This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php declare(strict_types = 1); |
||
| 2 | |||
| 3 | namespace JSKOS; |
||
| 4 | |||
| 5 | use Psr\Http\Message\RequestInterface; |
||
| 6 | use Psr\Http\Message\ResponseInterface; |
||
| 7 | use Http\Message\ResponseFactory; |
||
| 8 | use Http\Discovery\MessageFactoryDiscovery; |
||
| 9 | use Psr\Log\LoggerInterface; |
||
| 10 | use Psr\Log\NullLogger; |
||
| 11 | |||
| 12 | /** |
||
| 13 | * A JSKOS Server. |
||
| 14 | */ |
||
| 15 | class Server implements \Psr\Log\LoggerAwareInterface |
||
| 16 | { |
||
| 17 | protected $service; |
||
| 18 | protected $responseFactory; |
||
| 19 | protected $logger; |
||
| 20 | |||
| 21 | public function __construct( |
||
| 22 | Service $service, |
||
| 23 | ResponseFactory $responseFactory=null, |
||
| 24 | LoggerInterface $logger=null |
||
| 25 | ) |
||
| 26 | { |
||
| 27 | $this->service = $service; |
||
| 28 | $this->responseFactory = $responseFactory ?: MessageFactoryDiscovery::find(); |
||
| 29 | $this->logger = $logger ?: new NullLogger(); |
||
| 30 | } |
||
| 31 | |||
| 32 | public function setLogger(LoggerInterface $logger) |
||
| 33 | { |
||
| 34 | $this->logger = $logger; |
||
| 35 | } |
||
| 36 | |||
| 37 | public function queryService(array $query, string $path=''): ResponseInterface |
||
| 38 | { |
||
| 39 | if (preg_match('/^[$A-Z_][0-9A-Z_$.]*$/i', $query['callback'] ?? '')) { |
||
| 40 | $callback = $query['callback']; |
||
| 41 | unset($query['callback']); |
||
| 42 | } |
||
| 43 | |||
| 44 | # TODO: detect conflicting parameters? |
||
| 45 | # if (isset($params['uri']) and isset($params['search'])) { |
||
| 46 | # $error = new Error(422, 'request_error', 'Conflicting request parameters uri & search'); |
||
| 47 | # } |
||
| 48 | |||
| 49 | try { |
||
| 50 | $result = $this->service->query($query, $path); |
||
| 51 | // TODO |
||
| 52 | } catch(Error $error) { |
||
| 53 | $result = $error; |
||
| 54 | } |
||
| 55 | |||
| 56 | # TODO: catch other kinds of errors: |
||
| 57 | # } catch (\Exception $e) { |
||
| 58 | # $this->logger->error('Service Exception', ['exception' => $e]); |
||
| 59 | # $error = new Error(500, 'Internal server error'); |
||
| 60 | |||
| 61 | return $this->buildResponse($result, 'GET', $callback ?? null); |
||
| 62 | } |
||
| 63 | |||
| 64 | public function query(RequestInterface $request): ResponseInterface |
||
| 65 | { |
||
| 66 | $method = $request->getMethod(); |
||
| 67 | |||
| 68 | if ($method == 'OPTIONS') { |
||
| 69 | return $this->optionsResponse(); |
||
| 70 | } elseif ($method != 'GET' && $method != 'HEAD') { |
||
| 71 | return $this->buildResponse(new Error(405, 'Method not allowed')); |
||
| 72 | } |
||
| 73 | |||
| 74 | $uri = $request->getUri(); |
||
| 75 | $path = $uri->getPath(); |
||
| 76 | $query = []; |
||
| 77 | parse_str($uri->getQuery(), $query); |
||
| 78 | |||
| 79 | # TODO: get language parameter from headers |
||
| 80 | |||
| 81 | return $this->queryService($query, $path); |
||
|
0 ignored issues
–
show
|
|||
| 82 | } |
||
| 83 | |||
| 84 | protected function buildResponse($result, $method='GET', $callback=null): ResponseInterface |
||
| 85 | { |
||
| 86 | $body = $result->json(); |
||
| 87 | $context = Resource::DEFAULT_CONTEXT; |
||
| 88 | |||
| 89 | $headers = [ |
||
| 90 | 'Access-Control-Allow-Origin' => '*', |
||
| 91 | 'Content-Type' => 'application/json; charset=UTF-8', |
||
| 92 | 'Content-Length' => strlen($body), |
||
