Issues (320)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/php/Apix/Config.php (13 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 *
5
 * This file is part of the Apix Project.
6
 *
7
 * (c) Franck Cassedanne <franck at ouarz.net>
8
 *
9
 * @license     http://opensource.org/licenses/BSD-3-Clause  New BSD License
10
 *
11
 */
12
13
namespace Apix;
14
15
class Config implements \ArrayAccess
16
{
17
    /**
18
     * Holds the config array.
19
     * @var array
20
     */
21
    public $config = array();
22
23
    /**
24
     * TEMP: Holds the singleton instance.
25
     * @var Config
26
     */
27
    private static $instance = null;
28
29
    /**
30
     * TEMP: Returns as a singleton instance.
31
     *
32
     * @return Config
33
     */
34
    public static function getInstance($config=null)
35
    {
36
        if (null === self::$instance) {
37
            self::$instance = new self($config);
38
        }
39
40
        return self::$instance;
41
    }
42
43
    /**
44
     * TEMP: disalow cloning.
45
     *
46
     * @codeCoverageIgnore
47
     */
48
    final private function __clone() {}
49
50
    /**
51
     * Initialises and sets the config property.
52
     *
53
     * @return Config
0 ignored issues
show
Comprehensibility Best Practice introduced by
Adding a @return annotation to constructors is generally not recommended as a constructor does not have a meaningful return value.

Adding a @return annotation to a constructor is not recommended, since a constructor does not have a meaningful return value.

Please refer to the PHP core documentation on constructors.

Loading history...
54
     */
55
    public function __construct($config=null)
56
    {
57
        switch (true) {
58
59
            case is_array($config):
60
                // add from user provided array
61
                break;
62
63
            case is_string($config):
64
                // add from a user file
65
                $config = $this->getConfigFromFile($config);
66
                break;
67
68
            default:
0 ignored issues
show
The default body in a switch statement must start on the line following the statement.

According to the PSR-2, the body of a default statement must start on the line immediately following the statement.

switch ($expr) {
    default:
        doSomething(); //right
        break;
}


switch ($expr) {
    default:

        doSomething(); //wrong
        break;
}

To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.

Loading history...
69
70
                // add from the HOME dir
71
                // $file = getenv('HOME') . '/.apix/config.php';
0 ignored issues
show
Unused Code Comprehensibility introduced by
43% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
72
                // if (file_exists($file)) {
0 ignored issues
show
Unused Code Comprehensibility introduced by
64% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
73
                //     $config = $this->getConfigFromFile($file);
0 ignored issues
show
Unused Code Comprehensibility introduced by
59% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
74
                // }
75
76
                // default to the distribution file
77
                $config = null;
78
        }
79
80
        $this->setConfig($config);
81
    }
82
83
    /**
84
     * Sets the config array from a file.
85
     *
86
     * @param  string            $file The full path to a configuration file.
87
     * @throws \RuntimeException
88
     * @return void;
0 ignored issues
show
The doc-type void; could not be parsed: Expected "|" or "end of type", but got ";" at position 4. (view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
89
     */
90
    public function getConfigFromFile($file)
91
    {
92
        if (!is_file($file)) {
93
            throw new \RuntimeException(
94
                sprintf('The "%s" config file does not exist.', $file),
95
                5000
96
            );
97
        }
98
99
        $config = require $file;
100
        if (null === $config || !is_array($config)) {
101
            throw new \RuntimeException(
102
                sprintf('The "%s" config file must return an array.', $file),
103
                5001
104
            );
105
        }
106
107
        return $config;
108
    }
109
110
    /**
111
     * Sets the config property and merge the defaults.
112
     *
113
     * @param array $config=null
0 ignored issues
show
There is no parameter named $config=null. Did you maybe mean $config?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function. It has, however, found a similar but not annotated parameter which might be a good fit.

Consider the following example. The parameter $ireland is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $ireland
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was changed, but the annotation was not.

Loading history...
114
     */
115
    public function setConfig(array $config=null)
116
    {
117
        $defaults = $this->getConfigDefaults();
118
        $this->config = null === $config ? $defaults : $config+$defaults;
119
    }
120
121
    /**
122
     * Returns the config array.
123
     *
124
     * @return array
125
     */
126
    public function getConfig()
127
    {
128
        return $this->config;
129
    }
130
131
    /**
132
     * Returns the specified config value using its index key. If the index key
133
     * is not set then it will return the whole config property.
134
     *
135
     * @param  string                    $key=null The key to retrieve.
0 ignored issues
show
There is no parameter named $key=null. Was it maybe removed?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.

Consider the following example. The parameter $italy is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was removed, but the annotation was not.

Loading history...
136
     * @return mixed
137
     * @throws \InvalidArgumentException
138
     */
139
    public function get($key=null)
140
    {
141
        if (is_null($key)) {
142
            return $this->getConfig();
143
        } elseif (isset($this->config[$key])) {
144
            return $this->config[$key];
145
        }
146
147
        throw new \InvalidArgumentException(
148
            sprintf('Config for "%s" does not exists.', $key)
149
        );
150
    }
151
152
    /**
153
     * Sets as new a mixed value to a specified key.
154
     *
155
     * @param string $key The key to set.
156
     * @param mixed  $mix The mixed value to set.
157
     */
158
    public function set($key, $mix)
159
    {
160
        $this->config[$key] = $mix;
161
    }
162
163
    /**
164
     * Adds the mixed value to a specified key.
165
     *
166
     * @param string $key The key to add to.
167
     * @param mixed  $mix The mixed value to add.
168
     */
169
    public function add($key, $mix)
170
    {
171
        $this->config[$key][] = $mix;
172
    }
173
174
    /**
175
     * Returns the specified default config value using its index key.
176
     * If the index key is not set then it will return the whole default config property.
177
     *
178
     * @param  string                    $key=null The key to retrieve.
0 ignored issues
show
There is no parameter named $key=null. Was it maybe removed?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.

Consider the following example. The parameter $italy is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was removed, but the annotation was not.

Loading history...
179
     * @return mixed
180
     * @throws \InvalidArgumentException
181
     */
182
    public function getDefault($key=null)
183
    {
184
        if (is_null($key)) {
185
            return $this->config['default'];
186
        } elseif (isset($this->config['default'][$key])) {
187
            return $this->config['default'][$key];
188
        }
189
190
        throw new \InvalidArgumentException(
191
            sprintf('Default config for "%s" does not exists.', $key)
192
        );
193
    }
194
195
    /**
196
     * Returns a specified sub-array type from config.
197
     * If an index key is specified return the corresponding (mixed) value.
198
     *
199
     * @param  string                    $type     The sub-array type to retrieve.
200
     * @param  string                    $key=null A key to narrow the retrieval.
0 ignored issues
show
There is no parameter named $key=null. Was it maybe removed?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.

Consider the following example. The parameter $italy is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was removed, but the annotation was not.

Loading history...
201
     * @return mixed
202
     * @throws \InvalidArgumentException
203
     */
204
    public function retrieve($type, $key=null)
205
    {
206
        // TODO: will optimise this...
207
        $config = isset($this->config['default'][$type])
208
                    ? $this->config[$type]+$this->getDefault($type)
209
                    : $this->config[$type];
210
211
        if (null === $key) {
212
            return $config;
213
        } elseif (isset($config[$key])) {
214
            return $config[$key];
215
        }
216
217
        throw new \RuntimeException(
218
            sprintf('"%s" does not exists in "%s".', $key, $type)
219
        );
220
    }
221
222
    /**
223
     * Returns all the resources or as the specified.
224
     *
225
     * @param string $key=null The resource key to retrieve.
0 ignored issues
show
There is no parameter named $key=null. Was it maybe removed?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.

Consider the following example. The parameter $italy is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was removed, but the annotation was not.

Loading history...
226
     * @see     self::retrieve
227
     */
228
    public function getResources($key=null)
229
    {
230
        return $this->retrieve('resources', $key);
231
    }
232
233
    /**
234
     * TEMP: Returns the default configuration.
235
     * TODO: should use 'config.dist.php'
236
     *
237
     * @return array
238
     */
239
    public function getConfigDefaults()
240
    {
241
        // $file = realpath(__DIR__ . '/../../data/distribution/config.dist.php');
0 ignored issues
show
Unused Code Comprehensibility introduced by
43% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
242
        $file = __DIR__ . '/../../data/distribution/config.dist.php';
243
244
        return $this->getConfigFromFile($file);
245
    }
246
247
    /**
248
     * Returns the specified service -- or all if unspecified.
249
     *
250
     * @param  string $key=null The service key to retrieve.
0 ignored issues
show
There is no parameter named $key=null. Was it maybe removed?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.

Consider the following example. The parameter $italy is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was removed, but the annotation was not.

Loading history...
251
     * @see self::retrieve
252
     * @return mixed  Generally should return a callback
253
     */
254
    public function getServices($key=null, $args=null)
255
    {
256
        $service = $this->retrieve('services', $key);
257
258
        return is_callable($service) ? $service($args) : $service;
259
    }
260
261
    /**
262
     * Sets the specified name, value as a service.
263
     *
264
     * @param  string $name The service name to set.
265
     * @param  mixed  $mix  The corresponding value to set.
266
     * @return void
267
     */
268
    public function setService($name, $mix)
269
    {
270
        $this->config['services'][$name] = $mix;
271
    }
272
273
    /**
274
     * {@inheritdoc}
275
     * @link http://php.net/manual/en/arrayaccess.offsetexists.php
276
     * @param mixed $offset - An offset to check for.
277
     * @return boolean true on success or false on failure.
278
     */
279
    public function offsetExists($offset)
280
    {
281
        return isset($this->config[$offset]);
282
    }
283
284
    /**
285
     * {@inheritdoc}
286
     * @link http://php.net/manual/en/arrayaccess.offsetget.php
287
     * @param mixed $offset The offset to retrieve.
288
     * @return mixed Can return all value types.
289
     */
290
    public function offsetGet($offset)
291
    {
292
        return $this->config[$offset];
293
    }
294
295
    /**
296
     * {@inheritdoc}
297
     * @link http://php.net/manual/en/arrayaccess.offsetset.php
298
     * @param mixed $offset The offset to assign the value to.
299
     * @param mixed $value The value to set.
300
     * @return void
301
     */
302
    public function offsetSet($offset, $value)
303
    {
304
        $this->config[$offset] = $value;
305
    }
306
307
    /**
308
     * {@inheritdoc}
309
     * @link http://php.net/manual/en/arrayaccess.offsetunset.php
310
     * @param mixed $offset  The offset to unset.
311
     * @return void
312
     */
313
    public function offsetUnset($offset)
314
    {
315
        unset($this->config[$offset]);
316
    }
317
318
    /* --- below obsolete --- */
319
320
    /**
321
     * TEMP: Holds the injected array.
322
     * @var array
323
     */
324
    private $injected;
325
326
    /**
327
     * TEMP: Sets/injects a key/value pair in the injected array.
328
     *
329
     * @param  string $key   An index key to set.
330
     * @param  mixed  $value The value to inject.
331
     * @return void
332
     */
333
    public function inject($key, $value)
334
    {
335
        $this->injected[$key] = $value;
336
    }
337
338
    /**
339
     * TEMP: Returns the specified injected key.
340
     *
341
     * @param  string $key The index key to retrieve.
342
     * @return mixed
343
     */
344
    public function getInjected($key)
345
    {
346
        return $this->injected[$key];
347
    }
348
349
}
350