    /**
     * Parses a block scalar
     *
     * @param string  $separator   The style indicator that was used to begin this block scalar (| or >)
/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}
     * @param string  $indicator   The chomping indicator that was used to begin this block scalar (+ or -)
/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}
     * @param int     $indentation The indentation indicator that was used to begin this block scalar
     *
     * @return string  The text value
     */
    protected function parseBlockScalar($style, $chomping = "", $indentation = 0)
    {
        $notEOF = $this->moveToNextLine();
        if (!$notEOF) {
            return "";
        }

        $isCurrentLineBlank = $this->isCurrentLineBlank();
        $blockLines = [];

        // leading blank lines are consumed before determining indentation
        while ($notEOF && $isCurrentLineBlank) {
            // newline only if not EOF
            if ($notEOF = $this->moveToNextLine()) {
                $blockLines[] = "";
                $isCurrentLineBlank = $this->isCurrentLineBlank();
            }
        }

        // determine indentation if not specified
        if ($indentation === 0) {
            if (preg_match("/^ +/", $this->currentLine, $matches)) {
                $indentation = strlen($matches[0]);
            }
        }

        if ($indentation > 0) {
            $pattern = sprintf("/^ {%d}(.*)$/", $indentation);

            while ($notEOF && ($isCurrentLineBlank || preg_match($pattern, $this->currentLine, $matches))) {
                if ($isCurrentLineBlank && strlen($this->currentLine) > $indentation) {
                    $blockLines[] = substr($this->currentLine, $indentation);
                } elseif ($isCurrentLineBlank) {
                    $blockLines[] = "";
                } else {
                    $blockLines[] = $matches[1];
function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}
                }

                // newline only if not EOF
                if ($notEOF = $this->moveToNextLine()) {
                    $isCurrentLineBlank = $this->isCurrentLineBlank();
                }
            }
        } elseif ($notEOF) {
            $blockLines[] = "";
        }

        if ($notEOF) {
            $blockLines[] = "";
            $this->moveToPreviousLine();
        }

        // folded style
        if ($style === ">") {
            $text = "";
            $previousLineIndented = false;
            $previousLineBlank = false;

            for ($i = 0; $i < count($blockLines); ++$i) {
for ($i=0; $i<count($array); $i++) { // calls count() on each iteration
}

// Better
for ($i=0, $c=count($array); $i<$c; $i++) { // calls count() just once
}
                if ($blockLines[$i] === "") {
                    $text .= "\n";
                    $previousLineIndented = false;
                    $previousLineBlank = true;
                } elseif ($blockLines[$i][0] === " ") {
                    $text .= "\n" . $blockLines[$i];
                    $previousLineIndented = true;
                    $previousLineBlank = false;
                } elseif ($previousLineIndented) {

                    $text .= "\n" . $blockLines[$i];
                    $previousLineIndented = false;
                    $previousLineBlank = false;
                } elseif ($previousLineBlank || 0 === $i) {
                    $text .= $blockLines[$i];
                    $previousLineIndented = false;
                    $previousLineBlank = false;
                } else {

                    $text .= " " . $blockLines[$i];
                    $previousLineIndented = false;
                    $previousLineBlank = false;
                }
            }
        } else {
            $text = implode("\n", $blockLines);
        }

        // deal with trailing newlines
        if ($chomping === "") {
            $text = preg_replace("/\\n+$/", "\n", $text);
        } elseif ($chomping === "-") {
            $text = preg_replace("/\\n+$/", "", $text);
        }

        return $text;
    }

    /**
     * Returns true if the next line is indented
     *
     * @return bool Returns true if the next line is indented, false otherwise
     */
    protected function isNextLineIndented()
    {
        $currentIndentation = $this->getCurrentLineIndentation();
        $EOF = !$this->moveToNextLine();

        while (!$EOF && $this->isCurrentLineEmpty()) {
            $EOF = !$this->moveToNextLine();
        }

        if ($EOF) {
            return false;
        }

        $ret = false;
        if ($this->getCurrentLineIndentation() > $currentIndentation) {
            $ret = true;
        }

        $this->moveToPreviousLine();

        return $ret;
    }

    /**
     * Returns true if the current line is blank or if it is a comment line
     *
     * @return bool Returns true if the current line is empty or if it is a comment line, false otherwise
     */
    protected function isCurrentLineEmpty()
    {
        return $this->isCurrentLineBlank() || $this->isCurrentLineComment();
    }

    /**
     * Returns true if the current line is blank
     *
     * @return bool Returns true if the current line is blank, false otherwise
     */
    protected function isCurrentLineBlank()
    {
        return trim($this->currentLine, " ") === "";
    }

    /**
     * Returns true if the current line is a comment line
     *
     * @return bool Returns true if the current line is a comment line, false otherwise
     */
    protected function isCurrentLineComment()
    {
        //checking explicitly the first char of the trim is faster than loops or strpos
        $ltrimmedLine = ltrim($this->currentLine, " ");

        return $ltrimmedLine !== "" && $ltrimmedLine[0] === "#";
    }

    /**
     * Cleanups a YAML string to be parsed
     *
     * @param string $value The input YAML string
     *
     * @return string A cleaned up YAML string
     */
    protected function cleanup($value)
    {
        $value = str_replace(["\r\n", "\r"], "\n", $value);

        // strip YAML header
        $count = 0;
        $value = preg_replace("#^\\%YAML[: ][\\d\\.]+.*\\n#u", "", $value, -1, $count);
        $this->offset += $count;

        // remove leading comments
        $trimmedValue = preg_replace("#^(\\#.*?\\n)+#s", "", $value, -1, $count);
        if ($count == 1) {
            // items have been removed, update the offset
            $this->offset += substr_count($value, "\n") - substr_count($trimmedValue, "\n");
            $value = $trimmedValue;
        }

        // remove start of the document marker (---)
        $trimmedValue = preg_replace("#^\\-\\-\\-.*?\\n#s", "", $value, -1, $count);
        if ($count == 1) {
            // items have been removed, update the offset
            $this->offset += substr_count($value, "\n") - substr_count($trimmedValue, "\n");
            $value = $trimmedValue;

            // remove end of the document marker (...)
            $value = preg_replace("#\\.\\.\\.\\s*$#", "", $value);
        }

        return $value;
    }

    /**
     * Returns true if the next line starts unindented collection
     *
     * @return bool Returns true if the next line starts unindented collection, false otherwise
     */
    protected function isNextLineUnIndentedCollection()
    {
        $currentIndentation = $this->getCurrentLineIndentation();
        $notEOF = $this->moveToNextLine();

        while ($notEOF && $this->isCurrentLineEmpty()) {
            $notEOF = $this->moveToNextLine();
        }

        if ($notEOF === false) {
            return false;
        }

        $ret = false;
        if ($this->getCurrentLineIndentation() == $currentIndentation &&
            $this->isStringUnIndentedCollectionItem()) {
            $ret = true;
        }

        $this->moveToPreviousLine();

        return $ret;
    }

    /**
     * Returns true if the string is un-indented collection item
     *
     * @return bool Returns true if the string is un-indented collection item, false otherwise
     */
    protected function isStringUnIndentedCollectionItem()
    {
        return (strpos($this->currentLine, "- ") === 0);
    }

    /**
     * Tests whether or not the current line is the header of a block scalar.
     *
     * @return bool
     */
    protected function isBlockScalarHeader()
    {
        return (bool)preg_match("~" . self::BLOCK_SCALAR_HEADER_PATTERN . "$~", $this->currentLine);
    }
}


Issues (37)

Security Analysis no request data

src/Yaml/Parser.php (16 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Available Fixes

eserozvataf / scabbia2-yaml

Issues (37)

Security Analysis no request data

src/Yaml/Parser.php (16 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Available Fixes

Duplication Side-by-Side

Filter issues like