Issues in Adapter.php (master) - Issues in master - freyo/flysystem-qcloud-cos-v3 - Measure and Improve Code Quality continuously with Scrutinizer

Issues (20)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Adapter.php (1 issue)

Labels

Severity

Major 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

namespace Freyo\Flysystem\QcloudCOSv3;

use Freyo\Flysystem\QcloudCOSv3\Client\Conf;
use Freyo\Flysystem\QcloudCOSv3\Client\Cosapi;
use Freyo\Flysystem\QcloudCOSv3\Exceptions\RuntimeException;
use League\Flysystem\Adapter\AbstractAdapter;
use League\Flysystem\AdapterInterface;
use League\Flysystem\Config;
use League\Flysystem\Util;

/**
 * Class Adapter.
 */
class Adapter extends AbstractAdapter
{
    /**
     * @var
     */
    protected $bucket;

    /**
     * @var
     */
    protected $debug;

    /**
     * Adapter constructor.
     *
     * @param $config
     */
    public function __construct($config)
    {
        Conf::setAppId($config['app_id']);
        Conf::setSecretId($config['secret_id']);
        Conf::setSecretKey($config['secret_key']);

        $this->bucket = $config['bucket'];
        $this->debug  = $config['debug'];

        $this->setPathPrefix($config['protocol'] . '://' . $config['domain'] . '/');

        Cosapi::setTimeout($config['timeout']);
    }

    /**
     * @return string
     */
    public function getBucket()
    {
        return $this->bucket;
    }

    /**
     * @param string $path
     *
     * @return string
     */
    public function getUrl($path)
    {
        return $this->applyPathPrefix($path);
    }

    /**
     * @param string $path
     * @param string $contents
     * @param Config $config
     *
     * @throws RuntimeException
     *
     * @return array|bool
     */
    public function write($path, $contents, Config $config)
    {
        $temporaryPath = $this->createTemporaryFile($contents);

        $response = Cosapi::upload($this->getBucket(), $temporaryPath, $path,
            null, null, $config->get('insertOnly', 1));

        $response = $this->normalizeResponse($response);

        if (false !== $response) {
            $this->setContentType($path, $contents);;
        }

        return $response;
    }

    /**
     * @param string   $path
     * @param resource $resource
     * @param Config   $config
     *
     * @throws RuntimeException
     *
     * @return array|bool
     */
    public function writeStream($path, $resource, Config $config)
    {
        $uri = stream_get_meta_data($resource)['uri'];

        $response = Cosapi::upload($this->getBucket(), $uri, $path,
            null, null, $config->get('insertOnly', 1));

        $response = $this->normalizeResponse($response);

        if (false !== $response) {
            $this->setContentType($path, stream_get_contents($resource));
        }

        return $response;
    }

    /**
     * @param string $path
     * @param string $contents
     * @param Config $config
     *
     * @throws RuntimeException
     *
     * @return array|bool
     */
    public function update($path, $contents, Config $config)
    {
        $temporaryPath = $this->createTemporaryFile($contents);

        $response = Cosapi::upload($this->getBucket(), $temporaryPath, $path,
            null, null, $config->get('insertOnly', 0));

        $response = $this->normalizeResponse($response);

        if (false !== $response) {
            $this->setContentType($path, $contents);
        }

        return $response;
    }

    /**
     * @param string   $path
     * @param resource $resource
     * @param Config   $config
     *
     * @throws RuntimeException
     *
     * @return array|bool
     */
    public function updateStream($path, $resource, Config $config)
    {
        $uri = stream_get_meta_data($resource)['uri'];

        $response = Cosapi::upload($this->getBucket(), $uri, $path,
            null, null, $config->get('insertOnly', 0));

        $response = $this->normalizeResponse($response);

        if (false !== $response) {
            $this->setContentType($path, stream_get_contents($resource));
        }

        return $response;
    }

    /**
     * @param string $path
     * @param string $newpath
     *
     * @return bool
     */
    public function rename($path, $newpath)
    {
        return (bool)$this->normalizeResponse(
            Cosapi::move($this->getBucket(), $path, $newpath, 1)
        );
    }

    /**
     * @param string $path
     * @param string $newpath
     *
     * @return bool
     */
    public function copy($path, $newpath)
    {
        $resource = $this->read($path);

        return isset($resource['contents'])
            ? (bool)$this->update($newpath, $resource['contents'], new Config()) : false;
    }

