This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /* |
||
4 | * Composer plugin for bower/npm assets |
||
5 | * |
||
6 | * @link https://github.com/hiqdev/composer-asset-plugin |
||
7 | * @package composer-asset-plugin |
||
8 | * @license BSD-3-Clause |
||
9 | * @copyright Copyright (c) 2015-2016, HiQDev (http://hiqdev.com/) |
||
10 | */ |
||
11 | |||
12 | namespace hiqdev\composerassetplugin; |
||
13 | |||
14 | use Composer\Composer; |
||
15 | use Composer\EventDispatcher\EventSubscriberInterface; |
||
16 | use Composer\IO\IOInterface; |
||
17 | use Composer\Json\JsonFile; |
||
18 | use Composer\Package\PackageInterface; |
||
19 | use Composer\Plugin\PluginInterface; |
||
20 | use Composer\Script\Event; |
||
21 | use Composer\Script\ScriptEvents; |
||
22 | |||
23 | /** |
||
24 | * Plugin class. |
||
25 | * |
||
26 | * @author Andrii Vasyliev <[email protected]> |
||
27 | */ |
||
28 | class Plugin implements PluginInterface, EventSubscriberInterface |
||
29 | { |
||
30 | /** |
||
31 | * @var string the filename of a lock file. Defaults to `composer-asset-plugin.lock` |
||
32 | */ |
||
33 | public $lockFile = 'composer-asset-plugin.lock'; |
||
34 | |||
35 | /** |
||
36 | * @var Composer instance |
||
37 | */ |
||
38 | protected $composer; |
||
39 | |||
40 | /** |
||
41 | * @var IOInterface |
||
42 | */ |
||
43 | public $io; |
||
44 | |||
45 | /** |
||
46 | * @var Pool |
||
47 | */ |
||
48 | protected $pool; |
||
49 | |||
50 | /** |
||
51 | * List of the available package managers/ |
||
52 | * Initialized at activate. |
||
53 | * @var array|PackageManager[] |
||
54 | * @see activate |
||
55 | */ |
||
56 | protected $managers = [ |
||
57 | 'bower' => 'hiqdev\composerassetplugin\Bower', |
||
58 | 'npm' => 'hiqdev\composerassetplugin\Npm', |
||
59 | ]; |
||
60 | |||
61 | /** |
||
62 | * @var PackageInterface[] the array of active composer packages |
||
63 | */ |
||
64 | protected $packages; |
||
65 | |||
66 | /** |
||
67 | * @var string absolute path to vendor directory. |
||
68 | */ |
||
69 | protected $vendorDir; |
||
70 | |||
71 | /** |
||
72 | * |
||
73 | */ |
||
74 | protected $requires = []; |
||
75 | |||
76 | /** |
||
77 | * Initializes the plugin object with the passed $composer and $io. |
||
78 | * Also initializes package managers. |
||
79 | * |
||
80 | * @param Composer $composer |
||
81 | * @param IOInterface $io |
||
82 | * @void |
||
83 | */ |
||
84 | 3 | public function activate(Composer $composer, IOInterface $io) |
|
85 | { |
||
86 | 3 | $managers = []; |
|
87 | 3 | $this->composer = $composer; |
|
88 | 3 | $this->io = $io; |
|
89 | 3 | foreach ($this->managers as $name => $class) { |
|
90 | 3 | $managers[$name] = new $class($this); |
|
91 | } |
||
92 | 3 | $this->managers = $managers; |
|
93 | |||
94 | #$rm = $composer->getRepositoryManager(); |
||
95 | |||
96 | #$rm->setRepositoryClass('assets', 'hiqdev\composerassetplugin\AssetRepository'); |
||
97 | #$rm->addRepository($rm->createRepository('assets', ['plugin' => $this])); |
||
98 | 3 | } |
|
99 | |||
100 | public function getComposer() |
||
101 | { |
||
102 | return $this->composer; |
||
103 | } |
||
104 | |||
105 | public function hasManager($name) |
||
106 | { |
||
107 | return isset($this->managers[$name]); |
||
108 | } |
||
109 | |||
110 | public function getManager($name) |
||
111 | { |
||
112 | return $this->managers[$name]; |
||
113 | } |
||
114 | |||
115 | /** |
||
116 | * Returns list of events the plugin is subscribed to. |
||
117 | * |
||
118 | * @return array list of events |
||
119 | */ |
||
120 | 1 | public static function getSubscribedEvents() |
|
121 | { |
||
122 | return [ |
||
123 | 1 | ScriptEvents::POST_INSTALL_CMD => [ |
|
124 | ['onPostInstall', 0], |
||
125 | 1 | ], |
|
126 | 1 | ScriptEvents::POST_UPDATE_CMD => [ |
|
127 | ['onPostUpdate', 0], |
||
128 | ], |
||
129 | ]; |
||
130 | } |
||
131 | |||
132 | public function scanAssetDependencies(PackageInterface $package) |
||
133 | { |
||
134 | static $deptypes = [ |
||
135 | 'dependencies' => 'getRequires', |
||
136 | 'devDependencies' => 'getDevRequires', |
||
137 | ]; |
||
138 | $res = []; |
||
0 ignored issues
–
show
|
|||
139 | foreach ($deptypes as $deptype => $method) { |
||
140 | $requires = $package->$method(); |
||
141 | foreach ($requires as $reqkey => $require) { |
||
142 | $target = $require->getTarget(); |
||
143 | if (strpos($target, '/') === false) { |
||
144 | continue; |
||
145 | } |
||
146 | list($vendor, $name) = explode('/', $target); |
||
147 | if (substr($vendor, -6) !== '-asset') { |
||
148 | continue; |
||
149 | } |
||
150 | list($manager, $asset) = explode('-', $vendor); |
||
151 | if ($this->hasManager($manager)) { |
||
152 | $this->getManager($manager)->setKnownDeps($package, $deptype, $name, $require->getPrettyConstraint()); |
||
153 | /* removing asset dependencies |
||
154 | unset($requires[$reqkey]); |
||
155 | $method[0] = 's'; |
||
156 | if (method_exists($package, $method)) { |
||
157 | $package->{$method}($requires); |
||
158 | } |
||
159 | */ |
||
160 | } |
||
161 | } |
||
162 | } |
||
163 | } |
||
164 | |||
165 | /** |
||
166 | * Perform install. Called by composer after install. |
||
167 | * |
||
168 | * @param Event $event |
||
169 | * @void |
||
170 | */ |
||
171 | 1 | public function onPostInstall(Event $event) |
|
172 | { |
||
173 | 1 | $lockFile = new JsonFile($this->lockFile); |
|
174 | 1 | if ($lockFile->exists()) { |
|
175 | $this->loadPackages($lockFile); |
||
176 | } else { |
||
177 | 1 | $this->scanPackages(); |
|
178 | } |
||
179 | 1 | $this->runAction('install'); |
|
180 | 1 | } |
|
181 | |||
182 | /** |
||
183 | * Perform update. Called by composer after update. |
||
184 | * |
||
185 | * @param Event $event |
||
186 | */ |
||
187 | public function onPostUpdate(Event $event) |
||
188 | { |
||
189 | $this->scanPackages(); |
||
190 | $this->runAction('update'); |
||
191 | } |
||
192 | |||
193 | /** |
||
194 | * Sets [[packages]]. |
||
195 | * |
||
196 | * @param PackageInterface[] $packages |
||
197 | */ |
||
198 | 3 | public function setPackages(array $packages) |
|
199 | { |
||
200 | 3 | $this->packages = $packages; |
|
201 | 3 | } |
|
202 | |||
203 | /** |
||
204 | * Gets [[packages]]. |
||
205 | * @return \Composer\Package\PackageInterface[] |
||
206 | */ |
||
207 | 2 | public function getPackages() |
|
208 | { |
||
209 | 2 | if ($this->packages === null) { |
|
210 | $this->packages = $this->composer->getRepositoryManager()->getLocalRepository()->getCanonicalPackages(); |
||
211 | $this->packages[] = $this->composer->getPackage(); |
||
212 | } |
||
213 | |||
214 | 2 | return $this->packages; |
|
215 | } |
||
216 | |||
217 | /** |
||
218 | * Returns package with given name if exists. |
||
219 | * @param string $name package name |
||
220 | * @return \Composer\Package\PackageInterface|null |
||
221 | */ |
||
222 | public function findPackage($name, $composer = null) |
||
223 | { |
||
224 | if ($composer === null) { |
||
225 | $composer = $this->composer; |
||
0 ignored issues
–
show
$composer is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
226 | } |
||
227 | |||
228 | return $this->composer->getRepositoryManager()->findPackage('beelab/bowerphp', '*'); |
||
229 | } |
||
230 | |||
231 | /** |
||
232 | * Scan packages from the composer objects. |
||
233 | * @void |
||
234 | */ |
||
235 | 1 | protected function scanPackages() |
|
236 | { |
||
237 | 1 | $rootPackage = $this->composer->getPackage(); |
|
238 | 1 | if ($rootPackage) { |
|
239 | $extra = $rootPackage->getExtra(); |
||
240 | foreach ($this->managers as $manager) { |
||
241 | $var = $manager->getName() . '-asset-library'; |
||
242 | if (isset($extra['asset-installer-paths'][$var])) { |
||
243 | $manager->setDestination($extra['asset-installer-paths'][$var]); |
||
244 | } |
||
245 | } |
||
246 | } |
||
247 | 1 | foreach ($this->getPackages() as $package) { |
|
248 | if ($package instanceof \Composer\Package\CompletePackageInterface) { |
||
249 | $this->scanAssetDependencies($package); |
||
250 | } |
||
251 | } |
||
252 | 1 | foreach ($this->getPackages() as $package) { |
|
253 | if ($package instanceof \Composer\Package\CompletePackageInterface) { |
||
254 | foreach ($this->managers as $manager) { |
||
255 | $manager->scanPackage($package); |
||
256 | } |
||
257 | } |
||
258 | } |
||
259 | 1 | } |
|
260 | |||
261 | /** |
||
262 | * Load packages from given lock file. |
||
263 | * |
||
264 | * @param JsonFile $lockFile |
||
265 | * @void |
||
266 | */ |
||
267 | protected function loadPackages(JsonFile $lockFile) |
||
268 | { |
||
269 | $lock = $lockFile->read(); |
||
270 | foreach ($this->managers as $name => $m) { |
||
271 | $m->setConfig($lock[$name]); |
||
272 | } |
||
273 | } |
||
274 | |||
275 | /** |
||
276 | * Install packages after loading/scanning. |
||
277 | * @param string $action |
||
278 | * @void |
||
279 | */ |
||
280 | 1 | protected function runAction($action) |
|
281 | { |
||
282 | 1 | $dir = getcwd(); |
|
283 | 1 | chdir($this->getVendorDir()); |
|
284 | 1 | foreach ($this->managers as $m) { |
|
285 | 1 | if ($m->hasDependencies()) { |
|
286 | 1 | $m->runAction($action); |
|
287 | } |
||
288 | } |
||
289 | 1 | chdir($dir); |
|
290 | 1 | } |
|
291 | |||
292 | /** |
||
293 | * Get absolute path to composer vendor dir. |
||
294 | * @return string |
||
295 | */ |
||
296 | 1 | public function getVendorDir() |
|
297 | { |
||
298 | 1 | if ($this->vendorDir === null) { |
|
299 | 1 | $this->vendorDir = $this->findVendorDir($this->composer); |
|
300 | } |
||
301 | |||
302 | 1 | return $this->vendorDir; |
|
303 | } |
||
304 | |||
305 | 1 | public function findVendorDir($composer) |
|
306 | { |
||
307 | 1 | return $composer->getConfig()->get('vendor-dir', '/'); |
|
308 | } |
||
309 | } |
||
310 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVar
assignment in line 1 and the$higher
assignment in line 2 are dead. The first because$myVar
is never used and the second because$higher
is always overwritten for every possible time line.