This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /* |
||
4 | * Composer plugin for bower/npm assets |
||
5 | * |
||
6 | * @link https://github.com/hiqdev/composer-asset-plugin |
||
7 | * @package composer-asset-plugin |
||
8 | * @license BSD-3-Clause |
||
9 | * @copyright Copyright (c) 2015-2016, HiQDev (http://hiqdev.com/) |
||
10 | */ |
||
11 | |||
12 | namespace hiqdev\composerassetplugin; |
||
13 | |||
14 | use Composer\Composer; |
||
15 | use Composer\EventDispatcher\EventSubscriberInterface; |
||
16 | use Composer\IO\IOInterface; |
||
17 | use Composer\Json\JsonFile; |
||
18 | use Composer\Package\PackageInterface; |
||
19 | use Composer\Plugin\PluginInterface; |
||
20 | use Composer\Script\Event; |
||
21 | use Composer\Script\ScriptEvents; |
||
22 | |||
23 | /** |
||
24 | * Plugin class. |
||
25 | * |
||
26 | * @author Andrii Vasyliev <[email protected]> |
||
27 | */ |
||
28 | class Plugin implements PluginInterface, EventSubscriberInterface |
||
29 | { |
||
30 | /** |
||
31 | * @var string the filename of a lock file. Defaults to `composer-asset-plugin.lock` |
||
32 | */ |
||
33 | public $lockFile = 'composer-asset-plugin.lock'; |
||
34 | |||
35 | /** |
||
36 | * @var Composer instance |
||
37 | */ |
||
38 | protected $composer; |
||
39 | |||
40 | /** |
||
41 | * @var IOInterface |
||
42 | */ |
||
43 | public $io; |
||
44 | |||
45 | /** |
||
46 | * @var Pool |
||
47 | */ |
||
48 | protected $pool; |
||
49 | |||
50 | /** |
||
51 | * List of the available package managers/ |
||
52 | * Initialized at activate. |
||
53 | * @var array|PackageManager[] |
||
54 | * @see activate |
||
55 | */ |
||
56 | protected $managers = [ |
||
57 | 'bower' => 'hiqdev\composerassetplugin\Bower', |
||
58 | 'npm' => 'hiqdev\composerassetplugin\Npm', |
||
59 | ]; |
||
60 | |||
61 | /** |
||
62 | * @var PackageInterface[] the array of active composer packages |
||
63 | */ |
||
64 | protected $packages; |
||
65 | |||
66 | /** |
||
67 | * @var string absolute path to vendor directory. |
||
68 | */ |
||
69 | protected $vendorDir; |
||
70 | |||
71 | /** |
||
72 | * |
||
73 | */ |
||
74 | protected $requires = []; |
||
75 | |||
76 | /** |
||
77 | * Initializes the plugin object with the passed $composer and $io. |
||
78 | * Also initializes package managers. |
||
79 | * |
||
80 | * @param Composer $composer |
||
81 | * @param IOInterface $io |
||
82 | * @void |
||
83 | */ |
||
84 | 3 | public function activate(Composer $composer, IOInterface $io) |
|
85 | { |
||
86 | 3 | $managers = []; |
|
87 | 3 | $this->composer = $composer; |
|
88 | 3 | $this->io = $io; |
|
89 | 3 | foreach ($this->managers as $name => $class) { |
|
90 | 3 | $managers[$name] = new $class($this); |
|
91 | } |
||
92 | 3 | $this->managers = $managers; |
|
93 | |||
94 | #$rm = $composer->getRepositoryManager(); |
||
0 ignored issues
–
show
|
|||
95 | |||
96 | #$rm->setRepositoryClass('assets', 'hiqdev\composerassetplugin\AssetRepository'); |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
80% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
97 | #$rm->addRepository($rm->createRepository('assets', ['plugin' => $this])); |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
77% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
98 | 3 | } |
|
99 | |||
100 | public function getComposer() |
||
101 | { |
||
102 | return $this->composer; |
||
103 | } |
||
104 | |||
105 | public function hasManager($name) |
||
106 | { |
||
107 | return isset($this->managers[$name]); |
||
108 | } |
||
109 | |||
110 | public function getManager($name) |
||
111 | { |
||
112 | return $this->managers[$name]; |
||
113 | } |
||
114 | |||
115 | /** |
||
116 | * Returns list of events the plugin is subscribed to. |
||
117 | * |
||
118 | * @return array list of events |
||
119 | */ |
||
120 | 1 | public static function getSubscribedEvents() |
|
121 | { |
||
122 | return [ |
||
123 | 1 | ScriptEvents::POST_INSTALL_CMD => [ |
|
124 | ['onPostInstall', 0], |
||
125 | 1 | ], |
|
126 | 1 | ScriptEvents::POST_UPDATE_CMD => [ |
|
127 | ['onPostUpdate', 0], |
||
128 | ], |
||
129 | ]; |
||
130 | } |
||
131 | |||
132 | public function scanAssetDependencies(PackageInterface $package) |
||
133 | { |
||
134 | static $deptypes = [ |
||
135 | 'dependencies' => 'getRequires', |
||
136 | 'devDependencies' => 'getDevRequires', |
||
137 | ]; |
||
138 | $res = []; |
||
0 ignored issues
–
show
$res is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
139 | foreach ($deptypes as $deptype => $method) { |
||
140 | $requires = $package->$method(); |
||
141 | foreach ($requires as $reqkey => $require) { |
||
142 | $target = $require->getTarget(); |
||
143 | if (strpos($target, '/') === false) { |
||
144 | continue; |
||
145 | } |
||
146 | list($vendor, $name) = explode('/', $target); |
||
147 | if (substr($vendor, -6) !== '-asset') { |
||
148 | continue; |
||
149 | } |
||
150 | list($manager, $asset) = explode('-', $vendor); |
||
0 ignored issues
–
show
The assignment to
$asset is unused. Consider omitting it like so list($first,,$third) .
This checks looks for assignemnts to variables using the Consider the following code example. <?php
function returnThreeValues() {
return array('a', 'b', 'c');
}
list($a, $b, $c) = returnThreeValues();
print $a . " - " . $c;
Only the variables Instead, the list call could have been. list($a,, $c) = returnThreeValues();
![]() |
|||
151 | if ($this->hasManager($manager)) { |
||
152 | $this->getManager($manager)->setKnownDeps($package, $deptype, $name, $require->getPrettyConstraint()); |
||
153 | /* removing asset dependencies |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
65% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
154 | unset($requires[$reqkey]); |
||
155 | $method[0] = 's'; |
||
156 | if (method_exists($package, $method)) { |
||
157 | $package->{$method}($requires); |
||
158 | } |
||
159 | */ |
||
160 | } |
||
161 | } |
||
162 | } |
||
163 | } |
||
164 | |||
165 | /** |
||
166 | * Perform install. Called by composer after install. |
||
167 | * |
||
168 | * @param Event $event |
||
169 | * @void |
||
170 | */ |
||
171 | 1 | public function onPostInstall(Event $event) |
|
0 ignored issues
–
show
|
|||
172 | { |
||
173 | 1 | $lockFile = new JsonFile($this->lockFile); |
|
174 | 1 | if ($lockFile->exists()) { |
|
175 | $this->loadPackages($lockFile); |
||
176 | } else { |
||
177 | 1 | $this->scanPackages(); |
|
178 | } |
||
179 | 1 | $this->runAction('install'); |
|
180 | 1 | } |
|
181 | |||
182 | /** |
||
183 | * Perform update. Called by composer after update. |
||
184 | * |
||
185 | * @param Event $event |
||
186 | */ |
||
187 | public function onPostUpdate(Event $event) |
||
0 ignored issues
–
show
|
|||
188 | { |
||
189 | $this->scanPackages(); |
||
190 | $this->runAction('update'); |
||
191 | } |
||
192 | |||
193 | /** |
||
194 | * Sets [[packages]]. |
||
195 | * |
||
196 | * @param PackageInterface[] $packages |
||
197 | */ |
||
198 | 3 | public function setPackages(array $packages) |
|
199 | { |
||
200 | 3 | $this->packages = $packages; |
|
201 | 3 | } |
|
202 | |||
203 | /** |
||
204 | * Gets [[packages]]. |
||
205 | * @return \Composer\Package\PackageInterface[] |
||
206 | */ |
||
207 | 2 | public function getPackages() |
|
208 | { |
||
209 | 2 | if ($this->packages === null) { |
|
210 | $this->packages = $this->composer->getRepositoryManager()->getLocalRepository()->getCanonicalPackages(); |
||
211 | $this->packages[] = $this->composer->getPackage(); |
||
212 | } |
||
213 | |||
214 | 2 | return $this->packages; |
|
215 | } |
||
216 | |||
217 | /** |
||
218 | * Returns package with given name if exists. |
||
219 | * @param string $name package name |
||
220 | * @return \Composer\Package\PackageInterface|null |
||
221 | */ |
||
222 | public function findPackage($name, $composer = null) |
||
0 ignored issues
–
show
|
|||
223 | { |
||
224 | if ($composer === null) { |
||
225 | $composer = $this->composer; |
||
0 ignored issues
–
show
$composer is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
226 | } |
||
227 | |||
228 | return $this->composer->getRepositoryManager()->findPackage('beelab/bowerphp', '*'); |
||
229 | } |
||
230 | |||
231 | /** |
||
232 | * Scan packages from the composer objects. |
||
233 | * @void |
||
234 | */ |
||
235 | 1 | protected function scanPackages() |
|
236 | { |
||
237 | 1 | $rootPackage = $this->composer->getPackage(); |
|
238 | 1 | if ($rootPackage) { |
|
239 | $extra = $rootPackage->getExtra(); |
||
240 | foreach ($this->managers as $manager) { |
||
241 | $var = $manager->getName() . '-asset-library'; |
||
242 | if (isset($extra['asset-installer-paths'][$var])) { |
||
243 | $manager->setDestination($extra['asset-installer-paths'][$var]); |
||
244 | } |
||
245 | } |
||
246 | } |
||
247 | 1 | foreach ($this->getPackages() as $package) { |
|
248 | if ($package instanceof \Composer\Package\CompletePackageInterface) { |
||
249 | $this->scanAssetDependencies($package); |
||
250 | } |
||
251 | } |
||
252 | 1 | foreach ($this->getPackages() as $package) { |
|
253 | if ($package instanceof \Composer\Package\CompletePackageInterface) { |
||
254 | foreach ($this->managers as $manager) { |
||
255 | $manager->scanPackage($package); |
||
256 | } |
||
257 | } |
||
258 | } |
||
259 | 1 | } |
|
260 | |||
261 | /** |
||
262 | * Load packages from given lock file. |
||
263 | * |
||
264 | * @param JsonFile $lockFile |
||
265 | * @void |
||
266 | */ |
||
267 | protected function loadPackages(JsonFile $lockFile) |
||
268 | { |
||
269 | $lock = $lockFile->read(); |
||
270 | foreach ($this->managers as $name => $m) { |
||
271 | $m->setConfig($lock[$name]); |
||
272 | } |
||
273 | } |
||
274 | |||
275 | /** |
||
276 | * Install packages after loading/scanning. |
||
277 | * @param string $action |
||
278 | * @void |
||
279 | */ |
||
280 | 1 | protected function runAction($action) |
|
281 | { |
||
282 | 1 | $dir = getcwd(); |
|
283 | 1 | chdir($this->getVendorDir()); |
|
284 | 1 | foreach ($this->managers as $m) { |
|
285 | 1 | if ($m->hasDependencies()) { |
|
286 | 1 | $m->runAction($action); |
|
287 | } |
||
288 | } |
||
289 | 1 | chdir($dir); |
|
290 | 1 | } |
|
291 | |||
292 | /** |
||
293 | * Get absolute path to composer vendor dir. |
||
294 | * @return string |
||
295 | */ |
||
296 | 1 | public function getVendorDir() |
|
297 | { |
||
298 | 1 | if ($this->vendorDir === null) { |
|
299 | 1 | $this->vendorDir = $this->findVendorDir($this->composer); |
|
300 | } |
||
301 | |||
302 | 1 | return $this->vendorDir; |
|
303 | } |
||
304 | |||
305 | 1 | public function findVendorDir($composer) |
|
306 | { |
||
307 | 1 | return $composer->getConfig()->get('vendor-dir', '/'); |
|
308 | } |
||
309 | } |
||
310 |
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.
The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.
This check looks for comments that seem to be mostly valid code and reports them.