Issues in Log.php (master) - Issues in master - gyselroth/micro - Measure and Improve Code Quality continuously with Scrutinizer

Issues (69)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Log.php (8 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
declare(strict_types = 1);

/**
 * Micro
 *
 * @author    Raffael Sahli <[email protected]>
 * @copyright Copyright (c) 2017 gyselroth GmbH (https://gyselroth.com)
 * @license   MIT https://opensource.org/licenses/MIT
 */

namespace Micro;

use \Psr\Log\AbstractLogger;
use \Psr\Log\LogLevel;
use \Psr\Log\LoggerInterface;
use \Micro\Log\Adapter\AbstractAdapter;
use \Micro\Log\Adapter\AdapterInterface;
use \Micro\Config;
use \Micro\Log\Exception;
.
|-- OtherDir
|   |-- Bar.php
|   `-- Foo.php
`-- SomeDir
    `-- Foo.php
use \Micro\Container\AdapterAwareInterface;

class Log extends AbstractLogger implements LoggerInterface, AdapterAwareInterface
{
    /**
     * Priorities
     */
    const PRIORITIES = [
        LogLevel::EMERGENCY => 0,
        LogLevel::ALERT     => 1,
        LogLevel::CRITICAL  => 2,
        LogLevel::ERROR     => 3,
        LogLevel::WARNING   => 4,
        LogLevel::NOTICE    => 5,
        LogLevel::INFO      => 6,
        LogLevel::DEBUG     => 7,
    ];


    /**
     * Adapters
     *
     * @var array
     */
    protected $adapter = [];


    /**
     * static context
     *
     * @var array
     */
    protected $context = [];


    /**
     * Initialize logger
     *
     * @param   Iterable $config
     * @return  void

     */
    public function __construct(? Iterable $config = null)
    {
        $this->setOptions($config);
    }


    /**
     * Set options
     *
     * @param  Iterable $config
     * @return Log
     */
    public function setOptions(? Iterable $config = null): Log
    {
        if ($config === null) {
            return $this;
        }

        foreach ($config as $option => $value) {
            switch($option) {
                case 'adapter':
switch ($expr) {
    case "A": { //wrong
        doSomething();
        break;
    }
    case "B"; //wrong
        doSomething();
        break;
    case "C": //right
        doSomething();
        break;
}
                    foreach($value as $name => $adapter) {
                        $this->injectAdapter($name, $adapter);
                    }
                break;
                default:
                    throw new Exception('invalid option '.$option.' given');
            }
        }

        return $this;
    }


    /**
     * {@inheritDoc}
     */
    public function getDefaultAdapter(): array
    {
        return [];
    }


    /**
     * {@inheritDoc}
     */
    public function hasAdapter(string $name): bool
    {
        return isset($this->adapter[$name]);
    }


    /**
     * {@inheritDoc}
     */
    public function injectAdapter($adapter, ?string $name=null) : AdapterAwareInterface
    {
        if(!($adapter instanceof AdapterInterface)) {
            throw new Exception('adapter needs to implement AdapterInterface');
        }

        if($name === null) {
            $name = get_class($adapter);
        }

        if ($this->hasAdapter($name)) {
            throw new Exception('log adapter '.$name.' is already registered');
        }

        $this->adapter[$name] = $adapter;
        return $this;
    }


    /**
     * {@inheritDoc}
     */
    public function getAdapter(string $name)
    {
        if (!$this->hasAdapter($name)) {
            throw new Exception('log adapter '.$name.' is not registered');
        }

        return $this->adapter[$name];
    }


    /**
     * Get adapters
     *
     * @param  array $adapters
     * @return array
     */
    public function getAdapters(array $adapters = []): array
    {
        if (empty($adapter)) {

            return $this->adapter;
        } else {
            $list = [];
            foreach ($adapter as $name) {
                if (!$this->hasAdapter($name)) {
                    throw new Exception('log adapter '.$name.' is not registered');
                }
                $list[$name] = $this->adapter[$name];
            }

            return $list;
        }
    }


    /**
     * Log message
     *
     * @param   string $level
     * @param   string $message
     * @param   array $context
     * @return  bool
     */
    public function log($level, $message, array $context = []): bool
    {
        if (!array_key_exists($level, self::PRIORITIES)) {
            throw new Exception('log level '.$level.' is unkown');
        }

        foreach ($this->adapter as $adapter) {
            $prio = $adapter->getLevel();

            if (self::PRIORITIES[$level] <= $prio) {
                $msg = $this->_format($message, $adapter->getFormat(), $adapter->getDateFormat(), $level, $context);
                $adapter->log($level, $msg);
            }
        }

        return true;
    }


    /**
     *  Add static context
     *
     * @param  string $name
     * @param  string $value
     * @return Log
     */
    public function addContext(string $name, string $value): Log
    {
        $this->context[$name] = $value;
        return $this;
    }


    /**
     * Log message
     *
     * @param   string $message
     * @param   string $format
     * @param   string $date_format
     * @param   string $level
     * @param   array $context
     * @return  string
     */
    protected function _format(string $message, string $format, string $date_format, string $level, array $context = []): string
    {
        $parsed = preg_replace_callback('/(\{(([a-z]\.*)+)\})/', function($match) use ($message, $level, $date_format, $context) {
            $key = '';
            $context = array_merge($this->context, $context);
$x = 1;
$callable = function() use ($x) {
    $x = 2; // Not visible in outer scope. If you would like this, how
            // about using a different variable name than $x?
};

$callable();
var_dump($x); // integer(1)

            if ($sub_context = strpos($match[2], '.')) {
                $parts = explode('.', $match[2]);
                $name = $parts[0];
                $key = $parts[1];
            } else {
                $name = $match[2];
            }

            switch ($name) {
                case 'level':
                    return $match[0] = $level;
                    break;
switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}
                case 'date':
                    return $match[0] = date($date_format);
                    break;
switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}
                case 'message':
                    $replace = [];
                    foreach ($context as $key => $val) {
                        if (!is_array($val) && (!is_object($val) || method_exists($val, '__toString'))) {
                            $replace['{'.$key.'}'] = $val;
                        } else {
                            $replace['{'.$key.'}'] = json_encode($val);
                        }
                    }

                    return $match[0] = strtr($message, $replace);
                    break;
switch ($x) {
    case 1:
        return 'foo';
        break; // This break is not necessary and can be left off.
}
                case 'context':
                    if ($sub_context) {
                        if (array_key_exists($key, $context)) {
                            if (!is_array($context[$key]) && (!is_object($context[$key]) || method_exists($context[$key], '__toString'))) {
                                return $match[0] = $context[$key];
                            } else {
                                return $match[0] = json_encode($context[$key]);
                            }
                        }
                    } else {
                        return $match[0] = json_encode($context);
                    }
                    break;
            }
        }, $format);

        return $parsed;
    }
}


Issues (69)

Security Analysis not enabled

src/Log.php (8 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Change not visible in outer-scope

Change visible in outer-scope

1			<?php
2			declare(strict_types = 1);
3
4			/**
5			* Micro
6			*
7			* @author Raffael Sahli <[email protected]>
8			* @copyright Copyright (c) 2017 gyselroth GmbH (https://gyselroth.com)
9			* @license MIT https://opensource.org/licenses/MIT
10			*/
11
12			namespace Micro;
13
14			use \Psr\Log\AbstractLogger;
15			use \Psr\Log\LogLevel;
16			use \Psr\Log\LoggerInterface;
17			use \Micro\Log\Adapter\AbstractAdapter;
18			use \Micro\Log\Adapter\AdapterInterface;
19			use \Micro\Config;
20			use \Micro\Log\Exception;
			0 ignored issues – show Bug introduced 2017-10-16 16:07 UTC by Report Bug Copy Issue Report Show Similar Issues like this This use statement conflicts with another class in this namespace, `Micro\Exception`. Let’s assume that you have a directory layout like this: . \|-- OtherDir \| \|-- Bar.php \| `-- Foo.php `-- SomeDir `-- Foo.php and let’s assume the following content of `Bar.php`: // Bar.php namespace OtherDir; use SomeDir\Foo; // This now conflicts the class OtherDir\Foo If both files `OtherDir/Foo.php` and `SomeDir/Foo.php` are loaded in the same runtime, you will see a PHP error such as the following: PHP Fatal error: Cannot use SomeDir\Foo as Foo because the name is already in use in OtherDir/Foo.php However, as `OtherDir/Foo.php` does not necessarily have to be loaded and the error is only triggered if it is loaded before `OtherDir/Bar.php`, this problem might go unnoticed for a while. In order to prevent this error from surfacing, you must import the namespace with a different alias: // Bar.php namespace OtherDir; use SomeDir\Foo as SomeDirFoo; // There is no conflict anymore. Loading history...
21			use \Micro\Container\AdapterAwareInterface;
22
23			class Log extends AbstractLogger implements LoggerInterface, AdapterAwareInterface
24			{
25			/**
26			* Priorities
27			*/
28			const PRIORITIES = [
29			LogLevel::EMERGENCY => 0,
30			LogLevel::ALERT => 1,
31			LogLevel::CRITICAL => 2,
32			LogLevel::ERROR => 3,
33			LogLevel::WARNING => 4,
34			LogLevel::NOTICE => 5,
35			LogLevel::INFO => 6,
36			LogLevel::DEBUG => 7,
37			];
38
39
40			/**
41			* Adapters
42			*
43			* @var array
44			*/
45			protected $adapter = [];
46
47
48			/**
49			* static context
50			*
51			* @var array
52			*/
53			protected $context = [];
54
55
56			/**
57			* Initialize logger
58			*
59			* @param Iterable $config
60			* @return void
			0 ignored issues – show Comprehensibility Best Practice introduced 2017-06-21 11:15 UTC by Report Bug Copy Issue Report Show Similar Issues like this Adding a `@return` annotation to constructors is generally not recommended as a constructor does not have a meaningful return value. Adding a `@return` annotation to a constructor is not recommended, since a constructor does not have a meaningful return value. Please refer to the PHP core documentation on constructors. Loading history...
61			*/
62			public function __construct(? Iterable $config = null)
63			{
64			$this->setOptions($config);
65			}
66
67
68			/**
69			* Set options
70			*
71			* @param Iterable $config
72			* @return Log
73			*/
74			public function setOptions(? Iterable $config = null): Log
75			{
76			if ($config === null) {
77			return $this;
78			}
79
80			foreach ($config as $option => $value) {
81			switch($option) {
82			case 'adapter':
			0 ignored issues – show Coding Style introduced 2017-11-06 16:24 UTC by Report Bug Copy Issue Report Show Similar Issues like this `case` statements should be defined using a colon. As per the PSR-2 coding standard, case statements should not be wrapped in curly braces. There is no need for braces, since each case is terminated by the next `break`. There is also the option to use a semicolon instead of a colon, this is discouraged because many programmers do not even know it works and the colon is universal between programming languages. switch ($expr) { case "A": { //wrong doSomething(); break; } case "B"; //wrong doSomething(); break; case "C": //right doSomething(); break; } To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. Loading history...
83			foreach($value as $name => $adapter) {
84			$this->injectAdapter($name, $adapter);
85			}
86			break;
87			default:
88			throw new Exception('invalid option '.$option.' given');
89			}
90			}
91
92			return $this;
93			}
94
95
96			/**
97			* {@inheritDoc}
98			*/
99			public function getDefaultAdapter(): array
100			{
101			return [];
102			}
103
104
105			/**
106			* {@inheritDoc}
107			*/
108			public function hasAdapter(string $name): bool
109			{
110			return isset($this->adapter[$name]);
111			}
112
113
114			/**
115			* {@inheritDoc}
116			*/
117			public function injectAdapter($adapter, ?string $name=null) : AdapterAwareInterface
118			{
119			if(!($adapter instanceof AdapterInterface)) {
120			throw new Exception('adapter needs to implement AdapterInterface');
121			}
122
123			if($name === null) {
124			$name = get_class($adapter);
125			}
126
127			if ($this->hasAdapter($name)) {
128			throw new Exception('log adapter '.$name.' is already registered');
129			}
130
131			$this->adapter[$name] = $adapter;
132			return $this;
133			}
134
135
136			/**
137			* {@inheritDoc}
138			*/
139			public function getAdapter(string $name)
140			{
141			if (!$this->hasAdapter($name)) {
142			throw new Exception('log adapter '.$name.' is not registered');
143			}
144
145			return $this->adapter[$name];
146			}
147
148
149			/**
150			* Get adapters
151			*
152			* @param array $adapters
153			* @return array
154			*/
155			public function getAdapters(array $adapters = []): array
156			{
157			if (empty($adapter)) {
			0 ignored issues – show Bug introduced 2017-06-21 11:15 UTC by Report Bug Copy Issue Report Show Similar Issues like this The variable `$adapter` does not exist. Did you mean `$adapters`? This check looks for variables that are accessed but have not been defined. It raises an issue if it finds another variable that has a similar name. The variable may have been renamed without also renaming all references. Loading history...
158			return $this->adapter;
159			} else {
160			$list = [];
161			foreach ($adapter as $name) {
162			if (!$this->hasAdapter($name)) {
163			throw new Exception('log adapter '.$name.' is not registered');
164			}
165			$list[$name] = $this->adapter[$name];
166			}
167
168			return $list;
169			}
170			}
171
172
173			/**
174			* Log message
175			*
176			* @param string $level
177			* @param string $message
178			* @param array $context
179			* @return bool
180			*/
181			public function log($level, $message, array $context = []): bool
182			{
183			if (!array_key_exists($level, self::PRIORITIES)) {
184			throw new Exception('log level '.$level.' is unkown');
185			}
186
187			foreach ($this->adapter as $adapter) {
188			$prio = $adapter->getLevel();
189
190			if (self::PRIORITIES[$level] <= $prio) {
191			$msg = $this->_format($message, $adapter->getFormat(), $adapter->getDateFormat(), $level, $context);
192			$adapter->log($level, $msg);
193			}
194			}
195
196			return true;
197			}
198
199
200			/**
201			* Add static context
202			*
203			* @param string $name
204			* @param string $value
205			* @return Log
206			*/
207			public function addContext(string $name, string $value): Log
208			{
209			$this->context[$name] = $value;
210			return $this;
211			}
212
213
214			/**
215			* Log message
216			*
217			* @param string $message
218			* @param string $format
219			* @param string $date_format
220			* @param string $level
221			* @param array $context
222			* @return string
223			*/
224			protected function _format(string $message, string $format, string $date_format, string $level, array $context = []): string
225			{
226			$parsed = preg_replace_callback('/(\{(([a-z]\.*)+)\})/', function($match) use ($message, $level, $date_format, $context) {
227			$key = '';
228			$context = array_merge($this->context, $context);
			0 ignored issues – show Bug introduced 2017-06-21 11:15 UTC by Report Bug Copy Issue Report Show Similar Issues like this Consider using a different name than the imported variable `$context`, or did you forget to import by reference? It seems like you are assigning to a variable which was imported through a `use` statement which was not imported by reference. For clarity, we suggest to use a different name or import by reference depending on whether you would like to have the change visibile in outer-scope. Change not visible in outer-scope $x = 1; $callable = function() use ($x) { $x = 2; // Not visible in outer scope. If you would like this, how // about using a different variable name than $x? }; $callable(); var_dump($x); // integer(1) Change visible in outer-scope $x = 1; $callable = function() use (&$x) { $x = 2; }; $callable(); var_dump($x); // integer(2) Loading history...
229
230			if ($sub_context = strpos($match[2], '.')) {
231			$parts = explode('.', $match[2]);
232			$name = $parts[0];
233			$key = $parts[1];
234			} else {
235			$name = $match[2];
236			}
237
238			switch ($name) {
239			case 'level':
240			return $match[0] = $level;
241			break;
			0 ignored issues – show Unused Code introduced 2017-06-21 11:15 UTC by Report Bug Copy Issue Report Show Similar Issues like this `break` is not strictly necessary here and could be removed. The `break` statement is not necessary if it is preceded for example by a `return` statement: switch ($x) { case 1: return 'foo'; break; // This break is not necessary and can be left off. } If you would like to keep this construct to be consistent with other `case` statements, you can safely mark this issue as a false-positive. Loading history...
242			case 'date':
243			return $match[0] = date($date_format);
244			break;
			0 ignored issues – show Unused Code introduced 2017-06-21 11:15 UTC by Report Bug Copy Issue Report Show Similar Issues like this `break` is not strictly necessary here and could be removed. The `break` statement is not necessary if it is preceded for example by a `return` statement: switch ($x) { case 1: return 'foo'; break; // This break is not necessary and can be left off. } If you would like to keep this construct to be consistent with other `case` statements, you can safely mark this issue as a false-positive. Loading history...
245			case 'message':
246			$replace = [];
247			foreach ($context as $key => $val) {
248			if (!is_array($val) && (!is_object($val) \|\| method_exists($val, '__toString'))) {
249			$replace['{'.$key.'}'] = $val;
250			} else {
251			$replace['{'.$key.'}'] = json_encode($val);
252			}
253			}
254
255			return $match[0] = strtr($message, $replace);
256			break;
			0 ignored issues – show Unused Code introduced 2017-06-21 11:15 UTC by Report Bug Copy Issue Report Show Similar Issues like this `break` is not strictly necessary here and could be removed. The `break` statement is not necessary if it is preceded for example by a `return` statement: switch ($x) { case 1: return 'foo'; break; // This break is not necessary and can be left off. } If you would like to keep this construct to be consistent with other `case` statements, you can safely mark this issue as a false-positive. Loading history...
257			case 'context':
258			if ($sub_context) {
259			if (array_key_exists($key, $context)) {
260			if (!is_array($context[$key]) && (!is_object($context[$key]) \|\| method_exists($context[$key], '__toString'))) {
261			return $match[0] = $context[$key];
262			} else {
263			return $match[0] = json_encode($context[$key]);
264			}
265			}
266			} else {
267			return $match[0] = json_encode($context);
268			}
269			break;
270			}
271			}, $format);
272
273			return $parsed;
274			}
275			}
276

gyselroth / micro

Issues (69)

Security Analysis not enabled

src/Log.php (8 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Change not visible in outer-scope

Change visible in outer-scope

Duplication Side-by-Side

Filter issues like