Issues (1131)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/routing/RoutingValue.class.php (4 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
// +---------------------------------------------------------------------------+
4
// | This file is part of the Agavi package.                                   |
5
// | Copyright (c) 2005-2011 the Agavi Project.                                |
6
// |                                                                           |
7
// | For the full copyright and license information, please view the LICENSE   |
8
// | file that was distributed with this source code. You can also view the    |
9
// | LICENSE file online at http://www.agavi.org/LICENSE.txt                   |
10
// |   vi: set noexpandtab:                                                    |
11
// |   Local Variables:                                                        |
12
// |   indent-tabs-mode: t                                                     |
13
// |   End:                                                                    |
14
// +---------------------------------------------------------------------------+
15
16
namespace Agavi\Routing;
17
18
use Agavi\Core\Context;
19
20
/**
21
 * Routing values are used internally and, optionally, by users in gen() calls
22
 * and callbacks to have more control over encoding behavior and values in pre-
23
 * and postfixes
24
 *
25
 * @package    agavi
26
 * @subpackage routing
27
 *
28
 * @author     Dominik del Bondio <[email protected]>
29
 * @copyright  Authors
30
 * @copyright  The Agavi Project
31
 *
32
 * @since      1.0.0
33
 *
34
 * @version    $Id$
35
 */
36
class RoutingValue implements RoutingValueInterface
37
{
38
    /**
39
     * @var Context
40
     */
41
    protected $context;
42
43
    /**
44
     * @var string
45
     */
46
    protected $contextName;
47
    
48
    protected $value;
49
    protected $prefix;
50
    protected $postfix;
51
    protected $valueNeedsEncoding = true;
52
    protected $prefixNeedsEncoding = false;
53
    protected $postfixNeedsEncoding = false;
54
    
55
    protected static $arrayMap = array(
56
        'pre'  => 'prefix',
57
        'val'  => 'value',
58
        'post' => 'postfix',
59
    );
60
    
61
    /**
62
     * Constructor.
63
     *
64
     * @param      mixed $value              The value.
65
     * @param      bool  $valueNeedsEncoding Whether or not the value needs encoding.
66
     *
67
     * @author     Dominik del Bondio <[email protected]>
68
     * @since      1.0.0
69
     */
70
    public function __construct($value, $valueNeedsEncoding = true)
71
    {
72
        $this->value = $value;
73
        $this->valueNeedsEncoding = $valueNeedsEncoding;
74
    }
75
    
76
    /**
77
     * Pre-serialization callback.
78
     *
79
     * Will set the name of the context instead of the instance, which will later
80
     * be restored by __wakeup().
81
     *
82
     * @author     David Zülke <[email protected]>
83
     * @since      1.0.0
84
     */
85 View Code Duplication
    public function __sleep()
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
86
    {
87
        $this->contextName = $this->context->getName();
88
        $arr = get_object_vars($this);
89
        unset($arr['context']);
90
        return array_keys($arr);
91
    }
92
93
    /**
94
     * Post-unserialization callback.
95
     *
96
     * Will restore the context instance based on their names set by __sleep().
97
     *
98
     * @author     David Zülke <[email protected]>
99
     * @since      1.0.0
100
     */
101
    public function __wakeup()
102
    {
103
        $this->context = Context::getInstance($this->contextName);
104
        
105
        unset($this->contextName);
106
    }
107
    
108
    /**
109
     * Initialize the routing value.
110
     *
111
     * @param      Context $context The Context.
112
     * @param      array   $parameters An array of initialization parameters.
113
     *
114
     * @author     Dominik del Bondio <[email protected]>
115
     * @since      1.0.0
116
     */
117
    public function initialize(Context $context, array $parameters = array())
118
    {
119
        $this->context = $context;
120
    }
121
    
122
    /**
123
     * Set the value.
124
     *
125
     * @param      mixed $value The value.
126
     *
127
     * @author     Dominik del Bondio <[email protected]>
128
     * @author     David Zülke <[email protected]>
129
     * @since      1.0.0
130
     */
131
    public function setValue($value)
132
    {
133
        $this->value = $value;
134
        return $this;
135
    }
136
    
137
    /**
138
     * Retrieve the value.
139
     *
140
     * @return mixed the value
141
     *
142
     * @author     Dominik del Bondio <[email protected]>
143
     * @since      1.0.0
144
     */
145
    public function getValue()
146
    {
147
        return $this->value;
148
    }
149
    
150
    /**
151
     * Set the prefix.
152
     *
153
     * @param      string $value The prefix.
154
     *
155
     * @author     Dominik del Bondio <[email protected]>
156
     * @author     David Zülke <[email protected]>
157
     * @since      1.0.0
158
     */
159
    public function setPrefix($value)
160
    {
161
        $this->prefix = $value;
162
        return $this;
163
    }
164
    
165
    /**
166
     * Retrieve the prefix.
167
     *
168
     * @return     string The prefix.
169
     *
170
     * @author     Dominik del Bondio <[email protected]>
171
     * @since      1.0.0
172
     */
173
    public function getPrefix()
174
    {
175
        return $this->prefix;
176
    }
177
    
178
    /**
179
     * Check if a prefix is set.
180
     *
181
     * @return     bool True, if a prefix is set, false otherwise.
182
     *
183
     * @author     Dominik del Bondio <[email protected]>
184
     * @since      1.0.0
185
     */
186
    public function hasPrefix()
187
    {
188
        return $this->prefix !== null;
189
    }
190
    
191
    /**
192
     * Set the postfix.
193
     *
194
     * @param      string $value The postfix.
195
     *
196
     * @author     Dominik del Bondio <[email protected]>
197
     * @author     David Zülke <[email protected]>
198
     * @since      1.0.0
199
     */
200
    public function setPostfix($value)
201
    {
202
        $this->postfix = $value;
203
        return $this;
204
    }
205
    
206
    /**
207
     * Retrieve the postfix.
208
     *
209
     * @return     string The postfix.
210
     *
211
     * @author     Dominik del Bondio <[email protected]>
212
     * @since      1.0.0
213
     */
214
    public function getPostfix()
215
    {
216
        return $this->postfix;
217
    }
218
    
219
    /**
220
     * Check if a postfix is set.
221
     *
222
     * @return     bool True, if a postfix is set, false otherwise.
223
     *
224
     * @author     Dominik del Bondio <[email protected]>
225
     * @since      1.0.0
226
     */
227
    public function hasPostfix()
228
    {
229
        return $this->postfix !== null;
230
    }
231
    
232
    /**
233
     * Set whether or not the value needs to be encoded.
234
     *
235
     * @param      bool $needsEncoding True, if the postfix needs encoding, false otherwise.
236
     *
237
     * @author     Dominik del Bondio <[email protected]>
238
     * @since      1.0.0
239
     */
240
    public function setValueNeedsEncoding($needsEncoding)
241
    {
242
        $this->valueNeedsEncoding = $needsEncoding;
243
        return $this;
244
    }
245
    
246
    /**
247
     * Retrieve whether or not the value needs to be encoded.
248
     *
249
     * @return     bool True, if the value needs encoding, false otherwise.
250
     *
251
     * @author     Dominik del Bondio <[email protected]>
252
     * @since      1.0.0
253
     */
254
    public function getValueNeedsEncoding()
255
    {
256
        return $this->valueNeedsEncoding;
257
    }
258
    
259
    /**
260
     * Set whether or not the prefix needs to be encoded.
261
     *
262
     * @param      bool $needsEncoding True, if the prefix needs encoding, false otherwise.
263
     *
264
     * @author     Dominik del Bondio <[email protected]>
265
     * @since      1.0.0
266
     */
267
    public function setPrefixNeedsEncoding($needsEncoding)
268
    {
269
        $this->prefixNeedsEncoding = $needsEncoding;
270
        return $this;
271
    }
272
    
273
    /**
274
     * Retrieve whether or not the prefix needs to be encoded.
275
     *
276
     * @return     bool True, if the prefix needs encoding, false otherwise.
277
     *
278
     * @author     Dominik del Bondio <[email protected]>
279
     * @since      1.0.0
280
     */
281
    public function getPrefixNeedsEncoding()
282
    {
283
        return $this->prefixNeedsEncoding;
284
    }
285
    
286
    /**
287
     * Set whether or not the postfix needs to be encoded.
288
     *
289
     * @param      bool $needsEncoding True, if the postfix needs encoding, false otherwise.
290
     *
291
     * @author     Dominik del Bondio <[email protected]>
292
     * @since      1.0.0
293
     */
294
    public function setPostfixNeedsEncoding($needsEncoding)
295
    {
296
        $this->postfixNeedsEncoding = $needsEncoding;
297
        return $this;
298
    }
299
    
300
    /**
301
     * Retrieve whether or not the postfix needs to be encoded.
302
     *
303
     * @return     bool True, if the postfix needs encoding, false otherwise.
304
     *
305
     * @author     Dominik del Bondio <[email protected]>
306
     * @since      1.0.0
307
     */
308
    public function getPostfixNeedsEncoding()
309
    {
310
        return $this->postfixNeedsEncoding;
311
    }
312
    
313
    /**
314
     * Check if this routing value is equal to the given parameter.
315
     *
316
     * @param      mixed $other The value to compare $this against.
317
     *
318
     * @return     bool Whether the value matches $this.
319
     *
320
     * @author     Dominik del Bondio <[email protected]>
321
     * @since      1.0.0
322
     */
323
    public function equals($other)
324
    {
325
        if ($other instanceof self) {
326
            return $this == $other;
327
        } elseif (is_array($other)) {
328
            return $this->value == $other['val'] && $this->prefix == $other['pre'] && $this->postfix == $other['post'] && !$this->valueEncoded && $this->prefixEncoded && $this->postfixEncoded;
0 ignored issues
show
The property valueEncoded does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
The property prefixEncoded does not seem to exist. Did you mean prefix?

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
The property postfixEncoded does not seem to exist. Did you mean postfix?

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
329
        } else {
330
            return $this->prefix === null && $this->postfix === null && $this->value == $other && !$this->valueEncoded;
331
        }
332
    }
333
    
334
    /**
335
     * ArrayAccess method for isset().
336
     *
337
     * @param      mixed $offset The offset.
338
     *
339
     * @return     bool Whether or not the given offset exists.
340
     *
341
     * @author     Dominik del Bondio <[email protected]>
342
     * @since      1.0.0
343
     */
344
    public function offsetExists($offset)
345
    {
346
        return isset(self::$arrayMap[$offset]);
347
    }
348
    
349
    /**
350
     * ArrayAccess method for getting a value.
351
     *
352
     * @param      mixed $offset The offset.
353
     *
354
     * @return     mixed The value, nor null if the value does not exist.
355
     *
356
     * @author     Dominik del Bondio <[email protected]>
357
     * @since      1.0.0
358
     */
359
    public function offsetGet($offset)
360
    {
361
        if (isset(self::$arrayMap[$offset])) {
362
            return $this->{self::$arrayMap[$offset]};
363
        }
364
    }
365
    
366
    /**
367
     * ArrayAccess method for setting a value.
368
     *
369
     * @param      mixed $offset The offset.
370
     * @param      mixed $value The value.
371
     *
372
     * @author     Dominik del Bondio <[email protected]>
373
     * @since      1.0.0
374
     */
375
    public function offsetSet($offset, $value)
376
    {
377
        if (isset(self::$arrayMap[$offset])) {
378
            $this->{self::$arrayMap[$offset]} = $value;
379
        }
380
    }
381
    
382
    /**
383
     * ArrayAccess method for unset().
384
     *
385
     * @param      mixed $offset The offset.
386
     *
387
     * @author     Dominik del Bondio <[email protected]>
388
     * @since      1.0.0
389
     */
390
    public function offsetUnset($offset)
391
    {
392
        if (isset(self::$arrayMap[$offset])) {
393
            $this->{self::$arrayMap[$offset]} = null;
394
        }
395
    }
396
    
397
    /**
398
     * Return the encoded value (without pre- or postfix) for BC.
399
     *
400
     * @return     string The encoded value.
401
     *
402
     * @author     Dominik del Bondio <[email protected]>
403
     * @author     David Zülke <[email protected]>
404
     * @since      1.0.0
405
     */
406
    public function __toString()
407
    {
408
        return $this->context->getRouting()->escapeOutputParameter($this->value);
409
    }
410
}
411