Issues (20)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Adapter.php (9 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Freyo\Flysystem\QcloudCOSv3;
4
5
use Freyo\Flysystem\QcloudCOSv3\Client\Conf;
6
use Freyo\Flysystem\QcloudCOSv3\Client\Cosapi;
7
use Freyo\Flysystem\QcloudCOSv3\Exceptions\RuntimeException;
8
use League\Flysystem\Adapter\AbstractAdapter;
9
use League\Flysystem\AdapterInterface;
10
use League\Flysystem\Config;
11
use League\Flysystem\Util;
12
13
/**
14
 * Class Adapter.
15
 */
16
class Adapter extends AbstractAdapter
17
{
18
    /**
19
     * @var
20
     */
21
    protected $bucket;
22
23
    /**
24
     * @var
25
     */
26
    protected $debug;
27
28
    /**
29
     * Adapter constructor.
30
     *
31
     * @param $config
32
     */
33
    public function __construct($config)
34
    {
35
        Conf::setAppId($config['app_id']);
36
        Conf::setSecretId($config['secret_id']);
37
        Conf::setSecretKey($config['secret_key']);
38
39
        $this->bucket = $config['bucket'];
40
        $this->debug  = $config['debug'];
41
42
        $this->setPathPrefix($config['protocol'] . '://' . $config['domain'] . '/');
43
44
        Cosapi::setTimeout($config['timeout']);
45
    }
46
47
    /**
48
     * @return string
49
     */
50 14
    public function getBucket()
51
    {
52 14
        return $this->bucket;
53
    }
54
55
    /**
56
     * @param string $path
57
     *
58
     * @return string
59
     */
60 1
    public function getUrl($path)
61
    {
62 1
        return $this->applyPathPrefix($path);
63
    }
64
65
    /**
66
     * @param string $path
67
     * @param string $contents
68
     * @param Config $config
69
     *
70
     * @throws RuntimeException
71
     *
72
     * @return array|bool
73
     */
74 View Code Duplication
    public function write($path, $contents, Config $config)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
75
    {
76
        $temporaryPath = $this->createTemporaryFile($contents);
77
78
        $response = Cosapi::upload($this->getBucket(), $temporaryPath, $path,
0 ignored issues
show
It seems like $temporaryPath defined by $this->createTemporaryFile($contents) on line 76 can also be of type boolean; however, Freyo\Flysystem\QcloudCO...Client\Cosapi::upload() does only seem to accept string, maybe add an additional type check?

If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check:

/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue.

Loading history...
79
            null, null, $config->get('insertOnly', 1));
80
81
        $response = $this->normalizeResponse($response);
82
83
        if (false !== $response) {
84
            $this->setContentType($path, $contents);;
85
        }
86
87
        return $response;
88
    }
89
90
    /**
91
     * @param string   $path
92
     * @param resource $resource
93
     * @param Config   $config
94
     *
95
     * @throws RuntimeException
96
     *
97
     * @return array|bool
98
     */
99 1 View Code Duplication
    public function writeStream($path, $resource, Config $config)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
100
    {
101 1
        $uri = stream_get_meta_data($resource)['uri'];
102
103 1
        $response = Cosapi::upload($this->getBucket(), $uri, $path,
104 1
            null, null, $config->get('insertOnly', 1));
105
106 1
        $response = $this->normalizeResponse($response);
107
108
        if (false !== $response) {
109
            $this->setContentType($path, stream_get_contents($resource));
110
        }
111
112
        return $response;
113
    }
114
115
    /**
116
     * @param string $path
117
     * @param string $contents
118
     * @param Config $config
119
     *
120
     * @throws RuntimeException
121
     *
122
     * @return array|bool
123
     */
124 View Code Duplication
    public function update($path, $contents, Config $config)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
125
    {
126
        $temporaryPath = $this->createTemporaryFile($contents);
127
128
        $response = Cosapi::upload($this->getBucket(), $temporaryPath, $path,
0 ignored issues
show
It seems like $temporaryPath defined by $this->createTemporaryFile($contents) on line 126 can also be of type boolean; however, Freyo\Flysystem\QcloudCO...Client\Cosapi::upload() does only seem to accept string, maybe add an additional type check?

If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check:

/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue.

Loading history...
129
            null, null, $config->get('insertOnly', 0));
130
131
        $response = $this->normalizeResponse($response);
132
133
        if (false !== $response) {
134
            $this->setContentType($path, $contents);
135
        }
136
137
        return $response;
138
    }
139
140
    /**
141
     * @param string   $path
142
     * @param resource $resource
143
     * @param Config   $config
144
     *
145
     * @throws RuntimeException
146
     *
147
     * @return array|bool
148
     */
149 1 View Code Duplication
    public function updateStream($path, $resource, Config $config)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
150
    {
151 1
        $uri = stream_get_meta_data($resource)['uri'];
152
153 1
        $response = Cosapi::upload($this->getBucket(), $uri, $path,
154 1
            null, null, $config->get('insertOnly', 0));
155
156 1
        $response = $this->normalizeResponse($response);
157
158
        if (false !== $response) {
159
            $this->setContentType($path, stream_get_contents($resource));
160
        }
161
162
        return $response;
163
    }
164
165
    /**
166
     * @param string $path
167
     * @param string $newpath
168
     *
169
     * @return bool
170
     */
171 1
    public function rename($path, $newpath)
172
    {
173 1
        return (bool)$this->normalizeResponse(
174 1
            Cosapi::move($this->getBucket(), $path, $newpath, 1)
175 1
        );
176
    }
177
178
    /**
179
     * @param string $path
180
     * @param string $newpath
181
     *
182
     * @return bool
183
     */
184
    public function copy($path, $newpath)
185
    {
186
        $resource = $this->read($path);
187
188
        return isset($resource['contents'])
189
            ? (bool)$this->update($newpath, $resource['contents'], new Config()) : false;
190
    }
191
192
    /**
193
     * @param string $path
194
     *
195
     * @return bool
196
     */
197 1
    public function delete($path)
198
    {
199 1
        return (bool)$this->normalizeResponse(
200 1
            Cosapi::delFile($this->getBucket(), $path)
201 1
        );
202
    }
203
204
    /**
205
     * @param string $dirname
206
     *
207
     * @return bool
208
     */
209 1
    public function deleteDir($dirname)
210
    {
211 1
        return (bool)$this->normalizeResponse(
212 1
            Cosapi::delFolder($this->getBucket(), $dirname)
213 1
        );
214
    }
215
216
    /**
217
     * @param string $dirname
218
     * @param Config $config
219
     *
220
     * @return array|bool
221
     */
222 1
    public function createDir($dirname, Config $config)
223
    {
224 1
        return $this->normalizeResponse(
225 1
            Cosapi::createFolder($this->getBucket(), $dirname)
226 1
        );
227
    }
228
229
    /**
230
     * @param string $path
231
     * @param string $visibility
232
     *
233
     * @return bool
234
     */
235 1
    public function setVisibility($path, $visibility)
236
    {
237 1
        $visibility = ($visibility === AdapterInterface::VISIBILITY_PUBLIC)
238 1
            ? 'eWPrivateRPublic' : 'eWRPrivate';
239
240 1
        return (bool)$this->normalizeResponse(
0 ignored issues
show
Bug Best Practice introduced by
The return type of return (bool) $this->nor...h, null, $visibility)); (boolean) is incompatible with the return type declared by the interface League\Flysystem\AdapterInterface::setVisibility of type array|false.

If you return a value from a function or method, it should be a sub-type of the type that is given by the parent type f.e. an interface, or abstract method. This is more formally defined by the Lizkov substitution principle, and guarantees that classes that depend on the parent type can use any instance of a child type interchangably. This principle also belongs to the SOLID principles for object oriented design.

Let’s take a look at an example:

class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}

Our function my_function expects a Post object, and outputs the author of the post. The base class Post returns a simple string and outputting a simple string will work just fine. However, the child class BlogPost which is a sub-type of Post instead decided to return an object, and is therefore violating the SOLID principles. If a BlogPost were passed to my_function, PHP would not complain, but ultimately fail when executing the strtoupper call in its body.

Loading history...
241 1
            Cosapi::update($this->getBucket(), $path, null, $visibility)
242 1
        );
243
    }
244
245
    /**
246
     * @param string $path
247
     *
248
     * @return bool
249
     */
250 1
    public function has($path)
251
    {
252
        try {
253 1
            return (bool)$this->getMetadata($path);
254 1
        } catch (RuntimeException $exception) {
255 1
            return false;
256
        }
257
    }
258
259
    /**
260
     * @param string $path
261
     *
262
     * @return array|bool
263
     */
264
    public function read($path)
265
    {
266
        $contents = file_get_contents($this->applyPathPrefix($path));
267
268
        return $contents !== false ? compact('contents') : false;
269
    }
270
271
    /**
272
     * @param string $path
273
     *
274
     * @return array|bool
275
     */
276
    public function readStream($path)
277
    {
278
        $stream = fopen($this->applyPathPrefix($path), 'r');
279
280
        return $stream !== false ? compact('stream') : false;
281
    }
282
283
    /**
284
     * @param string $directory
285
     * @param bool   $recursive
286
     *
287
     * @return bool
288
     */
289 1
    public function listContents($directory = '', $recursive = false)
290
    {
291 1
        return $this->normalizeResponse(
292 1
            Cosapi::listFolder($this->getBucket(), $directory)
293 1
        );
294
    }
295
296
    /**
297
     * @param string $path
298
     *
299
     * @return bool
300
     */
301 6
    public function getMetadata($path)
302
    {
303 6
        return $this->normalizeResponse(
304 6
            Cosapi::stat($this->getBucket(), $path)
305 6
        );
306
    }
307
308
    /**
309
     * @param string $path
310
     *
311
     * @return array|bool
312
     */
313 1
    public function getSize($path)
314
    {
315 1
        $stat = $this->getMetadata($path);
316
317
        return isset($stat['filesize']) ? ['size' => $stat['filesize']] : false;
318
    }
319
320
    /**
321
     * @param string $path
322
     *
323
     * @return array|bool
324
     */
325 1
    public function getMimetype($path)
326
    {
327 1
        $stat = $this->getMetadata($path);
328
329
        return isset($stat['custom_headers']['Content-Type'])
330
            ? ['mimetype' => $stat['custom_headers']['Content-Type']] : false;
331
    }
332
333
    /**
334
     * @param string $path
335
     *
336
     * @return array|bool
337
     */
338 1
    public function getTimestamp($path)
339
    {
340 1
        $stat = $this->getMetadata($path);
341
342
        return isset($stat['ctime']) ? ['timestamp' => $stat['ctime']] : false;
343
    }
344
345
    /**
346
     * @param string $path
347
     *
348
     * @return array|bool
349
     */
350 1
    public function getVisibility($path)
351
    {
352 1
        $stat = $this->getMetadata($path);
353
354 View Code Duplication
        if (isset($stat['authority']) && $stat['authority'] === 'eWPrivateRPublic') {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
355
            return ['visibility' => AdapterInterface::VISIBILITY_PUBLIC];
356
        }
357
358 View Code Duplication
        if (isset($stat['authority']) && $stat['authority'] === 'eWRPrivate') {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
359
            return ['visibility' => AdapterInterface::VISIBILITY_PRIVATE];
360
        }
361
362
        return false;
363
    }
364
365
    /**
366
     * Creates a temporary file
367
     *
368
     * @param string $content
369
     *
370
     * @return string
371
     * @throws RuntimeException
372
     */
373
    protected function createTemporaryFile($content)
374
    {
375
        $temporaryPath = $this->getTemporaryPath();
376
377
        if (false === $temporaryPath) {
378
            throw new RuntimeException("Unable to create temporary file in '{$temporaryPath}'.");
379
        }
380
381
        file_put_contents($temporaryPath, $content);
382
383
        // The file is automatically removed when closed, or when the script ends.
384
        register_shutdown_function(function () use ($temporaryPath) {
385
            unlink($temporaryPath);
386
        });
387
388
        return $temporaryPath;
389
    }
390
391
    /**
392
     * Gets a temporary file path.
393
     *
394
     * @return bool|string
395
     */
396
    protected function getTemporaryPath()
397
    {
398
        return tempnam(sys_get_temp_dir(), uniqid('entwechat', true));
399
    }
400
401
    /**
402
     * @param string $path
403
     * @param string $content
404
     *
405
     * @return bool
406
     */
407
    protected function setContentType($path, $content)
408
    {
409
        $custom_headers = [
410
            'Content-Type' => Util::guessMimeType($path, $content),
411
        ];
412
413
        return $this->normalizeResponse(
414
            Cosapi::update($this->getBucket(), $path, null, null, $custom_headers)
415
        );
416
    }
417
418
    /**
419
     * @param $response
420
     *
421
     * @throws RuntimeException
422
     *
423
     * @return mixed
424
     */
425 14
    protected function normalizeResponse($response)
426
    {
427 14
        if ($response['code'] == 0) {
428
            return isset($response['data']) ? $response['data'] : true;
429
        }
430
431 14
        if ($this->debug) {
432 14
            throw new RuntimeException($response['message'], $response['code']);
433
        }
434
435
        return false;
436
    }
437
}
438