Issues (43)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

DependencyInjection/Configuration.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
declare(strict_types=1);
4
5
/*
6
 * This file is part of the BazingaGeocoderBundle package.
7
 * For the full copyright and license information, please view the LICENSE
8
 * file that was distributed with this source code.
9
 *
10
 * @license    MIT License
11
 */
12
13
namespace Bazinga\GeocoderBundle\DependencyInjection;
14
15
use Symfony\Component\Config\Definition\Builder\ArrayNodeDefinition;
16
use Symfony\Component\Config\Definition\Builder\TreeBuilder;
17
use Symfony\Component\Config\Definition\ConfigurationInterface;
18
19
/**
20
 * @author William Durand <[email protected]>
21
 */
22
class Configuration implements ConfigurationInterface
23
{
24
    /**
25
     * Whether to use the debug mode.
26
     *
27
     * @see https://github.com/doctrine/DoctrineBundle/blob/v1.5.2/DependencyInjection/Configuration.php#L31-L41
28
     *
29
     * @var bool
30
     */
31
    private $debug;
32
33
    /**
34
     * @param bool $debug
35
     */
36 35
    public function __construct($debug)
37
    {
38 35
        $this->debug = (bool) $debug;
39 35
    }
40
41
    /**
42
     * Proxy to get root node for Symfony < 4.2.
43
     *
44
     * @return ArrayNodeDefinition
45
     */
46 35
    protected function getRootNode(TreeBuilder $treeBuilder, string $name)
47
    {
48 35
        if (\method_exists($treeBuilder, 'getRootNode')) {
49 35
            return $treeBuilder->getRootNode();
50
        } else {
51
            return $treeBuilder->root($name);
0 ignored issues
show
The method root() does not seem to exist on object<Symfony\Component...on\Builder\TreeBuilder>.

This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces.

This is most likely a typographical error or the method has been renamed.

Loading history...
52
        }
53
    }
54
55
    /**
56
     * Generates the configuration tree builder.
57
     *
58
     * @return TreeBuilder The tree builder
59
     */
60 35
    public function getConfigTreeBuilder()
61
    {
62 35
        $treeBuilder = new TreeBuilder('bazinga_geocoder');
63
64 35
        $this->getRootNode($treeBuilder, 'bazinga_geocoder')
65 35
            ->children()
66 35
            ->append($this->getProvidersNode())
67 35
            ->arrayNode('profiling')
68 35
                ->addDefaultsIfNotSet()
69 35
                ->treatFalseLike(['enabled' => false])
70 35
                ->treatTrueLike(['enabled' => true])
71 35
                ->treatNullLike(['enabled' => $this->debug])
72 35
                ->info('Extend the debug profiler with information about requests.')
73 35
                ->children()
74 35
                    ->booleanNode('enabled')
75 35
                        ->info('Turn the toolbar on or off. Defaults to kernel debug mode.')
76 35
                        ->defaultValue($this->debug)
77 35
                    ->end()
78 35
                ->end()
79 35
            ->end()
80 35
            ->arrayNode('fake_ip')
81 35
                ->beforeNormalization()
82 35
                ->ifString()
83
                    ->then(function ($value) {
84
                        return ['ip' => $value];
85 35
                    })
86 35
                ->end()
87 35
                ->canBeEnabled()
88 35
                ->children()
89 35
                    ->scalarNode('local_ip')
90 35
                        ->defaultValue('127.0.0.1')
91 35
                    ->end()
92 35
                    ->scalarNode('ip')->defaultNull()->end()
93 35
                    ->booleanNode('use_faker')->defaultFalse()->end()
94 35
                ->end()
95 35
            ->end();
96
97 35
        return $treeBuilder;
98
    }
99
100
    /**
101
     * @return ArrayNodeDefinition
102
     */
103 35
    private function getProvidersNode()
104
    {
105 35
        $treeBuilder = new TreeBuilder('providers');
106
107 35
        return $this->getRootNode($treeBuilder, 'providers')
108 35
            ->requiresAtLeastOneElement()
109 35
            ->useAttributeAsKey('name')
110 35
            ->arrayPrototype()
111 35
            ->fixXmlConfig('plugin')
112 35
                ->children()
113 35
                    ->scalarNode('factory')->isRequired()->cannotBeEmpty()->end()
114 35
                    ->variableNode('options')->defaultValue([])->end()
115 35
                    ->scalarNode('cache')->defaultNull()->end()
116 35
                    ->scalarNode('cache_lifetime')->defaultNull()->end()
117 35
                    ->scalarNode('cache_precision')
118 35
                        ->defaultNull()
119 35
                        ->info('Precision of the coordinates to cache.')
120 35
                        ->end()
121 35
                    ->scalarNode('limit')->defaultNull()->end()
122 35
                    ->scalarNode('locale')->defaultNull()->end()
123 35
                    ->scalarNode('logger')->defaultNull()->end()
124 35
                    ->arrayNode('aliases')
125 35
                        ->scalarPrototype()->end()
126 35
                    ->end()
127 35
                    ->append($this->createClientPluginNode())
128 35
                ->end()
129 35
            ->end();
130
    }
131
132
    /**
133
     * Create plugin node of a client.
134
     *
135
     * @return ArrayNodeDefinition The plugin node
136
     */
137 35
    private function createClientPluginNode()
138
    {
139 35
        $builder = new TreeBuilder('plugins');
140 35
        $node = $this->getRootNode($builder, 'plugins');
141
142
        /** @var ArrayNodeDefinition $pluginList */
143
        $pluginList = $node
144 35
            ->info('A list of plugin service ids. The order is important.')
145 35
            ->arrayPrototype()
146
        ;
147
        $pluginList
148
            // support having just a service id in the list
149 35
            ->beforeNormalization()
150
                ->always(function ($plugin) {
151 2
                    if (is_string($plugin)) {
152
                        return [
153
                            'reference' => [
154 2
                                'enabled' => true,
155 2
                                'id' => $plugin,
156
                            ],
157
                        ];
158
                    }
159
160 1
                    return $plugin;
161 35
                })
162 35
            ->end()
163
        ;
164
165
        $pluginList
166 35
            ->children()
167 35
                ->arrayNode('reference')
168 35
                    ->canBeEnabled()
169 35
                    ->info('Reference to a plugin service')
170 35
                    ->children()
171 35
                        ->scalarNode('id')
172 35
                            ->info('Service id of a plugin')
173 35
                            ->isRequired()
174 35
                            ->cannotBeEmpty()
175 35
                        ->end()
176 35
                    ->end()
177 35
                ->end()
178 35
            ->end()
179 35
        ->end();
180
181 35
        return $node;
182
    }
183
}
184