Issues (25)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Protocol/RequestFactory.php (1 issue)

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
namespace evseevnn\Cassandra\Protocol;
3
use evseevnn\Cassandra\Enum\OpcodeEnum;
4
5
final class RequestFactory {
6
7
	/**
8
	 * STARTUP
9
	 *
10
	 * Initialize the connection. The server will respond by either a READY message
11
	 * (in which case the connection is ready for queries) or an AUTHENTICATE message
12
	 * (in which case credentials will need to be provided using CREDENTIALS).
13
	 *
14
	 * This must be the first message of the connection, except for OPTIONS that can
15
	 * be sent before to find out the options supported by the server. Once the
16
	 * connection has been initialized, a client should not send any more STARTUP
17
	 * message.
18
	 *
19
	 * Possible options are:
20
	 * - "CQL_VERSION": the version of CQL to use. This option is mandatory and
21
	 * currenty, the only version supported is "3.0.0". Note that this is
22
	 * different from the protocol version.
23
	 * - "COMPRESSION": the compression algorithm to use for frames (See section 5).
24
	 * This is optional, if not specified no compression will be used.
25
	 *
26
	 * @param array $option
27
	 * @return \evseevnn\Cassandra\Protocol\Request
28
	 */
29
	public static function startup(array $option = []) {
30
		$body = pack('n', count($option));
31
		foreach ($option as $name => $value) {
32
			$body .= pack('n', strlen($name)) . $name;
33
			$body .= pack('n', strlen($value)) . $value;
34
		}
35
36
		return new Request(OpcodeEnum::STARTUP, $body);
37
	}
38
39
	/**
40
	 * CREDENTIALS
41
	 *
42
	 * Provides credentials information for the purpose of identification. This
43
	 * message comes as a response to an AUTHENTICATE message from the server, but
44
	 * can be use later in the communication to change the authentication
45
	 * information.
46
	 *
47
	 * The body is a list of key/value informations. It is a [short] n, followed by n
48
	 * pair of [string]. These key/value pairs are passed as is to the Cassandra
49
	 * IAuthenticator and thus the detail of which informations is needed depends on
50
	 * that authenticator.
51
	 *
52
	 * The response to a CREDENTIALS is a READY message (or an ERROR message).
53
	 *
54
	 * @param string $user
55
	 * @param string $password
56
	 * @return \evseevnn\Cassandra\Protocol\Request
57
	 */
58
	public static function credentials($user, $password) {
59
		$body = pack('n', 2);
60
		$body .= pack('n', 8) . 'username';
61
		$body .= pack('n', strlen($user)) . $user;
62
		$body .= pack('n', 8) . 'password';
63
		$body .= pack('n', strlen($password)) . $password;
64
65
		return new Request(OpcodeEnum::CREDENTIALS, $body);
66
	}
67
68
	/**
69
	 * OPTIONS
70
	 *
71
	 * Asks the server to return what STARTUP options are supported. The body of an
72
	 * OPTIONS message should be empty and the server will respond with a SUPPORTED
73
	 * message.
74
	 */
75
	public function options() {
76
		return new Request(OpcodeEnum::OPTIONS);
77
	}
78
79
	/**
80
	 * QUERY
81
	 *
82
	 * Performs a CQL query. The body of the message consists of a CQL query as a [long
83
	 * string] followed by the [consistency] for the operation.
84
	 *
85
	 * Note that the consistency is ignored by some queries (USE, CREATE, ALTER,
86
	 * TRUNCATE, ...).
87
	 *
88
	 * The server will respond to a QUERY message with a RESULT message, the content
89
	 * of which depends on the query.
90
	 *
91
	 * @param string $cql
92
	 * @param int $consistency
93
	 * @return \evseevnn\Cassandra\Protocol\Request
94
	 */
95
	public static function query($cql, $consistency) {
96
		$body = pack('N', strlen($cql)) . $cql . pack('n', $consistency);
97
		return new Request(OpcodeEnum::QUERY, $body);
98
	}
99
100
	/**
101
	 * PREPARE
102
	 *
103
	 * Prepare a query for later execution (through EXECUTE). The body consists of
104
	 * the CQL query to prepare as a [long string].
105
	 *
106
	 * The server will respond with a RESULT message with a `prepared` kind (0x0004,
107
	 * see Section 4.2.5).
108
	 *
109
	 * @param string $cql
110
	 * @return \evseevnn\Cassandra\Protocol\Request
111
	 */
112
	public static function prepare($cql) {
113
		$body = pack('N', strlen($cql)) . $cql;
114
		return new Request(OpcodeEnum::PREPARE, $body);
115
	}
116
117
	/**
118
	 * EXECUTE
119
	 *
120
	 * Executes a prepared query. The body of the message must be:
121
	 * <id><n><value_1>....<value_n><consistency>
122
	 * where:
123
	 * - <id> is the prepared query ID. It's the [short bytes] returned as a
124
	 * response to a PREPARE message.
125
	 * - <n> is a [short] indicating the number of following values.
126
	 * - <value_1>...<value_n> are the [bytes] to use for bound variables in the
127
	 * prepared query.
128
	 * - <consistency> is the [consistency] level for the operation.
129
	 * Note that the consistency is ignored by some (prepared) queries (USE, CREATE,
130
	 * ALTER, TRUNCATE, ...).
131
	 * The response from the server will be a RESULT message.
132
	 *
133
	 * @param array $prepareData
134
	 * @param array $values
135
	 * @param int $consistency
136
	 * @return \evseevnn\Cassandra\Protocol\Request
137
	 */
138
	public static function execute(array $prepareData, array $values, $consistency) {
139
		$body = pack('n', strlen($prepareData['id'])) . $prepareData['id'];
140
		$body .= pack('n', count($values));
141
142
		// column names in lower case in metadata
143
		$values = array_change_key_case($values);
144
145
		foreach($prepareData['metadata']['columns'] as $key => $column) {
146
			if (isset($values[$column['name']])) {
147
				$value = $values[$column['name']];
148
			} elseif (isset($values[$key])) {
149
				$value = $values[$key];
150
			} else {
151
				$value = null;
152
			}
153
			$binary = new BinaryData($column['type'], $value);
154
			$body .= pack('N', strlen($binary)) . $binary;
155
		}
156
		$body .= pack('n', $consistency);
157
158
		return new Request(OpcodeEnum::EXECUTE, $body);
159
	}
160
161
	/**
162
	 * REGISTER
163
	 *
164
	 * Register this connection to receive some type of events. The body of the
165
	 * message is a [string list] representing the event types to register to. See
166
	 * section 4.2.6 for the list of valid event types.
167
	 *
168
	 * The response to a REGISTER message will be a READY message.
169
	 *
170
	 * Please note that if a client driver maintains multiple connections to a
171
	 * Cassandra node and/or connections to multiple nodes, it is advised to
172
	 * dedicate a handful of connections to receive events, but to *not* register
173
	 * for events on all connections, as this would only result in receiving
174
	 * multiple times the same event messages, wasting bandwidth.
175
	 *
176
	 * @param array $events
177
	 */
178
	public function register(array $events) {
0 ignored issues
show
The parameter $events is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
179
		// TODO
180
	}
181
}