Issues in ObjectBase.php (2.x) - Issues in 2.x - fusonic/opengraph - Measure and Improve Code Quality continuously with Scrutinizer

Issues (7)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Objects/ObjectBase.php (1 issue)

Labels

Bug 1

Severity

Critical 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

namespace Fusonic\OpenGraph\Objects;

use DateTimeImmutable;
use Fusonic\OpenGraph\Elements\Audio;
use Fusonic\OpenGraph\Elements\Image;
use Fusonic\OpenGraph\Elements\Video;
use Fusonic\OpenGraph\Property;
use UnexpectedValueException;

/**
 * Abstract base class for all Open Graph objects (website, video, ...)
 */
abstract class ObjectBase
{
    /**
     * An array of audio resources attached to the object.
     *
     * @var Audio[]
     */
    public array $audios = [];


    /**
     * A short description of the object.
     */
    public ?string $description = null;

    /**
     * The word that appears before the object's title in a sentence. This is an list of words from 'a', 'an', 'the',
     * ' "" ', or 'auto'. If 'auto' is chosen, the consumer of the object will chose between 'a' or 'an'. The default is
     * the blank, "".
     */
    public ?string $determiner = null;

    /**
     * An array of images attached to the object.
     *
     * @var Image[]
     */
    public array $images = [];

    /**
     * The locale that the object's tags are marked up in, in the format language_TERRITORY.
     */
    public ?string $locale = null;

    /**
     * An array of alternate locales in which the resource is available.
     *
     * @var string[]
     */
    public array $localeAlternate = [];

    public ?bool $richAttachment = null;

    /**
     * An array of URLs of related resources.
     *
     * @var string[]
     */
    public array $seeAlso = [];

    /**
     * The name of the web site upon which the object resides.
     */
    public ?string $siteName = null;

    /**
     * The title of the object as it should appear in the graph.
     */
    public ?string $title = null;

    /**
     * The type of the object, such as 'article'.
     */
    public ?string $type = null;

    /**
     * The time when the object was last updated.
     */
    public ?DateTimeImmutable $updatedTime = null;

    /**
     * The canonical URL of the object, used as its ID in the graph.
     */
    public ?string $url = null;

    /**
     * An array of videos attached to the object.
     *
     * @var Video[]
     */
    public array $videos = [];

    public function __construct()
    {
    }

    /**
     * Assigns all properties given to the this Object instance.
     *
     * @param   array|Property[]    $properties     Array of all properties to assign.
     * @param   bool                $debug          Throw exceptions when parsing or not.
     *
     * @throws  UnexpectedValueException
     */
    public function assignProperties(array $properties, $debug = false): void
    {
        foreach ($properties as $property) {
            $name = $property->key;
            $value = $property->value;

            switch($name) {
                case Property::AUDIO:
                case Property::AUDIO_URL:
                    $this->audios[] = new Audio($value);
                    break;
                case Property::AUDIO_SECURE_URL:
                case Property::AUDIO_TYPE:
                    if (count($this->audios) > 0) {
                        $this->handleAudioAttribute($this->audios[count($this->audios) - 1], $name, $value);
                    } elseif ($debug) {
                        throw new UnexpectedValueException(
                            sprintf(
                                "Found '%s' property but no audio was found before.",
                                $name
                            )
                        );
                    }
                    break;
                case Property::DESCRIPTION:
                    if ($this->description === null) {
                        $this->description = $value;
                    }
                    break;
                case Property::DETERMINER:
                    if ($this->determiner === null) {
                        $this->determiner = $value;
                    }
                    break;
                case Property::IMAGE:
                case Property::IMAGE_URL:
                    $this->images[] = new Image($value);
                    break;
                case Property::IMAGE_HEIGHT:
                case Property::IMAGE_SECURE_URL:
                case Property::IMAGE_TYPE:
                case Property::IMAGE_WIDTH:
                case Property::IMAGE_USER_GENERATED:
                    if (count($this->images) > 0) {
                        $this->handleImageAttribute($this->images[count($this->images) - 1], $name, $value);
                    } elseif ($debug) {
                        throw new UnexpectedValueException(
                            sprintf(
                                "Found '%s' property but no image was found before.",
                                $name
                            )
                        );
                    }
                    break;
                case Property::LOCALE:
                    if ($this->locale === null) {
                        $this->locale = $value;
                    }
                    break;
                case Property::LOCALE_ALTERNATE:
                    $this->localeAlternate[] = $value;
                    break;
                case Property::RICH_ATTACHMENT:
                    $this->richAttachment = $this->convertToBoolean($value);
                    break;
                case Property::SEE_ALSO:
                    $this->seeAlso[] = $value;
                    break;
                case Property::SITE_NAME:
                    if ($this->siteName === null) {
                        $this->siteName = $value;
                    }
                    break;
                case Property::TITLE:
                    if ($this->title === null) {
                        $this->title = $value;
                    }
                    break;
                case Property::UPDATED_TIME:
                    if ($this->updatedTime === null) {
                        $this->updatedTime = $this->convertToDateTime($value);
                    }
                    break;
                case Property::URL:
                    if ($this->url === null) {
                        $this->url = $value;
                    }
                    break;
                case Property::VIDEO:
                case Property::VIDEO_URL:
                    $this->videos[] = new Video($value);
                    break;
                case Property::VIDEO_HEIGHT:
                case Property::VIDEO_SECURE_URL:
                case Property::VIDEO_TYPE:
                case Property::VIDEO_WIDTH:
                    if (count($this->videos) > 0) {
                        $this->handleVideoAttribute($this->videos[count($this->videos) - 1], $name, $value);
                    } elseif ($debug) {
                        throw new UnexpectedValueException(sprintf(
                            "Found '%s' property but no video was found before.",
                            $name
                        ));
                    }
            }
        }
    }

    private function handleImageAttribute(Image $element, string $name, string $value): void
    {
        switch($name)
        {
            case Property::IMAGE_HEIGHT:
                $element->height = (int)$value;
                break;
            case Property::IMAGE_WIDTH:
                $element->width = (int)$value;
                break;
            case Property::IMAGE_TYPE:
                $element->type = $value;
                break;
            case Property::IMAGE_SECURE_URL:
                $element->secureUrl = $value;
                break;
            case Property::IMAGE_USER_GENERATED:
                $element->userGenerated = $this->convertToBoolean($value);
                break;
        }
    }

    private function handleVideoAttribute(Video $element, string $name, string $value): void
    {
        switch($name)
        {
            case Property::VIDEO_HEIGHT:
                $element->height = (int)$value;
                break;
            case Property::VIDEO_WIDTH:
                $element->width = (int)$value;
                break;
            case Property::VIDEO_TYPE:
                $element->type = $value;
                break;
            case Property::VIDEO_SECURE_URL:
                $element->secureUrl = $value;
                break;
        }
    }

    private function handleAudioAttribute(Audio $element, string $name, string $value): void
    {
        switch($name)
        {
            case Property::AUDIO_TYPE:
                $element->type = $value;
                break;
            case Property::AUDIO_SECURE_URL:
                $element->secureUrl = $value;
                break;
        }
    }

    protected function convertToDateTime(string $value): ?DateTimeImmutable
    {
        try {
            return new DateTimeImmutable($value);
        } catch (\Exception $e) {
            return null;
        }
    }

    protected function convertToBoolean(string $value): bool
    {
        switch(strtolower($value))
        {
            case "1":
            case "true":
                return true;
            default:
                return false;
        }
    }

    /**
     * Gets all properties set on this object.
     *
     * @return  Property[]
     */
    public function getProperties(): array
    {
        $properties = [];

        foreach ($this->audios as $audio) {
            $properties = array_merge($properties, $audio->getProperties());
        }
        
        if ($this->title !== null) {
            $properties[] = new Property(Property::TITLE, $this->title);
        }

        if ($this->description !== null) {
            $properties[] = new Property(Property::DESCRIPTION, $this->description);
        }

        if ($this->determiner !== null) {
            $properties[] = new Property(Property::DETERMINER, $this->determiner);
        }

        foreach ($this->images as $image) {
            $properties = array_merge($properties, $image->getProperties());
        }

        if ($this->locale !== null) {
            $properties[] = new Property(Property::LOCALE, $this->locale);
        }

        foreach ($this->localeAlternate as $locale) {
            $properties[] = new Property(Property::LOCALE_ALTERNATE, $locale);
        }

        if ($this->richAttachment !== null) {
            $properties[] = new Property(Property::RICH_ATTACHMENT, (int)$this->richAttachment);
        }

        foreach ($this->seeAlso as $seeAlso) {
            $properties[] = new Property(Property::SEE_ALSO, $seeAlso);
        }

        if ($this->siteName !== null) {
            $properties[] = new Property(Property::SITE_NAME, $this->siteName);
        }

        if ($this->type !== null) {
            $properties[] = new Property(Property::TYPE, $this->type);
        }

        if ($this->updatedTime !== null) {
            $properties[] = new Property(Property::UPDATED_TIME, $this->updatedTime->format("c"));
        }

        if ($this->url !== null) {
            $properties[] = new Property(Property::URL, $this->url);
        }

        foreach ($this->videos as $video) {
            $properties = array_merge($properties, $video->getProperties());
        }

        return $properties;
    }
}


1		<?php
2
3		namespace Fusonic\OpenGraph\Objects;
4
5		use DateTimeImmutable;
6		use Fusonic\OpenGraph\Elements\Audio;
7		use Fusonic\OpenGraph\Elements\Image;
8		use Fusonic\OpenGraph\Elements\Video;
9		use Fusonic\OpenGraph\Property;
10		use UnexpectedValueException;
11
12		/**
13		* Abstract base class for all Open Graph objects (website, video, ...)
14		*/
15		abstract class ObjectBase
16		{
17		/**
18		* An array of audio resources attached to the object.
19		*
20		* @var Audio[]
21		*/
22		public array $audios = [];
		0 ignored issues – show Bug introduced 2020-05-13 12:23 UTC by Report Bug Copy Issue Report Show Similar Issues like this This code did not parse for me. Apparently, there is an error somewhere around this line: Syntax error, unexpected T_ARRAY, expecting T_FUNCTION or T_CONST Loading history...
23
24		/**
25		* A short description of the object.
26		*/
27		public ?string $description = null;
28
29		/**
30		* The word that appears before the object's title in a sentence. This is an list of words from 'a', 'an', 'the',
31		* ' "" ', or 'auto'. If 'auto' is chosen, the consumer of the object will chose between 'a' or 'an'. The default is
32		* the blank, "".
33		*/
34		public ?string $determiner = null;
35
36		/**
37		* An array of images attached to the object.
38		*
39		* @var Image[]
40		*/
41		public array $images = [];
42
43		/**
44		* The locale that the object's tags are marked up in, in the format language_TERRITORY.
45		*/
46		public ?string $locale = null;
47
48		/**
49		* An array of alternate locales in which the resource is available.
50		*
51		* @var string[]
52		*/
53		public array $localeAlternate = [];
54
55		public ?bool $richAttachment = null;
56
57		/**
58		* An array of URLs of related resources.
59		*
60		* @var string[]
61		*/
62		public array $seeAlso = [];
63
64		/**
65		* The name of the web site upon which the object resides.
66		*/
67		public ?string $siteName = null;
68
69		/**
70		* The title of the object as it should appear in the graph.
71		*/
72		public ?string $title = null;
73
74		/**
75		* The type of the object, such as 'article'.
76		*/
77		public ?string $type = null;
78
79		/**
80		* The time when the object was last updated.
81		*/
82		public ?DateTimeImmutable $updatedTime = null;
83
84		/**
85		* The canonical URL of the object, used as its ID in the graph.
86		*/
87		public ?string $url = null;
88
89		/**
90		* An array of videos attached to the object.
91		*
92		* @var Video[]
93		*/
94		public array $videos = [];
95
96	28	public function __construct()
97		{
98	28	}
99
100		/**
101		* Assigns all properties given to the this Object instance.
102		*
103		* @param array\|Property[] $properties Array of all properties to assign.
104		* @param bool $debug Throw exceptions when parsing or not.
105		*
106		* @throws UnexpectedValueException
107		*/
108	16	public function assignProperties(array $properties, $debug = false): void
109		{
110	16	foreach ($properties as $property) {
111	13	$name = $property->key;
112	13	$value = $property->value;
113
114		switch($name) {
115	13	case Property::AUDIO:
116	13	case Property::AUDIO_URL:
117	1	$this->audios[] = new Audio($value);
118	1	break;
119	13	case Property::AUDIO_SECURE_URL:
120	12	case Property::AUDIO_TYPE:
121	3	if (count($this->audios) > 0) {
122	1	$this->handleAudioAttribute($this->audios[count($this->audios) - 1], $name, $value);
123	2	} elseif ($debug) {
124	1	throw new UnexpectedValueException(
125		sprintf(
126	1	"Found '%s' property but no audio was found before.",
127		$name
128		)
129		);
130		}
131	2	break;
132	10	case Property::DESCRIPTION:
133	1	if ($this->description === null) {
134	1	$this->description = $value;
135		}
136	1	break;
137	10	case Property::DETERMINER:
138	1	if ($this->determiner === null) {
139	1	$this->determiner = $value;
140		}
141	1	break;
142	10	case Property::IMAGE:
143	10	case Property::IMAGE_URL:
144	2	$this->images[] = new Image($value);
145	2	break;
146	10	case Property::IMAGE_HEIGHT:
147	10	case Property::IMAGE_SECURE_URL:
148	10	case Property::IMAGE_TYPE:
149	10	case Property::IMAGE_WIDTH:
150	6	case Property::IMAGE_USER_GENERATED:
151	4	if (count($this->images) > 0) {
152	2	$this->handleImageAttribute($this->images[count($this->images) - 1], $name, $value);
153	2	} elseif ($debug) {
154	1	throw new UnexpectedValueException(
155		sprintf(
156	1	"Found '%s' property but no image was found before.",
157		$name
158		)
159		);
160		}
161	3	break;
162	6	case Property::LOCALE:
163	1	if ($this->locale === null) {
164	1	$this->locale = $value;
165		}
166	1	break;
167	6	case Property::LOCALE_ALTERNATE:
168	1	$this->localeAlternate[] = $value;
169	1	break;
170	6	case Property::RICH_ATTACHMENT:
171	1	$this->richAttachment = $this->convertToBoolean($value);
172	1	break;
173	6	case Property::SEE_ALSO:
174	1	$this->seeAlso[] = $value;
175	1	break;
176	6	case Property::SITE_NAME:
177	1	if ($this->siteName === null) {
178	1	$this->siteName = $value;
179		}
180	1	break;
181	6	case Property::TITLE:
182	3	if ($this->title === null) {
183	3	$this->title = $value;
184		}
185	3	break;
186	4	case Property::UPDATED_TIME:
187	1	if ($this->updatedTime === null) {
188	1	$this->updatedTime = $this->convertToDateTime($value);
189		}
190	1	break;
191	4	case Property::URL:
192	1	if ($this->url === null) {
193	1	$this->url = $value;
194		}
195	1	break;
196	3	case Property::VIDEO:
197	3	case Property::VIDEO_URL:
198	1	$this->videos[] = new Video($value);
199	1	break;
200	3	case Property::VIDEO_HEIGHT:
201	3	case Property::VIDEO_SECURE_URL:
202	3	case Property::VIDEO_TYPE:
203	3	case Property::VIDEO_WIDTH:
204	3	if (count($this->videos) > 0) {
205	1	$this->handleVideoAttribute($this->videos[count($this->videos) - 1], $name, $value);
206	2	} elseif ($debug) {
207	1	throw new UnexpectedValueException(sprintf(
208	1	"Found '%s' property but no video was found before.",
209		$name
210		));
211		}
212		}
213		}
214	13	}
215
216	2	private function handleImageAttribute(Image $element, string $name, string $value): void
217		{
218		switch($name)
219		{
220	2	case Property::IMAGE_HEIGHT:
221	2	$element->height = (int)$value;
222	2	break;
223	2	case Property::IMAGE_WIDTH:
224	2	$element->width = (int)$value;
225	2	break;
226	1	case Property::IMAGE_TYPE:
227	1	$element->type = $value;
228	1	break;
229	1	case Property::IMAGE_SECURE_URL:
230	1	$element->secureUrl = $value;
231	1	break;
232		case Property::IMAGE_USER_GENERATED:
233		$element->userGenerated = $this->convertToBoolean($value);
234		break;
235		}
236	2	}
237
238	1	private function handleVideoAttribute(Video $element, string $name, string $value): void
239		{
240		switch($name)
241		{
242	1	case Property::VIDEO_HEIGHT:
243	1	$element->height = (int)$value;
244	1	break;
245	1	case Property::VIDEO_WIDTH:
246	1	$element->width = (int)$value;
247	1	break;
248	1	case Property::VIDEO_TYPE:
249	1	$element->type = $value;
250	1	break;
251	1	case Property::VIDEO_SECURE_URL:
252	1	$element->secureUrl = $value;
253	1	break;
254		}
255	1	}
256
257	1	private function handleAudioAttribute(Audio $element, string $name, string $value): void
258		{
259		switch($name)
260		{
261	1	case Property::AUDIO_TYPE:
262	1	$element->type = $value;
263	1	break;
264	1	case Property::AUDIO_SECURE_URL:
265	1	$element->secureUrl = $value;
266	1	break;
267		}
268	1	}
269
270	1	protected function convertToDateTime(string $value): ?DateTimeImmutable
271		{
272		try {
273	1	return new DateTimeImmutable($value);
274		} catch (\Exception $e) {
275		return null;
276		}
277		}
278
279	1	protected function convertToBoolean(string $value): bool
280		{
281	1	switch(strtolower($value))
282		{
283	1	case "1":
284	1	case "true":
285	1	return true;
286		default:
287		return false;
288		}
289		}
290
291		/**
292		* Gets all properties set on this object.
293		*
294		* @return Property[]
295		*/
296		public function getProperties(): array
297		{
298		$properties = [];
299
300		foreach ($this->audios as $audio) {
301		$properties = array_merge($properties, $audio->getProperties());
302		}
303
304		if ($this->title !== null) {
305		$properties[] = new Property(Property::TITLE, $this->title);
306		}
307
308		if ($this->description !== null) {
309		$properties[] = new Property(Property::DESCRIPTION, $this->description);
310		}
311
312		if ($this->determiner !== null) {
313		$properties[] = new Property(Property::DETERMINER, $this->determiner);
314		}
315
316		foreach ($this->images as $image) {
317		$properties = array_merge($properties, $image->getProperties());
318		}
319
320		if ($this->locale !== null) {
321		$properties[] = new Property(Property::LOCALE, $this->locale);
322		}
323
324		foreach ($this->localeAlternate as $locale) {
325		$properties[] = new Property(Property::LOCALE_ALTERNATE, $locale);
326		}
327
328		if ($this->richAttachment !== null) {
329		$properties[] = new Property(Property::RICH_ATTACHMENT, (int)$this->richAttachment);
330		}
331
332		foreach ($this->seeAlso as $seeAlso) {
333		$properties[] = new Property(Property::SEE_ALSO, $seeAlso);
334		}
335
336		if ($this->siteName !== null) {
337		$properties[] = new Property(Property::SITE_NAME, $this->siteName);
338		}
339
340		if ($this->type !== null) {
341		$properties[] = new Property(Property::TYPE, $this->type);
342		}
343
344		if ($this->updatedTime !== null) {
345		$properties[] = new Property(Property::UPDATED_TIME, $this->updatedTime->format("c"));
346		}
347
348		if ($this->url !== null) {
349		$properties[] = new Property(Property::URL, $this->url);
350		}
351
352		foreach ($this->videos as $video) {
353		$properties = array_merge($properties, $video->getProperties());
354		}
355
356		return $properties;
357		}
358		}
359

fusonic / opengraph

Issues (7)

Security Analysis no request data

src/Objects/ObjectBase.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like