Issues (2473)

Branch: master

Security Analysis    no vulnerabilities found

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

engine/classes/Elgg/ClassLoader.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
namespace Elgg;
3
4
/**
5
 * A class/interface/trait autoloader for PHP
6
 *
7
 * It is able to load classes that use either:
8
 *
9
 *  * The technical interoperability standards for PHP 5.3 namespaces and
10
 *    class names (https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-0.md);
11
 *
12
 *  * The PEAR naming convention for classes (http://pear.php.net/).
13
 *
14
 * Classes from a sub-namespace or a sub-hierarchy of PEAR classes can be
15
 * looked for in a list of locations to ease the vendoring of a sub-set of
16
 * classes for large projects.
17
 *
18
 * All discovered files are stored in the internal class map and the map is
19
 * queried before attempting to find a file.
20
 *
21
 * Contains code from Symfony2's UniversalClassLoader.
22
 *
23
 * Copyright (c) 2004-2013 Fabien Potencier
24
 *
25
 * Permission is hereby granted, free of charge, to any person obtaining a copy
26
 * of this software and associated documentation files (the "Software"), to deal
27
 * in the Software without restriction, including without limitation the rights
28
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
29
 * copies of the Software, and to permit persons to whom the Software is furnished
30
 * to do so, subject to the following conditions:
31
 *
32
 * The above copyright notice and this permission notice shall be included in all
33
 * copies or substantial portions of the Software.
34
 *
35
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
36
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
37
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
38
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
39
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
40
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
41
 * THE SOFTWARE.
42
 *
43
 * @access private
44
 *
45
 * @package    Elgg.Core
46
 * @subpackage Autoloader
47
 * @author     Fabien Potencier <[email protected]>
48
 */
49
class ClassLoader {
50
51
	protected $namespaces = array();
52
	protected $prefixes = array();
53
	protected $fallbacks = array();
54
55
	/**
56
	 * @var \Elgg\ClassMap Map of classes to files
57
	 */
58
	protected $map;
59
60
	/**
61
	 * Constructor
62
	 * 
63
	 * @param \Elgg\ClassMap $map Class map
64
	 */
65 6
	public function __construct(\Elgg\ClassMap $map) {
66 6
		$this->map = $map;
67 6
	}
68
69
	/**
70
	 * Get the class map
71
	 * 
72
	 * @return \Elgg\ClassMap
73
	 */
74
	public function getClassMap() {
75
		return $this->map;
76
	}
77
78
	/**
79
	 * Gets the configured namespaces.
80
	 *
81
	 * @return array A hash with namespaces as keys and directories as values
82
	 */
83
	public function getNamespaces() {
84
		return $this->namespaces;
85
	}
86
87
	/**
88
	 * Gets the configured class prefixes.
89
	 *
90
	 * @return array A hash with class prefixes as keys and directories as values
91
	 */
92
	public function getPrefixes() {
93
		return $this->prefixes;
94
	}
95
96
	/**
97
	 * Registers an array of namespaces
98
	 *
99
	 * @param array $namespaces An array of namespaces (namespaces as keys and locations as values)
100
	 * @return void
101
	 */
102
	public function registerNamespaces(array $namespaces) {
103
		foreach ($namespaces as $namespace => $locations) {
104
			$this->namespaces[$namespace] = (array)$locations;
105
		}
106
	}
107
108
	/**
109
	 * Registers a namespace.
110
	 *
111
	 * @param string       $namespace The namespace
112
	 * @param array|string $paths     The location(s) of the namespace
113
	 * @return void
114
	 */
115
	public function registerNamespace($namespace, $paths) {
116
		$this->namespaces[$namespace] = (array)$paths;
117
	}
118
119
	/**
120
	 * Registers an array of classes using the PEAR naming convention.
121
	 *
122
	 * @param array $classes An array of classes (prefixes as keys and locations as values)
123
	 * @return void
124
	 */
125
	public function registerPrefixes(array $classes) {
126
		foreach ($classes as $prefix => $locations) {
127
			$this->prefixes[$prefix] = (array)$locations;
128
		}
129
	}
130
131
	/**
132
	 * Registers a set of classes using the PEAR naming convention.
133
	 *
134
	 * @param string       $prefix The classes prefix
135
	 * @param array|string $paths  The location(s) of the classes
136
	 * @return void
137
	 */
138
	public function registerPrefix($prefix, $paths) {
139
		$this->prefixes[$prefix] = (array)$paths;
140
	}
141
142
	/**
143
	 * Add a directory to search if no registered directory is found.
144
	 *
145
	 * @param string $path The directory
146
	 * @return void
147
	 */
148
	public function addFallback($path) {
149
		$this->fallbacks[] = rtrim($path, '/\\');
150
	}
151
152
	/**
153
	 * Registers this instance as an autoloader.
154
	 * 
155
	 * @return void
156
	 */
157 6
	public function register() {
158 6
		spl_autoload_register(array($this, 'loadClass'));
159 6
	}
160
161
	/**
162
	 * Loads the given class or interface, possibly updating the class map.
163
	 *
164
	 * @param string $class The name of the class
165
	 * @return void
166
	 */
167 1
	public function loadClass($class) {
168 1
		$file = $this->map->getPath($class);
169 1
		if ($file && is_readable($file)) {
170
			require $file;
171
			return;
172
		}
173
174 1
		$file = $this->findFile($class);
175 1
		if ($file && is_readable($file)) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $file of type string|null is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
176
			$this->map->setPath($class, $file);
177
			$this->map->setAltered(true);
178
			require $file;
179
		}
180 1
	}
181
182
	/**
183
	 * Finds the path to the file where the class is defined.
184
	 *
185
	 * @param string $class The name of the class
186
	 *
187
	 * @return string|null The path, if found
188
	 */
189 1
	public function findFile($class) {
190 1
		if ('\\' == $class[0]) {
191
			$class = substr($class, 1);
192
		}
193
194 1
		$pos = strrpos($class, '\\');
195 1
		if (false !== $pos) {
196
			// namespaced class name
197
			$namespace = substr($class, 0, $pos);
198
			$className = substr($class, $pos + 1);
199
			$normalizedClass = str_replace('\\', DIRECTORY_SEPARATOR, $namespace)
200
				. DIRECTORY_SEPARATOR
201
				. str_replace('_', DIRECTORY_SEPARATOR, $className) . '.php';
202
			foreach ($this->namespaces as $ns => $dirs) {
203
				if (0 !== strpos($namespace, $ns)) {
204
					continue;
205
				}
206
207 View Code Duplication
				foreach ($dirs as $dir) {
208
					$file = $dir . DIRECTORY_SEPARATOR . $normalizedClass;
209
					if (is_file($file)) {
210
						return $file;
211
					}
212
				}
213
			}
214
215
		} else {
216
			// PEAR-like class name
217 1
			$normalizedClass = str_replace('_', DIRECTORY_SEPARATOR, $class) . '.php';
218 1
			foreach ($this->prefixes as $prefix => $dirs) {
219
				if (0 !== strpos($class, $prefix)) {
220
					continue;
221
				}
222
223 View Code Duplication
				foreach ($dirs as $dir) {
224
					$file = $dir . DIRECTORY_SEPARATOR . $normalizedClass;
225
					if (is_file($file)) {
226
						return $file;
227
					}
228
				}
229 1
			}
230
		}
231
232 1 View Code Duplication
		foreach ($this->fallbacks as $dir) {
233
			$file = $dir . DIRECTORY_SEPARATOR . $normalizedClass;
234
			if (is_file($file)) {
235
				return $file;
236
			}
237 1
		}
238 1
	}
239
}
240
241