| 93 | 'Link' => "<$context>; rel=\"http://www.w3.org/ns/json-ld#context\"; type=\"application/ld+json\"" |
||
| 94 | ]; |
||
| 95 | |||
| 96 | if ($method == 'HEAD') { |
||
| 97 | $body = ''; |
||
| 98 | } |
||
| 99 | |||
| 100 | if ($callback) { |
||
| 101 | $body = "/**/$callback($body);"; |
||
| 102 | $headers['Content-Type'] = 'application/javascript; charset=UTF-8'; |
||
| 103 | } |
||
| 104 | |||
| 105 | if ($result instanceof Result) { |
||
| 106 | $headers['X-Total-Count'] = $result->getTotalCount(); |
||
| 107 | $code = '200'; |
||
| 108 | } else { |
||
| 109 | $code = $result->code; |
||
| 110 | } |
||
| 111 | |||
| 112 | return $this->responseFactory->createResponse($code, null, $headers, $body); |
||
| 113 | } |
||
| 114 | |||
| 115 | public function optionsResponse(): ResponseInterface |
||
| 116 | { |
||
| 117 | $headers = [ |
||
| 118 | 'Access-Control-Allow-Methods' => 'GET, HEAD, OPTIONS', |
||
| 119 | ]; |
||
| 120 | |||
| 121 | # TODO: |
||
| 122 | # if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) && |
||
| 123 | # $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] == 'GET') { |
||
| 124 | # $response->headers['Access-Control-Allow-Origin'] = '*'; |
||
| 125 | # $response->headers['Acess-Control-Expose-Headers'] = 'Link, X-Total-Count'; |
||
| 126 | |||
| 127 | return $this->responseFactory->createResponse(200, null, $headers, ''); |
||
| 128 | } |
||
| 129 | |||
| 130 | /** |
||
| 131 | * TODO: Extract requested languages(s) from request. |
||
| 132 | public function extractRequestLanguage($params) |
||
| 133 | { |
||
| 134 | $language = null; |
||
| 135 | |||
| 136 | # get query modifier: language |
||
| 137 | if (isset($params['language'])) { |
||
| 138 | $language = $params['language']; |
||
| 139 | unset($params['language']); |
||
| 140 | # TODO: parse language |
||
| 141 | } elseif (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) { |
||
| 142 | # parse accept-language-header |
||
| 143 | preg_match_all( |
||
| 144 | '/([a-z]+(?:-[a-z]+)?)\s*(?:;\s*q\s*=\s*(1|0?\.[0-9]+))?/i', |
||
| 145 | $_SERVER['HTTP_ACCEPT_LANGUAGE'], |
||
| 146 | $match); |
||
| 147 | if (count($match[1])) { |
||
| 148 | foreach ($match[1] as $i => $l) { |
||
| 149 | if (isset($match[2][$i]) && $match[2][$i] != '') { |
||
| 150 | $langs[strtolower($l)] = (float) $match[2][$i]; |
||
| 151 | } else { |
||
| 152 | $langs[strtolower($l)] = 1; |
||
| 153 | } |
||
| 154 | } |
||
| 155 | arsort($langs, SORT_NUMERIC); |
||
| 156 | reset($langs); |
||
| 157 | $language = key($langs); # most wanted language |
||
| 158 | } |
||
| 159 | } |
||
| 160 | |||
| 161 | return $language; |
||
| 162 | } |
||
| 163 | */ |
||
| 164 | |||
| 165 | /** |
||
| 166 | * Utility function to emit a Response without additional framework. |
||
| 167 | */ |
||
| 168 | public static function sendResponse(ResponseInterface $response) |
||
| 169 | { |
||
| 170 | $code = $response->getStatusCode(); |
||
| 171 | $reason = $response->getReasonPhrase(); |
||
| 172 | header( |
||
| 173 | sprintf('HTTP/%s %s %s', $response->getProtocolVersion(), $code, $reason), |
||
| 174 | true, $code |
||
| 175 | ); |
||
| 176 | |||
| 177 | foreach ($response->getHeaders() as $header => $values) { |
||
| 178 | foreach ($values as $value) { |
||
| 179 | header("$header: $value", false); |
||
| 180 | } |
||
| 181 | } |
||
| 182 | |||
| 183 | echo $response->getBody(); |
||
| 184 | } |
||
| 185 | } |
||
| 186 |
If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check:
If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue.