This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Copyright (c) 2015-present, Facebook, Inc. All rights reserved. |
||
4 | * |
||
5 | * You are hereby granted a non-exclusive, worldwide, royalty-free license to |
||
6 | * use, copy, modify, and distribute this software in source code or binary |
||
7 | * form for use in connection with the web services and APIs provided by |
||
8 | * Facebook. |
||
9 | * |
||
10 | * As with any software that integrates with the Facebook platform, your use |
||
11 | * of this software is subject to the Facebook Developer Principles and |
||
12 | * Policies [http://developers.facebook.com/policy/]. This copyright notice |
||
13 | * shall be included in all copies or substantial portions of the software. |
||
14 | * |
||
15 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
||
16 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
||
17 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL |
||
18 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
||
19 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING |
||
20 | * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
||
21 | * DEALINGS IN THE SOFTWARE. |
||
22 | * |
||
23 | */ |
||
24 | |||
25 | namespace FacebookAds; |
||
26 | |||
27 | use FacebookAds\Cursor; |
||
28 | use FacebookAds\AbstractObject; |
||
29 | |||
30 | class ApiRequest { |
||
31 | protected $api; |
||
32 | protected $id; |
||
33 | protected $method; |
||
34 | protected $endpoint; |
||
35 | protected $return_prototype; |
||
0 ignored issues
–
show
|
|||
36 | protected $accepted_fields; |
||
0 ignored issues
–
show
$accepted_fields does not seem to conform to the naming convention (^[a-z][a-zA-Z0-9]*$ ).
This check examines a number of code elements and verifies that they conform to the given naming conventions. You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods. ![]() |
|||
37 | protected $param_checker; |
||
0 ignored issues
–
show
$param_checker does not seem to conform to the naming convention (^[a-z][a-zA-Z0-9]*$ ).
This check examines a number of code elements and verifies that they conform to the given naming conventions. You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods. ![]() |
|||
38 | protected $api_type; |
||
0 ignored issues
–
show
$api_type does not seem to conform to the naming convention (^[a-z][a-zA-Z0-9]*$ ).
This check examines a number of code elements and verifies that they conform to the given naming conventions. You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods. ![]() |
|||
39 | protected $use_graph_video_endpoint; |
||
0 ignored issues
–
show
$use_graph_video_endpoint does not seem to conform to the naming convention (^[a-z][a-zA-Z0-9]*$ ).
This check examines a number of code elements and verifies that they conform to the given naming conventions. You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods. ![]() |
|||
40 | private $fields; |
||
41 | private $params; |
||
42 | private $file_params; |
||
0 ignored issues
–
show
$file_params does not seem to conform to the naming convention (^[a-z][a-zA-Z0-9]*$ ).
This check examines a number of code elements and verifies that they conform to the given naming conventions. You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods. ![]() |
|||
43 | private $allow_file_upload; |
||
0 ignored issues
–
show
$allow_file_upload does not seem to conform to the naming convention (^[a-z][a-zA-Z0-9]*$ ).
This check examines a number of code elements and verifies that they conform to the given naming conventions. You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods. ![]() |
|||
44 | private $file_counter; |
||
0 ignored issues
–
show
$file_counter does not seem to conform to the naming convention (^[a-z][a-zA-Z0-9]*$ ).
This check examines a number of code elements and verifies that they conform to the given naming conventions. You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods. ![]() |
|||
45 | |||
46 | public function __construct( |
||
47 | Api $api, |
||
48 | $id, |
||
49 | $method, |
||
50 | $endpoint, |
||
51 | $return_prototype = null, |
||
52 | $api_type = null, |
||
53 | $accepted_fields = array(), |
||
54 | TypeChecker $param_checker = null, |
||
55 | $allow_file_upload = false, |
||
56 | $use_graph_video_endpoint = false) { |
||
57 | $this->fields = []; |
||
58 | $this->params = []; |
||
59 | $this->file_params = []; |
||
60 | $this->file_counter = 0; |
||
61 | $this->api = $api; |
||
62 | $this->id = $id; |
||
63 | $this->method = $method; |
||
64 | $this->endpoint = $endpoint; |
||
65 | $this->return_prototype = $return_prototype; |
||
66 | $this->api_type = $api_type; |
||
67 | $this->accepted_fields = $accepted_fields; |
||
68 | $this->param_checker = $param_checker; |
||
69 | $this->allow_file_upload = $allow_file_upload; |
||
70 | $this->use_graph_video_endpoint = $use_graph_video_endpoint; |
||
71 | } |
||
72 | |||
73 | public function addParam($param, $value) { |
||
74 | $extracted_value = $this->extractValue($value); |
||
75 | if (!ApiConfig::TYPE_CHECKER_STRICT_MODE |
||
76 | || !$this->param_checker->isValidParam($param) |
||
77 | ) { |
||
78 | $this->params[$param] = $extracted_value; |
||
79 | } else { |
||
80 | if ($this->param_checker->isValidParamPair($param, $value)) { |
||
81 | if ($this->param_checker->isFileParam($param)) { |
||
82 | $this->file_params[$param] = $extracted_value; |
||
83 | } else { |
||
84 | $this->params[$param] = $extracted_value; |
||
85 | } |
||
86 | } elseif ($this->param_checker->isPrimitiveType($param)) { |
||
87 | $param_type = $this->param_checker->getType($param); |
||
88 | $this->params[$param] = $this->param_checker->convertStringToPrimType( |
||
89 | $param_type, $value); |
||
90 | } else { |
||
91 | throw new \LogicException('The value for '.$param.' is not compatible'); |
||
92 | } |
||
93 | } |
||
94 | return $this; |
||
95 | } |
||
96 | |||
97 | public function addParams($params) { |
||
98 | foreach ($params as $key => $value) { |
||
99 | $this->addParam($key, $value); |
||
100 | } |
||
101 | return $this; |
||
102 | } |
||
103 | |||
104 | public function removeParam($param) { |
||
105 | if (array_key_exists($param, $this->params)) { |
||
106 | unset($this->params[$param]); |
||
107 | } elseif (array_key_exists($param, $this->params)) { |
||
108 | unset($this->file_params[$param]); |
||
109 | } |
||
110 | return $this; |
||
111 | } |
||
112 | |||
113 | public function clearParams() { |
||
114 | $this->params = []; |
||
115 | $this->file_params = []; |
||
116 | return this; |
||
117 | } |
||
118 | |||
119 | public function getParams() { |
||
120 | $all_params = array_merge($this->params, $this->file_params); |
||
121 | return $all_params; |
||
122 | } |
||
123 | |||
124 | public function addField($field) { |
||
125 | if (ApiConfig::TYPE_CHECKER_STRICT_MODE |
||
126 | && !in_array($field, $this->accepted_fields) |
||
127 | ) { |
||
128 | throw new \LogicException('Field '.$field.' is not supported'); |
||
129 | } |
||
130 | if (!(in_array($field, $this->fields))) { |
||
131 | $this->fields[] = $field; |
||
132 | } |
||
133 | return $this; |
||
134 | } |
||
135 | |||
136 | public function addFields($fields) { |
||
137 | foreach ($fields as $field) { |
||
138 | $this->addField($field); |
||
139 | } |
||
140 | return $this; |
||
141 | } |
||
142 | |||
143 | public function removeField($field) { |
||
144 | if (in_array($field, $this->fields)) { |
||
145 | $index_to_remove = array_search($field, $this->fields); |
||
146 | unset($this->fields[$index_to_remove]); |
||
147 | } |
||
148 | return $this; |
||
149 | } |
||
150 | |||
151 | public function clearFields() { |
||
152 | $this->fields = []; |
||
153 | return this; |
||
154 | } |
||
155 | |||
156 | public function getFields() { |
||
157 | return $this->fields; |
||
158 | } |
||
159 | |||
160 | public function addFile($filename) { |
||
161 | if (ApiConfig::TYPE_CHECKER_STRICT_MODE && !$this->allow_file_upload) { |
||
162 | throw new \LogicException("This api cannot upload files"); |
||
163 | } |
||
164 | $file_key = 'source'.$this->file_counter; |
||
165 | if (file_exists($filename)) { |
||
166 | $this->file_params[$file_key] = $filename; |
||
167 | $this->file_counter++; |
||
168 | } |
||
169 | return $this; |
||
170 | } |
||
171 | |||
172 | /** |
||
173 | * Execute the request |
||
174 | */ |
||
175 | public function execute() { |
||
176 | $url_path = '/'.$this->id.$this->endpoint; |
||
177 | $updated_params = $this->params; |
||
178 | if (!empty($this->fields)) { |
||
179 | $fields = implode(',', $this->fields); |
||
180 | $updated_params['fields'] = $fields; |
||
181 | } |
||
182 | $response = $this->api->call( |
||
183 | $url_path, $this->method, $updated_params, $this->file_params); |
||
0 ignored issues
–
show
The call to
Api::call() has too many arguments starting with $this->file_params .
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. In this case you can add the ![]() |
|||
184 | if ($this->api_type === "EDGE" && $this->method === "GET") { |
||
185 | return new Cursor($response, $this->return_prototype, $this->api); |
||
186 | } else if ($this->method === "DELETE") { |
||
187 | return $response; |
||
188 | } else { |
||
189 | return $this->createObject($response->getContent()); |
||
0 ignored issues
–
show
It seems like
$response->getContent() targeting FacebookAds\Http\ResponseInterface::getContent() can also be of type null ; however, FacebookAds\ApiRequest::createObject() does only seem to accept array , maybe add an additional type check?
This check looks at variables that are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. ![]() |
|||
190 | } |
||
191 | } |
||
192 | |||
193 | protected function extractValue($value) { |
||
194 | if ($this->param_checker->isAbstractObject($value)) { |
||
195 | return $value->exportAllData(); |
||
196 | } else if (is_array($value)) { |
||
197 | $extracted_value = []; |
||
198 | foreach ($value as $key => $sub_value) { |
||
199 | $extracted_value[$key] = $this->extractValue($sub_value); |
||
200 | } |
||
201 | return $extracted_value; |
||
202 | } else { |
||
203 | return $value; |
||
204 | } |
||
205 | } |
||
206 | |||
207 | protected function createObject(array $object_data) { |
||
208 | $object = clone $this->return_prototype; |
||
209 | $object->setDataWithoutValidation($object_data); |
||
210 | if ($object instanceof AbstractCrudObject) { |
||
0 ignored issues
–
show
The class
FacebookAds\AbstractCrudObject does not exist. Did you forget a USE statement, or did you not list all dependencies?
This error could be the result of: 1. Missing dependenciesPHP Analyzer uses your Are you sure this class is defined by one of your dependencies, or did you maybe
not list a dependency in either the 2. Missing use statementPHP does not complain about undefined classes in if ($x instanceof DoesNotExist) {
// Do something.
}
If you have not tested against this specific condition, such errors might go unnoticed. ![]() |
|||
211 | $object->setApi($this->api); |
||
212 | } |
||
213 | return $object; |
||
214 | } |
||
215 | } |
||
216 |
This check examines a number of code elements and verifies that they conform to the given naming conventions.
You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods.