facebook /
facebook-php-sdk-v4
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * Copyright 2016 Facebook, Inc. |
||
| 4 | * |
||
| 5 | * You are hereby granted a non-exclusive, worldwide, royalty-free license to |
||
| 6 | * use, copy, modify, and distribute this software in source code or binary |
||
| 7 | * form for use in connection with the web services and APIs provided by |
||
| 8 | * Facebook. |
||
| 9 | * |
||
| 10 | * As with any software that integrates with the Facebook platform, your use |
||
| 11 | * of this software is subject to the Facebook Developer Principles and |
||
| 12 | * Policies [http://developers.facebook.com/policy/]. This copyright notice |
||
| 13 | * shall be included in all copies or substantial portions of the software. |
||
| 14 | * |
||
| 15 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
||
| 16 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
||
| 17 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL |
||
| 18 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
||
| 19 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING |
||
| 20 | * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
||
| 21 | * DEALINGS IN THE SOFTWARE. |
||
| 22 | * |
||
| 23 | */ |
||
| 24 | namespace Facebook; |
||
| 25 | |||
| 26 | use ArrayIterator; |
||
| 27 | use IteratorAggregate; |
||
| 28 | use ArrayAccess; |
||
| 29 | use Facebook\Authentication\AccessToken; |
||
| 30 | use Facebook\Exceptions\FacebookSDKException; |
||
| 31 | |||
| 32 | /** |
||
| 33 | * Class BatchRequest |
||
| 34 | * |
||
| 35 | * @package Facebook |
||
| 36 | */ |
||
| 37 | class FacebookBatchRequest extends FacebookRequest implements IteratorAggregate, ArrayAccess |
||
| 38 | { |
||
| 39 | /** |
||
| 40 | * @var array An array of FacebookRequest entities to send. |
||
| 41 | */ |
||
| 42 | protected $requests; |
||
| 43 | |||
| 44 | /** |
||
| 45 | * @var array An array of files to upload. |
||
| 46 | */ |
||
| 47 | protected $attachedFiles; |
||
| 48 | |||
| 49 | /** |
||
| 50 | * Creates a new Request entity. |
||
| 51 | * |
||
| 52 | * @param FacebookApp|null $app |
||
| 53 | * @param array $requests |
||
| 54 | * @param AccessToken|string|null $accessToken |
||
| 55 | * @param string|null $graphVersion |
||
| 56 | */ |
||
| 57 | public function __construct(FacebookApp $app = null, array $requests = [], $accessToken = null, $graphVersion = null) |
||
| 58 | { |
||
| 59 | parent::__construct($app, $accessToken, 'POST', '', [], null, $graphVersion); |
||
| 60 | |||
| 61 | $this->add($requests); |
||
| 62 | } |
||
| 63 | |||
| 64 | /** |
||
| 65 | * A a new request to the array. |
||
| 66 | * |
||
| 67 | * @param FacebookRequest|array $request |
||
| 68 | * @param string|null $name |
||
| 69 | * |
||
| 70 | * @return FacebookBatchRequest |
||
| 71 | * |
||
| 72 | * @throws \InvalidArgumentException |
||
| 73 | */ |
||
| 74 | public function add($request, $name = null) |
||
| 75 | { |
||
| 76 | if (is_array($request)) { |
||
| 77 | foreach ($request as $key => $req) { |
||
| 78 | $this->add($req, $key); |
||
| 79 | } |
||
| 80 | |||
| 81 | return $this; |
||
| 82 | } |
||
| 83 | |||
| 84 | if (!$request instanceof FacebookRequest) { |
||
| 85 | throw new \InvalidArgumentException('Argument for add() must be of type array or FacebookRequest.'); |
||
| 86 | } |
||
| 87 | |||
| 88 | $this->addFallbackDefaults($request); |
||
| 89 | $requestToAdd = [ |
||
| 90 | 'name' => $name, |
||
| 91 | 'request' => $request, |
||
| 92 | ]; |
||
| 93 | |||
| 94 | // File uploads |
||
| 95 | $attachedFiles = $this->extractFileAttachments($request); |
||
| 96 | if ($attachedFiles) { |
||
|
0 ignored issues
–
show
|
|||
| 97 | $requestToAdd['attached_files'] = $attachedFiles; |
||
| 98 | } |
||
| 99 | $this->requests[] = $requestToAdd; |
||
| 100 | |||
| 101 | return $this; |
||
| 102 | } |
||
| 103 | |||
| 104 | /** |
||
| 105 | * Ensures that the FacebookApp and access token fall back when missing. |
||
| 106 | * |
||
| 107 | * @param FacebookRequest $request |
||
| 108 | * |
||
| 109 | * @throws FacebookSDKException |
||
| 110 | */ |
||
| 111 | public function addFallbackDefaults(FacebookRequest $request) |
||
| 112 | { |
||
| 113 | if (!$request->getApp()) { |
||
| 114 | $app = $this->getApp(); |
||
| 115 | if (!$app) { |
||
| 116 | throw new FacebookSDKException('Missing FacebookApp on FacebookRequest and no fallback detected on FacebookBatchRequest.'); |
||
| 117 | } |
||
| 118 | $request->setApp($app); |
||
| 119 | } |
||
| 120 | |||
| 121 | if (!$request->getAccessToken()) { |
||
|
0 ignored issues
–
show
The expression
$request->getAccessToken() of type string|null is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === null instead.
In PHP, under loose comparison (like For '' == false // true
'' == null // true
'ab' == false // false
'ab' == null // false
// It is often better to use strict comparison
'' === false // false
'' === null // false
Loading history...
|
|||
| 122 | $accessToken = $this->getAccessToken(); |
||
| 123 | if (!$accessToken) { |
||
|
0 ignored issues
–
show
The expression
$accessToken of type string|null is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === null instead.
In PHP, under loose comparison (like For '' == false // true
'' == null // true
'ab' == false // false
'ab' == null // false
// It is often better to use strict comparison
'' === false // false
'' === null // false
Loading history...
|
|||
| 124 | throw new FacebookSDKException('Missing access token on FacebookRequest and no fallback detected on FacebookBatchRequest.'); |
||
| 125 | } |
||
| 126 | $request->setAccessToken($accessToken); |
||
| 127 | } |
||
| 128 | } |
||
| 129 | |||
| 130 | /** |
||
| 131 | * Extracts the files from a request. |
||
| 132 | * |
||
| 133 | * @param FacebookRequest $request |
||
| 134 | * |
||
| 135 | * @return string|null |
||
| 136 | * |
||
| 137 | * @throws FacebookSDKException |
||
| 138 | */ |
||
| 139 | public function extractFileAttachments(FacebookRequest $request) |
||
| 140 | { |
||
| 141 | if (!$request->containsFileUploads()) { |
||
| 142 | return null; |
||
| 143 | } |
||
| 144 | |||
| 145 | $files = $request->getFiles(); |
||
| 146 | $fileNames = []; |
||
| 147 | foreach ($files as $file) { |
||
| 148 | $fileName = uniqid(); |
||
| 149 | $this->addFile($fileName, $file); |
||
| 150 | $fileNames[] = $fileName; |
||
| 151 | } |
||
| 152 | |||
| 153 | $request->resetFiles(); |
||
| 154 | |||
| 155 | // @TODO Does Graph support multiple uploads on one endpoint? |
||
| 156 | return implode(',', $fileNames); |
||
| 157 | } |
||
| 158 | |||
| 159 | /** |
||
| 160 | * Return the FacebookRequest entities. |
||
| 161 | * |
||
| 162 | * @return array |
||
| 163 | */ |
||
| 164 | public function getRequests() |
||
| 165 | { |
||
| 166 | return $this->requests; |
||
| 167 | } |
||
| 168 | |||
| 169 | /** |
||
| 170 | * Prepares the requests to be sent as a batch request. |
||
| 171 | * |
||
| 172 | * @return string |
||
| 173 | */ |
||
| 174 | public function prepareRequestsForBatch() |
||
| 175 | { |
||
| 176 | $this->validateBatchRequestCount(); |
||
| 177 | |||
| 178 | $params = [ |
||
| 179 | 'batch' => $this->convertRequestsToJson(), |
||
| 180 | 'include_headers' => true, |
||
| 181 | ]; |
||
| 182 | $this->setParams($params); |
||
| 183 | } |
||
| 184 | |||
| 185 | /** |
||
| 186 | * Converts the requests into a JSON(P) string. |
||
| 187 | * |
||
| 188 | * @return string |
||
| 189 | */ |
||
| 190 | public function convertRequestsToJson() |
||
| 191 | { |
||
| 192 | $requests = []; |
||
| 193 | foreach ($this->requests as $request) { |
||
| 194 | $attachedFiles = isset($request['attached_files']) ? $request['attached_files'] : null; |
||
| 195 | $requests[] = $this->requestEntityToBatchArray($request['request'], $request['name'], $attachedFiles); |
||
| 196 | } |
||
| 197 | |||
| 198 | return json_encode($requests); |
||
| 199 | } |
||
| 200 | |||
| 201 | /** |
||
| 202 | * Validate the request count before sending them as a batch. |
||
| 203 | * |
||
| 204 | * @throws FacebookSDKException |
||
| 205 | */ |
||
| 206 | public function validateBatchRequestCount() |
||
| 207 | { |
||
| 208 | $batchCount = count($this->requests); |
||
