Issues (53)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Xml/ContainerBuilder.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Fwk
4
 *
5
 * Copyright (c) 2011-2012, Julien Ballestracci <[email protected]>.
6
 * All rights reserved.
7
 *
8
 * For the full copyright and license information, please view the LICENSE
9
 * file that was distributed with this source code.
10
 *
11
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
12
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
13
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
14
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
15
 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
16
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
17
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
18
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
19
 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
20
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
21
 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
22
 * POSSIBILITY OF SUCH DAMAGE.
23
 *
24
 * PHP Version 5.3
25
 *
26
 * @category  DependencyInjection
27
 * @package   Fwk\Di
28
 * @author    Julien Ballestracci <[email protected]>
29
 * @copyright 2011-2014 Julien Ballestracci <[email protected]>
30
 * @license   http://www.opensource.org/licenses/bsd-license.php  BSD License
31
 * @link      http://www.nitronet.org/fwk
32
 */
33
namespace Fwk\Di\Xml;
34
35
use Fwk\Di\Definitions\ClassDefinition;
36
use Fwk\Di\Definitions\LazyClassDefinition;
37
use Fwk\Di\Exception;
38
use Fwk\Xml\Map;
39
use Fwk\Di\Container;
40
use Fwk\Xml\XmlFile;
41
use Fwk\Di\Definitions\ArrayDefinition;
42
43
/**
44
 * ContainerBuilder
45
 * 
46
 * Builds or extends an existing Container using an Xml Map
47
 *
48
 * @category Xml
49
 * @package  Fwk\Di
50
 * @author   Julien Ballestracci <[email protected]>
51
 * @license  http://www.opensource.org/licenses/bsd-license.php  BSD License
52
 * @link     http://www.nitronet.org/fwk
53
 */
54
class ContainerBuilder
55
{
56
    /**
57
     * The Map that should return definitions from an Xml file
58
     * @var Map
59
     */
60
    protected $map;
61
    
62
    /**
63
     * Constructor
64
     * 
65
     * If no Map is specified, the builder will use the ContainerXmlMap.
66
     * 
67
     * @param null|Map $map The Xml Map used to parse the Xml file
68
     * 
69
     * @return void
0 ignored issues
show
Comprehensibility Best Practice introduced by
Adding a @return annotation to constructors is generally not recommended as a constructor does not have a meaningful return value.

Adding a @return annotation to a constructor is not recommended, since a constructor does not have a meaningful return value.

Please refer to the PHP core documentation on constructors.

Loading history...
70
     */
71 6
    public function __construct(Map $map = null)
72
    {
73 6
        if (is_null($map)) {
74 6
            $map = new ContainerXmlMap();
75
        }
76
        
77 6
        $this->map = $map;
78 6
    }
79
    
80
    /**
81
     * Registers Xml definitions to the provided Container.
82
     * If no Container is provided, a new one will be created.
83
     * 
84
     * @param string|XmlFile $file      Path to Xml (or XmlFile instance)
85
     * @param null|Container $container Container where definitions are added
86
     * 
87
     * @return Container
88
     */
89 5
    public function execute($file, Container $container = null)
90
    {
91 5
        if (!$file instanceof XmlFile) {
92 5
            $file = new XmlFile($file);
93
        }
94 5
        if (null === $container) {
95 1
            $container = new Container();
96
        }
97
        
98 5
        $results = $this->map->execute($file);
99
        
100 5
        $container->setProperty('packageDir', dirname($file->getRealPath()));
101 5
        $this->applyIniFiles($results['ini'], $container, $file);
102 5
        $this->applyDefinitions($results['definitions'], $container);
103 5
        $this->applyArrayDefinitions($results['arrayDefs'], $container);
104 5
        $this->applyClassDefinitions($results['classDefs'], $container);
105 5
        $this->applyListeners($results['listeners'], $container);
106
107 5
        return $container;
108
    }
109
    
110
    
111
    /**
112
     * Converts XML definitions from parsing results
113
     * 
114
     * @param array     $inis      Parsing results
115
     * @param Container $container The Di Container
116
     * @param XmlFile   $file      The XmlFile instance
117
     * 
118
     * @return void
119
     */
120 5
    protected function applyIniFiles(array $inis, Container $container, 
121
        XmlFile $file
122
    ) {
123 5
        foreach ($inis as $infos) {
124 5
            $container->iniProperties(
125
                str_replace(
126 5
                    ':baseDir', 
127 5
                    dirname($file->getRealPath()), 
128 5
                    $infos['value']
129
                ), 
130 5
                $infos['category']
131
            );
132
        }
133 5
    }
134
    
135
    /**
136
     * Converts XML definitions from parsing results
137
     * 
138
     * @param array     $definitions Parsing results
139
     * @param Container $container   The Di Container
140
     * 
141
     * @return void
142
     */
143 5
    protected function applyDefinitions(array $definitions, 
144
        Container $container
145
    ) {
146 5
        foreach ($definitions as $name => $infos) {
147 5
            $container->set(
148 5
                $container->propertizeString($name), 
149 5
                $container->propertizeString($infos['value'])
150
            );
151
        }
152 5
    }
153
    
154
    /**
155
     * Converts XML class definitions from parsing results
156
     * 
157
     * @param array     $classDefs Parsing results
158
     * @param Container $container The Di Container
159
     * 
160
     * @return void
161
     */
162 5
    protected function applyClassDefinitions(array $classDefs, 
163
        Container $container
164
    ) {
165 5
        foreach ($classDefs as $name => $infos) {
166 5
            $shared = (bool)$this->transformValueType($infos['shared']);
167 5
            $lazy = (bool)$this->transformValueType($infos['lazy']);
168 5
            $defClass = ($lazy ? LazyClassDefinition::class : ClassDefinition::class);
169 5
            $def = new $defClass(
170 5
                $infos['className'], 
171 5
                $infos['arguments']
172
            );
173 5
            foreach ($infos['methodsCalls'] as $mnfos) {
174 5
                $def->addMethodCall(
175 5
                    $container->propertizeString($mnfos['method']), 
176 5
                    $mnfos['arguments']
177
                );
178
            }
179
180 5
            $def->setShared($shared)
181 5
                ->setData($infos['data']);
182
            
183 5
            $container->set($name, $def);
184
        }
185 5
    }
186
    
187
    /**
188
     * Converts XML Array definitions from parsing results
189
     * 
190
     * @param array     $arrayDefs Parsing results
191
     * @param Container $container The Di Container
192
     * 
193
     * @return void
194
     */
195 5
    protected function applyArrayDefinitions(array $arrayDefs, 
196
        Container $container
197
    ) {
198 5
        foreach ($arrayDefs as $name => $infos) {
199 5
            $shared = (bool)$this->transformValueType($infos['shared']);
200 5
            $array  = array();
201 5
            foreach ($infos['params'] as $mnfos) {
202 5
                $key = (empty($mnfos['key']) ? null : $mnfos['key']);
203 5
                $val = $this->transformValueType($mnfos['value']);
204
                
205 5
                if (!empty($key)) {
206 5
                    $array[$key] = $val;
207
                } else {
208 5
                    $array[] = $val;
209
                }
210
            }
211
212 5
            $def = ArrayDefinition::factory($array)
213 5
                    ->setShared($shared)
214 5
                    ->setData($infos['data']);
215
216 5
            $container->set($name, $def);
217
        }
218 5
    }
219
220
    /**
221
     * Converts XML definitions from parsing results
222
     *
223
     * @param array     $listeners Parsing results
224
     * @param Container $container The Di Container
225
     *
226
     * @return void
227
     */
228 5
    protected function applyListeners(array $listeners, Container $container)
229
    {
230 5
        foreach ($listeners as $infos) {
231 5
            $class = $infos['class'];
232 5
            $service = $infos['service'];
233
234 5
            if (empty($class) && empty($service)) {
235
                throw new Exception('Invalid Xml Listener: either "class" or "service" attribute must be defined.');
236
            }
237
238 5
            if (!empty($class)) {
239 5
                $def = new ClassDefinition($class);
240 5
                $container->addListener($def->invoke($container));
241 5
                continue;
242
            }
243
244 5
            if (!$container->has($service)) {
245
                throw new Exception(sprintf('Invalid Xml Listener service ID: "%s"', $service));
246
            }
247 5
            $container->addListener($container->get($service));
248
        }
249 5
    }
250
    
251
    /**
252
     * Transforms a string to a type, if known:
253
     * 
254
     * - boolean: true / false
255
     * - null: null
256
     * 
257
     * @param string $value The initial string value
258
     * 
259
     * @return null|string|boolean
260
     */
261 5
    protected function transformValueType($value)
262
    {
263 5
        $value = trim($value);
264 5
        if (strtolower($value) === "true") {
265 5
            $value = true;
266 5
        } elseif (strtolower($value) === "false") {
267
            $value = false;
268 5
        } elseif (strtolower($value) === "null") {
269
            $value = null;
270
        }
271
        
272 5
        return $value;
273
    }
274
    
275
    /**
276
     * Returns the Xml Map
277
     * 
278
     * @return Map
279
     */
280 1
    public function getMap()
281
    {
282 1
        return $this->map;
283
    }
284
285
    /**
286
     * Defines the Xml Map used to parse definitions from the Xml file
287
     * 
288
     * @param Map $map The Xml Map 
289
     * 
290
     * @return void
291
     */
292 1
    public function setMap(Map $map)
293
    {
294 1
        $this->map = $map;
295
    }
296
}