    /**
     * @param string $path
     *
     * @return bool
     */
    public function delete($path)
    {
        return (bool)$this->normalizeResponse(
            Cosapi::delFile($this->getBucket(), $path)
        );
    }

    /**
     * @param string $dirname
     *
     * @return bool
     */
    public function deleteDir($dirname)
    {
        return (bool)$this->normalizeResponse(
            Cosapi::delFolder($this->getBucket(), $dirname)
        );
    }

    /**
     * @param string $dirname
     * @param Config $config
     *
     * @return array|bool
     */
    public function createDir($dirname, Config $config)
    {
        return $this->normalizeResponse(
            Cosapi::createFolder($this->getBucket(), $dirname)
        );
    }

    /**
     * @param string $path
     * @param string $visibility
     *
     * @return bool
     */
    public function setVisibility($path, $visibility)
    {
        $visibility = ($visibility === AdapterInterface::VISIBILITY_PUBLIC)
            ? 'eWPrivateRPublic' : 'eWRPrivate';

        return (bool)$this->normalizeResponse(
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
            Cosapi::update($this->getBucket(), $path, null, $visibility)
        );
    }

    /**
     * @param string $path
     *
     * @return bool
     */
    public function has($path)
    {
        try {
            return (bool)$this->getMetadata($path);
        } catch (RuntimeException $exception) {
            return false;
        }
    }

    /**
     * @param string $path
     *
     * @return array|bool
     */
    public function read($path)
    {
        $contents = file_get_contents($this->applyPathPrefix($path));

        return $contents !== false ? compact('contents') : false;
    }

    /**
     * @param string $path
     *
     * @return array|bool
     */
    public function readStream($path)
    {
        $stream = fopen($this->applyPathPrefix($path), 'r');

        return $stream !== false ? compact('stream') : false;
    }

    /**
     * @param string $directory
     * @param bool   $recursive
     *
     * @return bool
     */
    public function listContents($directory = '', $recursive = false)
    {
        return $this->normalizeResponse(
            Cosapi::listFolder($this->getBucket(), $directory)
        );
    }

    /**
     * @param string $path
     *
     * @return bool
     */
    public function getMetadata($path)
    {
        return $this->normalizeResponse(
            Cosapi::stat($this->getBucket(), $path)
        );
    }

    /**
     * @param string $path
     *
     * @return array|bool
     */
    public function getSize($path)
    {
        $stat = $this->getMetadata($path);

        return isset($stat['filesize']) ? ['size' => $stat['filesize']] : false;
    }

    /**
     * @param string $path
     *
     * @return array|bool
     */
    public function getMimetype($path)
    {
        $stat = $this->getMetadata($path);

        return isset($stat['custom_headers']['Content-Type'])
            ? ['mimetype' => $stat['custom_headers']['Content-Type']] : false;
    }

    /**
     * @param string $path
     *
     * @return array|bool
     */
    public function getTimestamp($path)
    {
        $stat = $this->getMetadata($path);

        return isset($stat['ctime']) ? ['timestamp' => $stat['ctime']] : false;
    }

    /**
     * @param string $path
     *
     * @return array|bool
     */
    public function getVisibility($path)
    {
        $stat = $this->getMetadata($path);

        if (isset($stat['authority']) && $stat['authority'] === 'eWPrivateRPublic') {
            return ['visibility' => AdapterInterface::VISIBILITY_PUBLIC];
        }

        if (isset($stat['authority']) && $stat['authority'] === 'eWRPrivate') {
            return ['visibility' => AdapterInterface::VISIBILITY_PRIVATE];
        }

        return false;
    }

    /**
     * Creates a temporary file
     *
     * @param string $content
     *
     * @return string
     * @throws RuntimeException
     */
    protected function createTemporaryFile($content)
    {
        $temporaryPath = $this->getTemporaryPath();

        if (false === $temporaryPath) {
            throw new RuntimeException("Unable to create temporary file in '{$temporaryPath}'.");
        }

        file_put_contents($temporaryPath, $content);

        // The file is automatically removed when closed, or when the script ends.
        register_shutdown_function(function () use ($temporaryPath) {
            unlink($temporaryPath);
        });

        return $temporaryPath;
    }

    /**
     * Gets a temporary file path.
     *
     * @return bool|string
     */
    protected function getTemporaryPath()
    {
        return tempnam(sys_get_temp_dir(), uniqid('entwechat', true));
    }

    /**
     * @param string $path
     * @param string $content
     *
     * @return bool
     */
    protected function setContentType($path, $content)
    {
        $custom_headers = [
            'Content-Type' => Util::guessMimeType($path, $content),
        ];

        return $this->normalizeResponse(
            Cosapi::update($this->getBucket(), $path, null, null, $custom_headers)
        );
    }

    /**
     * @param $response
     *
     * @throws RuntimeException
     *
     * @return mixed
     */
    protected function normalizeResponse($response)
    {
        if ($response['code'] == 0) {
            return isset($response['data']) ? $response['data'] : true;
        }

        if ($this->debug) {
            throw new RuntimeException($response['message'], $response['code']);
        }

        return false;
    }
}


1			<?php
2
3			namespace Freyo\Flysystem\QcloudCOSv3;
4
5			use Freyo\Flysystem\QcloudCOSv3\Client\Conf;
6			use Freyo\Flysystem\QcloudCOSv3\Client\Cosapi;
7			use Freyo\Flysystem\QcloudCOSv3\Exceptions\RuntimeException;
8			use League\Flysystem\Adapter\AbstractAdapter;
9			use League\Flysystem\AdapterInterface;
10			use League\Flysystem\Config;
11			use League\Flysystem\Util;
12
13			/**
14			* Class Adapter.
15			*/
16			class Adapter extends AbstractAdapter
17			{
18			/**
19			* @var
20			*/
21			protected $bucket;
22
23			/**
24			* @var
25			*/
26			protected $debug;
27
28			/**
29			* Adapter constructor.
30			*
31			* @param $config
32			*/
33			public function __construct($config)
34			{
35			Conf::setAppId($config['app_id']);
36			Conf::setSecretId($config['secret_id']);
37			Conf::setSecretKey($config['secret_key']);
38
39			$this->bucket = $config['bucket'];
40			$this->debug = $config['debug'];
41
42			$this->setPathPrefix($config['protocol'] . '://' . $config['domain'] . '/');
43
44			Cosapi::setTimeout($config['timeout']);
45			}
46
47			/**
48			* @return string
49			*/
50	14		public function getBucket()
51			{
52	14		return $this->bucket;
53			}
54
55			/**
56			* @param string $path
57			*
58			* @return string
59			*/
60	1		public function getUrl($path)
61			{
62	1		return $this->applyPathPrefix($path);
63			}
64
65			/**
66			* @param string $path
67			* @param string $contents
68			* @param Config $config
69			*
70			* @throws RuntimeException
71			*
72			* @return array\|bool
73			*/
74		View Code Duplication	public function write($path, $contents, Config $config)
75			{
76			$temporaryPath = $this->createTemporaryFile($contents);
77
78			$response = Cosapi::upload($this->getBucket(), $temporaryPath, $path,
79			null, null, $config->get('insertOnly', 1));
80
81			$response = $this->normalizeResponse($response);
82
83			if (false !== $response) {
84			$this->setContentType($path, $contents);;
85			}
86
87			return $response;
88			}
89
90			/**
91			* @param string $path
92			* @param resource $resource
93			* @param Config $config
94			*
95			* @throws RuntimeException
96			*
97			* @return array\|bool
98			*/
99	1	View Code Duplication	public function writeStream($path, $resource, Config $config)
100			{
101	1		$uri = stream_get_meta_data($resource)['uri'];
102
103	1		$response = Cosapi::upload($this->getBucket(), $uri, $path,
104	1		null, null, $config->get('insertOnly', 1));
105
106	1		$response = $this->normalizeResponse($response);
107
108			if (false !== $response) {
109			$this->setContentType($path, stream_get_contents($resource));
110			}
111
112			return $response;
113			}
114
115			/**
116			* @param string $path
117			* @param string $contents
118			* @param Config $config
119			*
120			* @throws RuntimeException
121			*
122			* @return array\|bool
123			*/
124		View Code Duplication	public function update($path, $contents, Config $config)
125			{
126			$temporaryPath = $this->createTemporaryFile($contents);
127
128			$response = Cosapi::upload($this->getBucket(), $temporaryPath, $path,
129			null, null, $config->get('insertOnly', 0));
130
131			$response = $this->normalizeResponse($response);
132
133			if (false !== $response) {
134			$this->setContentType($path, $contents);
135			}
136
137			return $response;
138			}
139
140			/**
141			* @param string $path
142			* @param resource $resource
143			* @param Config $config
144			*
145			* @throws RuntimeException
146			*
147			* @return array\|bool
148			*/
149	1	View Code Duplication	public function updateStream($path, $resource, Config $config)
150			{
151	1		$uri = stream_get_meta_data($resource)['uri'];
152
153	1		$response = Cosapi::upload($this->getBucket(), $uri, $path,
154	1		null, null, $config->get('insertOnly', 0));
155
156	1		$response = $this->normalizeResponse($response);
157
158			if (false !== $response) {
159			$this->setContentType($path, stream_get_contents($resource));
160			}
161
162			return $response;
163			}
164
165			/**
166			* @param string $path
167			* @param string $newpath
168			*
169			* @return bool
170			*/
171	1		public function rename($path, $newpath)
172			{
173	1		return (bool)$this->normalizeResponse(
174	1		Cosapi::move($this->getBucket(), $path, $newpath, 1)
175	1		);
176			}
177
178			/**
179			* @param string $path
180			* @param string $newpath
181			*
182			* @return bool
183			*/
184			public function copy($path, $newpath)
185			{
186			$resource = $this->read($path);
187
188			return isset($resource['contents'])
189			? (bool)$this->update($newpath, $resource['contents'], new Config()) : false;
190			}
191
192			/**
193			* @param string $path
194			*
195			* @return bool
196			*/
197	1		public function delete($path)
198			{
199	1		return (bool)$this->normalizeResponse(
200	1		Cosapi::delFile($this->getBucket(), $path)
201	1		);
202			}
203
204			/**
205			* @param string $dirname
206			*
207			* @return bool
208			*/
209	1		public function deleteDir($dirname)
210			{
211	1		return (bool)$this->normalizeResponse(
212	1		Cosapi::delFolder($this->getBucket(), $dirname)
213	1		);
214			}
215
216			/**
217			* @param string $dirname
218			* @param Config $config
219			*
220			* @return array\|bool
221			*/
222	1		public function createDir($dirname, Config $config)
223			{
224	1		return $this->normalizeResponse(
225	1		Cosapi::createFolder($this->getBucket(), $dirname)
226	1		);
227			}
228
229			/**
230			* @param string $path
231			* @param string $visibility
232			*
233			* @return bool
234			*/
235	1		public function setVisibility($path, $visibility)
236			{
237	1		$visibility = ($visibility === AdapterInterface::VISIBILITY_PUBLIC)
238	1		? 'eWPrivateRPublic' : 'eWRPrivate';
239
240	1		return (bool)$this->normalizeResponse(
			0 ignored issues – show Bug Best Practice introduced 2017-04-25 05:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this The return type of `return (bool) $this->nor...h, null, $visibility));` (`boolean`) is incompatible with the return type declared by the interface `League\Flysystem\AdapterInterface::setVisibility` of type `array\|false`. If you return a value from a function or method, it should be a sub-type of the type that is given by the parent type f.e. an interface, or abstract method. This is more formally defined by the Lizkov substitution principle, and guarantees that classes that depend on the parent type can use any instance of a child type interchangably. This principle also belongs to the SOLID principles for object oriented design. Let’s take a look at an example: class Author { private $name; public function __construct($name) { $this->name = $name; } public function getName() { return $this->name; } } abstract class Post { public function getAuthor() { return 'Johannes'; } } class BlogPost extends Post { public function getAuthor() { return new Author('Johannes'); } } class ForumPost extends Post { /* ... */ } function my_function(Post $post) { echo strtoupper($post->getAuthor()); } Our function `my_function` expects a `Post` object, and outputs the author of the post. The base class `Post` returns a simple string and outputting a simple string will work just fine. However, the child class `BlogPost` which is a sub-type of `Post` instead decided to return an `object`, and is therefore violating the SOLID principles. If a `BlogPost` were passed to `my_function`, PHP would not complain, but ultimately fail when executing the `strtoupper` call in its body. Loading history...
241	1		Cosapi::update($this->getBucket(), $path, null, $visibility)
242	1		);
243			}
244
245			/**
246			* @param string $path
247			*
248			* @return bool
249			*/
250	1		public function has($path)
251			{
252			try {
253	1		return (bool)$this->getMetadata($path);
254	1		} catch (RuntimeException $exception) {
255	1		return false;
256			}
257			}
258
259			/**
260			* @param string $path
261			*
262			* @return array\|bool
263			*/
264			public function read($path)
265			{
266			$contents = file_get_contents($this->applyPathPrefix($path));
267
268			return $contents !== false ? compact('contents') : false;
269			}
270
271			/**
272			* @param string $path
273			*
274			* @return array\|bool
275			*/
276			public function readStream($path)
277			{
278			$stream = fopen($this->applyPathPrefix($path), 'r');
279
280			return $stream !== false ? compact('stream') : false;
281			}
282
283			/**
284			* @param string $directory
285			* @param bool $recursive
286			*
287			* @return bool
288			*/
289	1		public function listContents($directory = '', $recursive = false)
290			{
291	1		return $this->normalizeResponse(
292	1		Cosapi::listFolder($this->getBucket(), $directory)
293	1		);
294			}
295
296			/**
297			* @param string $path
298			*
299			* @return bool
300			*/
301	6		public function getMetadata($path)
302			{
303	6		return $this->normalizeResponse(
304	6		Cosapi::stat($this->getBucket(), $path)
305	6		);
306			}
307
308			/**
309			* @param string $path
310			*
311			* @return array\|bool
312			*/
313	1		public function getSize($path)
314			{
315	1		$stat = $this->getMetadata($path);
316
317			return isset($stat['filesize']) ? ['size' => $stat['filesize']] : false;
318			}
319
320			/**
321			* @param string $path
322			*
323			* @return array\|bool
324			*/
325	1		public function getMimetype($path)
326			{
327	1		$stat = $this->getMetadata($path);
328
329			return isset($stat['custom_headers']['Content-Type'])
330			? ['mimetype' => $stat['custom_headers']['Content-Type']] : false;
331			}
332
333			/**
334			* @param string $path
335			*
336			* @return array\|bool
337			*/
338	1		public function getTimestamp($path)
339			{
340	1		$stat = $this->getMetadata($path);
341
342			return isset($stat['ctime']) ? ['timestamp' => $stat['ctime']] : false;
343			}
344
345			/**
346			* @param string $path
347			*
348			* @return array\|bool
349			*/
350	1		public function getVisibility($path)
351			{
352	1		$stat = $this->getMetadata($path);
353
354		View Code Duplication	if (isset($stat['authority']) && $stat['authority'] === 'eWPrivateRPublic') {
355			return ['visibility' => AdapterInterface::VISIBILITY_PUBLIC];
356			}
357
358		View Code Duplication	if (isset($stat['authority']) && $stat['authority'] === 'eWRPrivate') {
359			return ['visibility' => AdapterInterface::VISIBILITY_PRIVATE];
360			}
361
362			return false;
363			}
364
365			/**
366			* Creates a temporary file
367			*
368			* @param string $content
369			*
370			* @return string
371			* @throws RuntimeException
372			*/
373			protected function createTemporaryFile($content)
374			{
375			$temporaryPath = $this->getTemporaryPath();
376
377			if (false === $temporaryPath) {
378			throw new RuntimeException("Unable to create temporary file in '{$temporaryPath}'.");
379			}
380
381			file_put_contents($temporaryPath, $content);
382
383			// The file is automatically removed when closed, or when the script ends.
384			register_shutdown_function(function () use ($temporaryPath) {
385			unlink($temporaryPath);
386			});
387
388			return $temporaryPath;
389			}
390
391			/**
392			* Gets a temporary file path.
393			*
394			* @return bool\|string
395			*/
396			protected function getTemporaryPath()
397			{
398			return tempnam(sys_get_temp_dir(), uniqid('entwechat', true));
399			}
400
401			/**
402			* @param string $path
403			* @param string $content
404			*
405			* @return bool
406			*/
407			protected function setContentType($path, $content)
408			{
409			$custom_headers = [
410			'Content-Type' => Util::guessMimeType($path, $content),
411			];
412
413			return $this->normalizeResponse(
414			Cosapi::update($this->getBucket(), $path, null, null, $custom_headers)
415			);
416			}
417
418			/**
419			* @param $response
420			*
421			* @throws RuntimeException
422			*
423			* @return mixed
424			*/
425	14		protected function normalizeResponse($response)
426			{
427	14		if ($response['code'] == 0) {
428			return isset($response['data']) ? $response['data'] : true;
429			}
430
431	14		if ($this->debug) {
432	14		throw new RuntimeException($response['message'], $response['code']);
433			}
434
435			return false;
436			}
437			}
438

freyo / flysystem-qcloud-cos-v3

Issues (20)

Security Analysis no request data

src/Adapter.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like