Issues (35)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Message/Builder/MessageBuilder.php (11 issues)

Labels
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/*
3
 * This file is part of the FirebaseCloudMessagingBundle.
4
 *
5
 * (c) Artem Henvald <[email protected]>
6
 *
7
 * For the full copyright and license information, please view the LICENSE
8
 * file that was distributed with this source code.
9
 */
10
11
declare(strict_types=1);
12
13
namespace Fresh\FirebaseCloudMessagingBundle\Message\Builder;
14
15
use Fresh\FirebaseCloudMessagingBundle\Message\Builder\Payload\AndroidPayloadBuilder;
16
use Fresh\FirebaseCloudMessagingBundle\Message\Builder\Payload\IosPayloadBuilder;
17
use Fresh\FirebaseCloudMessagingBundle\Message\Builder\Payload\WebPayloadBuilder;
18
use Fresh\FirebaseCloudMessagingBundle\Message\Part\Options\Options;
19
use Fresh\FirebaseCloudMessagingBundle\Message\Part\Options\OptionsInterface;
20
use Fresh\FirebaseCloudMessagingBundle\Message\Part\Options\Priority;
21
use Fresh\FirebaseCloudMessagingBundle\Message\Part\Payload\Combined\CombinedPayload;
22
use Fresh\FirebaseCloudMessagingBundle\Message\Part\Payload\CommonPayloadInterface;
23
use Fresh\FirebaseCloudMessagingBundle\Message\Part\Payload\Data\DataPayload;
24
use Fresh\FirebaseCloudMessagingBundle\Message\Part\Payload\Notification\AbstractCommonNotificationPayload;
25
use Fresh\FirebaseCloudMessagingBundle\Message\Part\Payload\Notification\AndroidNotificationPayload;
26
use Fresh\FirebaseCloudMessagingBundle\Message\Part\Payload\Notification\IosNotificationPayload;
27
use Fresh\FirebaseCloudMessagingBundle\Message\Part\Payload\Notification\WebNotificationPayload;
28
use Fresh\FirebaseCloudMessagingBundle\Message\Part\Target;
29
use Fresh\FirebaseCloudMessagingBundle\Message\Type\AbstractMessage;
30
31
/**
32
 * MessageBuilder.
33
 *
34
 * @author Artem Henvald <[email protected]>
35
 *
36
 * @todo Add validation while building message
37
 */
38
class MessageBuilder
39
{
40
    /** @var AbstractMessage */
41
    private $message;
42
43
    private $targetPart = [];
44
45
    private $optionsPart = [];
46
47
    private $payloadPart = [];
48
49
    /**
50
     * @param AbstractMessage $message
51
     */
52
    public function setMessage(AbstractMessage $message): void
53
    {
54
        $this->message = $message;
55
    }
56
57
    /**
58
     * @return array
59
     *
60
     * @throws \RuntimeException
61
     */
62
    public function getMessagePartsAsArray(): array
63
    {
64
        if (!$this->messageIsValid()) {
65
            throw new \RuntimeException('Message is not valid');
66
        }
67
68
        $this->buildTargetPart();
69
        $this->buildOptionsPart();
70
        $this->buildPayloadPart();
71
72
        return \array_merge($this->targetPart, $this->optionsPart, $this->payloadPart);
73
    }
74
75
    /**
76
     * @return string
77
     */
78
    public function getMessageAsJson(): string
79
    {
80
        return \json_encode($this->getMessagePartsAsArray());
81
    }
82
83
    /**
84
     * Check if message is valid (has all required parts).
85
     *
86
     * Target and payload are required parts. Options can be omitted.
87
     *
88
     * @return bool
89
     *
90
     * @throws \RuntimeException
91
     */
92
    private function messageIsValid(): bool
93
    {
94
        if (!$this->message instanceof AbstractMessage) {
0 ignored issues
show
The class Fresh\FirebaseCloudMessa...ge\Type\AbstractMessage does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
95
            throw new \RuntimeException(\sprintf('Message is not instance of %s', AbstractMessage::class));
96
        }
97
98
        if (!$this->message->getTarget() instanceof Target\TargetInterface) {
99
            throw new \RuntimeException(\sprintf('Message target is not instance of %s', Target\TargetInterface::class));
100
        }
101
102
        if (!$this->message->getPayload() instanceof CommonPayloadInterface) {
103
            throw new \RuntimeException(\sprintf('Message target is not instance of %s', CommonPayloadInterface::class));
104
        }
105
106
        return true;
107
    }
108
109
    /**
110
     * @throws \InvalidArgumentException
111
     */
112
    private function buildTargetPart(): void
113
    {
114
        $this->targetPart = [];
115
116
        $target = $this->message->getTarget();
117
118
        if ($target instanceof Target\ConditionTarget) {
0 ignored issues
show
The class Fresh\FirebaseCloudMessa...\Target\ConditionTarget does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
119
            $this->targetPart = ['condition' => $target->getCondition()];
120
        } elseif ($target instanceof Target\MulticastTarget) {
0 ignored issues
show
The class Fresh\FirebaseCloudMessa...\Target\MulticastTarget does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
121
            $this->targetPart = ['registration_ids' => $target->getRegistrationTokens()];
122
        } elseif ($target instanceof Target\SingleRecipientTarget) {
0 ignored issues
show
The class Fresh\FirebaseCloudMessa...t\SingleRecipientTarget does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
123
            $this->targetPart = ['to' => $target->getRegistrationToken()];
124
        } else {
125
            throw new \InvalidArgumentException('Unsupported target part');
126
        }
127
    }
128
129
    /**
130
     * Build options part.
131
     */
132
    private function buildOptionsPart(): void
133
    {
134
        $this->optionsPart = [];
135
136
        if ($this->message instanceof AbstractMessage && $this->message->getOptions() instanceof OptionsInterface) {
0 ignored issues
show
The class Fresh\FirebaseCloudMessa...ge\Type\AbstractMessage does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
137
            $options = $this->message->getOptions();
138
139
            if (!empty($options->getCollapseKey())) {
140
                $this->optionsPart['collapse_key'] = $options->getCollapseKey();
141
            }
142
143
            // By default, messages are sent with normal priority.
144
            // If priority is different add it to the set of options.
145
            if (Priority::NORMAL !== $options->getPriority()) {
146
                $this->optionsPart['priority'] = $options->getPriority();
147
            }
148
149
            // By default `content_available` option is false. Adding it only if it was changed to true.
150
            if ($options->isContentAvailable()) {
151
                $this->optionsPart['content_available'] = true;
152
            }
153
154
            // By default `mutable_content` option is false. Adding it only if it was changed to true.
155
            if ($options->isMutableContent()) {
156
                $this->optionsPart['mutable_content'] = true;
157
            }
158
159
            // By default TTL for message in FCM is 4 weeks, it is also the default value if you omitted the TTL option.
160
            // So if the TTL is overwritten and is not equal to the default value, then add this option.
161
            // Otherwise if TTL is still equal to default, then it is not need to send this option.
162
            if (Options::DEFAULT_TTL_IN_SECONDS !== $options->getTimeToLive()) {
163
                $this->optionsPart['time_to_live'] = $options->getTimeToLive();
164
            }
165
166
            if (!empty($options->getRestrictedPackageName())) {
167
                $this->optionsPart['restricted_package_name'] = $options->getRestrictedPackageName();
168
            }
169
170
            // By default `dry_run` option is.... @todo
171
            if ($options->isDryRun()) {
172
                $this->optionsPart['dry_run'] = true;
173
            }
174
        }
175
    }
176
177
    /**
178
     * @throws \InvalidArgumentException
179
     */
180
    private function buildPayloadPart(): void
181
    {
182
        $this->payloadPart = [];
183
184
        $payload = $this->message->getPayload();
185
186
        if ($payload instanceof AbstractCommonNotificationPayload) {
0 ignored issues
show
The class Fresh\FirebaseCloudMessa...mmonNotificationPayload does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
187
            $this->payloadPart['notification'] = $this->buildNotificationPayloadPart($payload);
188
        } elseif ($payload instanceof DataPayload) {
0 ignored issues
show
The class Fresh\FirebaseCloudMessa...ayload\Data\DataPayload does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
189
            $this->payloadPart['data'] = $payload->getData();
190
        } elseif ($payload instanceof CombinedPayload) {
0 ignored issues
show
The class Fresh\FirebaseCloudMessa...ombined\CombinedPayload does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
191
            $this->payloadPart = [
192
                'notification' => $this->buildNotificationPayloadPart($payload->getNotificationPayload()),
193
                'data' => $payload->getDataPayload()->getData(),
194
            ];
195
        } else {
196
            throw new \InvalidArgumentException('Unsupported payload part');
197
        }
198
    }
199
200
    /**
201
     * @param AbstractCommonNotificationPayload $payload
202
     *
203
     * @return array
204
     *
205
     * @throws \InvalidArgumentException
206
     */
207
    private function buildNotificationPayloadPart(AbstractCommonNotificationPayload $payload): array
208
    {
209
        if ($payload instanceof AndroidNotificationPayload) {
0 ignored issues
show
The class Fresh\FirebaseCloudMessa...roidNotificationPayload does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
210
            $payloadBuilder = new AndroidPayloadBuilder($payload);
211
        } elseif ($payload instanceof IosNotificationPayload) {
0 ignored issues
show
The class Fresh\FirebaseCloudMessa...\IosNotificationPayload does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
212
            $payloadBuilder = new IosPayloadBuilder($payload);
213
        } elseif ($payload instanceof WebNotificationPayload) {
0 ignored issues
show
The class Fresh\FirebaseCloudMessa...\WebNotificationPayload does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
214
            $payloadBuilder = new WebPayloadBuilder($payload);
215
        } else {
216
            throw new \InvalidArgumentException('Unsupported notification payload part');
217
        }
218
219
        return $payloadBuilder->build()->getPayloadPart();
220
    }
221
}
222