Issues (1752)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Fwlib/Test/AbstractDbRelateTest.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
namespace Fwlib\Test;
3
4
use Fwlib\Bridge\Adodb;
5
use FwlibTest\Aide\TestServiceContainer;
6
use FwlibTest\Aide\TestServiceContainerAwareTrait;
7
use Fwolf\Wrapper\PHPUnit\PHPUnitTestCase;
8
9
/**
10
 * Parent class for db relate tests
11
 *
12
 * @codeCoverageIgnore
13
 *
14
 * @copyright   Copyright 2013-2015 Fwolf
15
 * @license     http://www.gnu.org/licenses/lgpl.html LGPL-3.0+
16
 */
17
abstract class AbstractDbRelateTest extends PHPunitTestCase
18
{
19
    use TestServiceContainerAwareTrait;
20
21
22
    /**
23
     * Db connection, default
24
     *
25
     * @var Adodb
26
     */
27
    protected static $db = null;
28
29
    /**
30
     * Db connection, mysql
31
     *
32
     * @var Adodb
33
     */
34
    protected static $dbMysql = null;
35
36
    /**
37
     * Service name of db profiles
38
     *
39
     * @var string[]    Index by db profile name
40
     */
41
    protected static $dbServiceNames = [
42
        'db'       => 'Db',
43
        'dbMysql'  => 'MysqlDb',
44
        'dbSybase' => 'SybaseDb',
45
    ];
46
47
    /**
48
     * Db connection, Sybase
49
     *
50
     * @var Adodb
51
     */
52
    protected static $dbSybase = null;
53
54
    /**
55
     * Using db profile
56
     *
57
     * Available value: default, mysql, sybase
58
     *
59
     * Multiple value can join with comma.
60
     *
61
     * Extend and change this value in child class to select which db to use.
62
     *
63
     * @var string
64
     */
65
    protected static $dbUsing = '';
66
67
    /**
68
     * Test table: group
69
     *
70
     * @var string
71
     */
72
    protected static $tableGroup = 'test_group';
73
74
    /**
75
     * Test table: user
76
     *
77
     * @var string
78
     */
79
    protected static $tableUser = 'test_user';
80
81
    /**
82
     * Test table: user_group
83
     *
84
     * @var string
85
     */
86
    protected static $tableUserGroup = 'test_user_group';
87
88
89
    /**
90
     * Connect to db and assign to static property $dbXxx
91
     *
92
     * @see $dbUsing
93
     * @param   string   $profile    Using db profile, multi splitted by ','
94
     */
95
    protected static function connectDb($profile)
96
    {
97
        if (empty($profile)) {
98
            return;
99
        }
100
101
        $dbName = [];
102
103
        $profileAr = explode(',', $profile);
104
        foreach ($profileAr as $type) {
105
            $type = trim($type);
106
107
            if ('default' == $type) {
108
                $dbName[] = 'db';
109
            } else {
110
                $dbName[] = 'db' . ucfirst($type);
111
            }
112
        }
113
114
        // Get db connection from service container
115
        $sc = TestServiceContainer::getInstance();
116
        foreach ($dbName as $name) {
117
            /** @var Adodb $db */
118
            $db = &self::${$name};
119
120
            if (is_null($db)) {
121
                $method = 'get' . self::$dbServiceNames[$name];
122
                $db = $sc->$method();
123
124
                if (is_null($db) || !$db->isConnected()) {
125
                    self::markTestSkipped("Db $name can't connect.");
126
                }
127
            }
128
        }
129
    }
130
131
132
    /**
133
     * @param   Adodb   $db
134
     */
135
    protected static function createTable($db)
136
    {
137
        // Try drop table in case last test didn't success
138
        self::dropTable($db);
139
140
        $groupTable = self::$tableGroup;
141
        $userTable = self::$tableUser;
142
        $userGroupTable = self::$tableUserGroup;
143
144
        // Create test table
145
        $db->execute(
146
            "CREATE TABLE {$groupTable}(
147
                uuid        CHAR(36)        NOT NULL,
148
                title       CHAR(255)       NULL,
149
                PRIMARY KEY (uuid)
150
            );
151
            "
152
        );
153
154
        if (0 != $db->getErrorCode()) {
155
            self::markTestSkipped(
156
                'Create test table group error: ' .
157
                $db->getErrorMessage()
158
            );
159
        }
160
161
        $db->execute(
162
            "CREATE TABLE {$userTable}(
163
                uuid        CHAR(36)        NOT NULL,
164
                title       VARCHAR(255)    NULL,
165
                age         INTEGER         NOT NULL DEFAULT 0,
166
                credit      DECIMAL(10, 2)  NULL,
167
                joindate    DATETIME        NULL,
168
                PRIMARY KEY (uuid)
169
            );
170
            "
171
        );
172
173
        if (0 != $db->getErrorCode()) {
174
            self::markTestSkipped(
175
                'Create test table user error: ' .
176
                $db->getErrorMessage()
177
            );
178
        }
179
180
        $db->execute(
181
            "CREATE TABLE {$userGroupTable}(
182
                uuid        CHAR(36)        NOT NULL,
183
                uuid_user   CHAR(36)        NOT NULL,
184
                uuid_group  CHAR(36)        NOT NULL,
185
                PRIMARY KEY (uuid)
186
            );
187
            "
188
        );
189
190
        if (0 != $db->getErrorCode()) {
191
            self::markTestSkipped(
192
                'Create test table user_group error: ' .
193
                $db->getErrorMessage()
194
            );
195
        }
196
    }
197
198
199
    /**
200
     * @param   Adodb  $db
201
     */
202
    protected static function dropTable($db)
203
    {
204
        $groupTable = self::$tableGroup;
205
        $userTable = self::$tableUser;
206
        $userGroupTable = self::$tableUserGroup;
207
208
        if ($db->isTableExist(self::$tableUserGroup)) {
209
            $db->execute(
210
                "DROP TABLE {$userGroupTable}"
211
            );
212
        }
213
214
        if ($db->isTableExist(self::$tableGroup)) {
215
            $db->execute(
216
                "DROP TABLE {$groupTable}"
217
            );
218
        }
219
220
        if ($db->isTableExist(self::$tableUser)) {
221
            $db->execute(
222
                "DROP TABLE {$userTable}"
223
            );
224
        }
225
    }
226
227
228 View Code Duplication
    public static function setUpBeforeClass()
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
229
    {
230
        self::connectDb(static::$dbUsing);
231
232
        // Create test table
233
        if (!is_null(self::$dbMysql) && self::$dbMysql->isConnected()) {
234
            self::createTable(self::$dbMysql);
235
        }
236
        if (!is_null(self::$dbSybase) && self::$dbSybase->isConnected()) {
237
            self::createTable(self::$dbSybase);
238
        }
239
240
        if (!is_null(self::$db) && self::$db->isConnected() &&
241
            !self::$db->isTableExist(self::$tableUser)) {
242
            self::createTable(self::$db);
243
        }
244
    }
245
246
247 View Code Duplication
    public static function tearDownAfterClass()
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
248
    {
249
        if (!is_null(self::$dbMysql) && self::$dbMysql->isConnected()) {
250
            self::dropTable(self::$dbMysql);
251
        }
252
        if (!is_null(self::$dbSybase) && self::$dbSybase->isConnected()) {
253
            self::dropTable(self::$dbSybase);
254
        }
255
256
        if (!is_null(self::$db) && self::$db->isConnected() &&
257
            self::$db->isTableExist(self::$tableUser)) {
258
            self::dropTable(self::$db);
259
        }
260
    }
261
}
262