Gongo\MercifulPolluter\Request

Complexity

Total Complexity

24

Size/Duplication

Total Lines	136
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	1

Importance

Changes	3
Bugs	0	Features	0

8 Methods

Rating	Name	Duplication	Size	Complexity
A	pollute()	0	5	1
A	enableMagicQuotesGpc()	0	4	1
A	disableMagicQuotesGpc()	0	4	1
A	injectFileToGlobal()	0	17	4
C	injectEGPCSToGlobal()	0	45	12
A	getInjectVariables()	0	4	1
A	addSlashesRecursive()	0	9	1
A	injectToGlobal()	0	10	3

<?php
namespace Gongo\MercifulPolluter;

class Request extends Base
{
    private $magicQuotesGpc = false;
    
    public function pollute()
    {
        $this->injectFileToGlobal();
        $this->injectEGPCSToGlobal();
    }

    public function enableMagicQuotesGpc()
    {
        $this->magicQuotesGpc = true;
    }

    public function disableMagicQuotesGpc()
    {
        $this->magicQuotesGpc = false;
    }
    
    /**
     * Inject $_FILES to global variables.
     *
     * The naming rule when injected
     *
     *     $_FILES['upfile']['tmp_name'] => $upfile
     *     $_FILES['upfile']['size']     => $upfile_size
     *     $_FILES['upfile']['type']     => $upfile_type
     *
     */
    private function injectFileToGlobal()
    {
        foreach ($_FILES as $field => $info) {
            $values = array();

            foreach ($info as $key => $value) {
                if ($key === 'tmp_name') {
                    $name = $field;
                } else {
                    $name = "${field}_${key}";
                }
                $values[$name] = $value;
            }

            $this->injectToGlobal($values);
        }
    }

    /**
     * Inject `EGPCS` to global variables.
     *
     * `EGPCS` means $_ENV, $_GET, $_POST, $_COOKIE and $_SERVER.
     *
     * If beforehand call `enableMagicQuotesGpc()`,
     * applies `addslashes` $_GET, $_POST, $_COOKIE and those inject variables.
     */
    private function injectEGPCSToGlobal()
    {
        $injectedFlag = array(
            'e' => false,
            'g' => false,
            'p' => false,
            'c' => false,
            's' => false
        );

        foreach ($this->getInjectVariables() as $name) {
            if (!isset($injectedFlag[$name]) || $injectedFlag[$name]) {
                continue;
            }

            switch ($name) {
                case 'e':
                    $this->injectToGlobal($_ENV);
                    break;
                case 'g':
                    if ($this->magicQuotesGpc) {
                        $this->addSlashesRecursive($_GET);
                    }
                    $this->injectToGlobal($_GET);
                    break;
                case 'p':
                    if ($this->magicQuotesGpc) {
                        $this->addSlashesRecursive($_POST);
                    }
                    $this->injectToGlobal($_POST);
                    break;
                case 'c':
                    if ($this->magicQuotesGpc) {
                        $this->addSlashesRecursive($_COOKIE);
                    }
                    $this->injectToGlobal($_COOKIE);
                    break;
                case 's':
                    $this->injectToGlobal($_SERVER);
                    break;
            }

            $injectedFlag[$name] = true;
        }
    }

    /**
     * @return  array
     */
    protected function getInjectVariables()
    {
        return str_split(strtolower(ini_get('variables_order')));
    }

    /**
     * Recursively applies `addslashes` to each element of the array recursive.
     *
     * This method is **bang** .
     */
    private function addSlashesRecursive(&$theVariables)
    {
        array_walk_recursive(
            $theVariables,
            function (&$value) {
                $value = addslashes($value);
            }
        );
    }

    protected function injectToGlobal(array $theVariables)
    {
        foreach ($theVariables as $name => $value) {
            if ($this->ignoringVariable($name)) {
                continue;
            }

            $GLOBALS[$name] = $value;
        }
    }
}