| 209 | if ($batchCount === 0) { |
||
| 210 | throw new FacebookSDKException('There are no batch requests to send.'); |
||
| 211 | } elseif ($batchCount > 50) { |
||
| 212 | // Per: https://developers.facebook.com/docs/graph-api/making-multiple-requests#limits |
||
| 213 | throw new FacebookSDKException('You cannot send more than 50 batch requests at a time.'); |
||
| 214 | } |
||
| 215 | } |
||
| 216 | |||
| 217 | /** |
||
| 218 | * Converts a Request entity into an array that is batch-friendly. |
||
| 219 | * |
||
| 220 | * @param FacebookRequest $request The request entity to convert. |
||
| 221 | * @param string|null $requestName The name of the request. |
||
| 222 | * @param string|null $attachedFiles Names of files associated with the request. |
||
| 223 | * |
||
| 224 | * @return array |
||
| 225 | */ |
||
| 226 | public function requestEntityToBatchArray(FacebookRequest $request, $requestName = null, $attachedFiles = null) |
||
| 227 | { |
||
| 228 | $compiledHeaders = []; |
||
| 229 | $headers = $request->getHeaders(); |
||
| 230 | foreach ($headers as $name => $value) { |
||
| 231 | $compiledHeaders[] = $name . ': ' . $value; |
||
| 232 | } |
||
| 233 | |||
| 234 | $batch = [ |
||
| 235 | 'headers' => $compiledHeaders, |
||
| 236 | 'method' => $request->getMethod(), |
||
| 237 | 'relative_url' => $request->getUrl(), |
||
| 238 | ]; |
||
| 239 | |||
| 240 | // Since file uploads are moved to the root request of a batch request, |
||
| 241 | // the child requests will always be URL-encoded. |
||
| 242 | $body = $request->getUrlEncodedBody()->getBody(); |
||
| 243 | if ($body) { |
||
| 244 | $batch['body'] = $body; |
||
| 245 | } |
||
| 246 | |||
| 247 | if (isset($requestName)) { |
||
| 248 | $batch['name'] = $requestName; |
||
| 249 | } |
||
| 250 | |||
| 251 | if (isset($attachedFiles)) { |
||
| 252 | $batch['attached_files'] = $attachedFiles; |
||
| 253 | } |
||
| 254 | |||
| 255 | // @TODO Add support for "omit_response_on_success" |
||
| 256 | // @TODO Add support for "depends_on" |
||
| 257 | // @TODO Add support for JSONP with "callback" |
||
| 258 | |||
| 259 | return $batch; |
||
| 260 | } |
||
| 261 | |||
| 262 | /** |
||
| 263 | * Get an iterator for the items. |
||
| 264 | * |
||
| 265 | * @return ArrayIterator |
||
| 266 | */ |
||
| 267 | public function getIterator() |
||
| 268 | { |
||
| 269 | return new ArrayIterator($this->requests); |
||
| 270 | } |
||
| 271 | |||
| 272 | /** |
||
| 273 | * @inheritdoc |
||
| 274 | */ |
||
| 275 | public function offsetSet($offset, $value) |
||
| 276 | { |
||
| 277 | $this->add($value, $offset); |
||
| 278 | } |
||
| 279 | |||
| 280 | /** |
||
| 281 | * @inheritdoc |
||
| 282 | */ |
||
| 283 | public function offsetExists($offset) |
||
| 284 | { |
||
| 285 | return isset($this->requests[$offset]); |
||
| 286 | } |
||
| 287 | |||
| 288 | /** |
||
| 289 | * @inheritdoc |
||
| 290 | */ |
||
| 291 | public function offsetUnset($offset) |
||
| 292 | { |
||
| 293 | unset($this->requests[$offset]); |
||
| 294 | } |
||
| 295 | |||
| 296 | /** |
||
| 297 | * @inheritdoc |
||
| 298 | */ |
||
| 299 | public function offsetGet($offset) |
||
| 300 | { |
||
| 301 | return isset($this->requests[$offset]) ? $this->requests[$offset] : null; |
||
| 302 | } |
||
| 303 | } |
||
| 304 |
In PHP, under loose comparison (like
==, or!=, orswitchconditions), values of different types might be equal.For
stringvalues, the empty string''is a special case, in particular the following results might be unexpected: