Issues in AgaviTesting.class.php (master) - Issues in master - horros/agavi2 - Measure and Improve Code Quality continuously with Scrutinizer

Issues (1131)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/testing/AgaviTesting.class.php (17 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
namespace Agavi\Testing;

// +---------------------------------------------------------------------------+
// | This file is part of the Agavi package.                                   |
// | Copyright (c) 2005-2011 the Agavi Project.                                |
// |                                                                           |
// | For the full copyright and license information, please view the LICENSE   |
// | file that was distributed with this source code. You can also view the    |
// | LICENSE file online at http://www.agavi.org/LICENSE.txt                   |
// |   vi: set noexpandtab:                                                    |
// |   Local Variables:                                                        |
// |   indent-tabs-mode: t                                                     |
// |   End:                                                                    |
// +---------------------------------------------------------------------------+

use Agavi\Config\Config;
use Agavi\Config\ConfigCache;
use Agavi\Exception\AgaviException;
use Agavi\Util\RecursiveDirectoryFilterIterator;
use Agavi\Util\Toolkit;
use PHP_CodeCoverage_Filter;

/**
 * Main framework class used for autoloading and initial bootstrapping of the
 * Agavi testing environment
 *
 * @package    agavi
 * @subpackage testing
 *
 * @author     Felix Gilcher <[email protected]>
 * @copyright  The Agavi Project
 *
 * @since      1.0.0
 * @deprecated 1.1.0 Use PhpUnitCli
 *
 * @version    $Id$
 */
class AgaviTesting
{
    /**
     * @var       PHP_CodeCoverage_Filter The code coverage filter for our tests.
     */
    public static $codeCoverageFilter = null;
    
    /**
     * Get the code coverage filter instance we will use for tests.
     * When running PHPUnit 3.5, this will return the singleton instance.
     * When running PHPUnit 3.6, this will return the instance we hold internally;
     * this same instance will be passed to PHPUnit in AgaviTesting::dispatch().
     *
     * @return     PHP_CodeCoverage_Filter The code coverage filter for our tests.
     *
     * @author     David Zülke <[email protected]>
     * @since      1.0.7
     * @deprecated 1.1.0 Use PhpUnitCli
     */
    public static function getCodeCoverageFilter()
    {
        if (self::$codeCoverageFilter === null) {
            // PHP_CodeCoverage doesn't expose any version info, we'll have to check if there is a static getInstance method
            self::$codeCoverageFilter = method_exists('PHP_CodeCoverage_Filter', 'getInstance') ? PHP_CodeCoverage_Filter::getInstance() : new PHP_CodeCoverage_Filter();
        }
        
        return self::$codeCoverageFilter;
    }

    /**
     * Startup the Agavi core
     *
     * @param      string $environment environment the environment to use for this session.
     *
     * @author     Felix Gilcher <[email protected]>
     * @since      1.0.0
     * @deprecated 1.1.0 Use PhpUnitCli
     */
    public static function bootstrap($environment = null)
    {
        PhpUnitCli::bootstrap($environment);
    }

    /**
     * Dispatch the test run.
     *
     * @param      array $arguments An array of arguments configuring PHPUnit behavior.
     * @param      bool  $exit Whether exit() should be called with an appropriate shell
     *                   exit status to indicate success or failures/errors.
     *
     * @return     \PHPUnit_Framework_TestResult The PHPUnit result object.
     *
     * @author     Felix Gilcher <[email protected]>
     * @author     David Zülke <[email protected]>
     * @since      1.0.0
     * @deprecated 1.1.0 Use PhpUnitCli
     */
    public static function dispatch($arguments = array(), $exit = true)
    {
        
        $suites = include ConfigCache::checkConfig(Config::get('core.testing_dir').'/config/suites.xml');
        $master_suite = new TestSuite('Master');
        
        if (!empty($arguments['include-suite'])) {
            $names = explode(',', $arguments['include-suite']);
            unset($arguments['include-suite']);
            
            foreach ($names as $name) {

                if (empty($suites[$name])) {
                    throw new \InvalidArgumentException(sprintf('Invalid suite name %1$s.', $name));
                }
                
                $master_suite->addTest(self::createSuite($name, $suites[$name]));

            }
        } else {
            $excludes = array();
            if (!empty($arguments['exclude-suite'])) {
                $excludes = explode(',', $arguments['exclude-suite']);
                unset($arguments['exclude-suite']);
            }
            foreach ($suites as $name => $suite) {
                if (!in_array($name, $excludes)) {
                    $master_suite->addTest(self::createSuite($name, $suite));

                }
            }
        }
        
        if (version_compare(\PHPUnit_Runner_Version::id(), '3.6', '<')) {
            // PHP_CodeCoverage_Filter is a singleton
            $runner = new \PHPUnit_TextUI_TestRunner();
        } else {
            // PHP_CodeCoverage_Filter instance must be passed to the test runner
            $runner = new \PHPUnit_TextUI_TestRunner(null, self::$codeCoverageFilter);
        }
        $result = $runner->doRun($master_suite, $arguments);
        if ($exit) {
            // bai
            exit(self::getExitStatus($result));

        } else {
            // return result so calling code can use it
            return $result;
        }
    }
    
    /**
     * Compute a shell exit status for the given result.
     * Behaves like PHPUnit_TextUI_Command.
     *
     * @param      PHPUnit_Framework_TestResult The test result object.
     *
     * @return     int The shell exit code.
     * @deprecated 1.1.0 Use PhpUnitCli
     */
    public static function getExitStatus(\PHPUnit_Framework_TestResult $result)
    {
        if ($result->wasSuccessful()) {
            return \PHPUnit_TextUI_TestRunner::SUCCESS_EXIT;
        } elseif ($result->errorCount()) {
            return \PHPUnit_TextUI_TestRunner::EXCEPTION_EXIT;
        } else {
            return \PHPUnit_TextUI_TestRunner::FAILURE_EXIT;
        }
    }
    
    /**
     * Initialize a suite from the given instructions and add registered tests.
     *
     * @param      string Name of the suite
     * @param      array  An array containing information about the suite
     *
     * @return     TestSuite The initialized test suite object.
     *
     * @author     Felix Gilcher <[email protected]>
     * @since      1.0.0
     * @deprecated 1.1.0 Use PhpUnitCli
     */
    protected static function createSuite($name, array $suite)
    {
        $base = (null == $suite['base']) ? 'tests' : $suite['base'];
        if (!Toolkit::isPathAbsolute($base)) {
            $base = Config::get('core.testing_dir').'/'.$base;
        }
        $s = new $suite['class']($name);
        if (!empty($suite['includes'])) {
            foreach (new \RecursiveIteratorIterator(
                    new RecursiveDirectoryFilterIterator(
                        new \RecursiveDirectoryIterator($base),
                        $suite['includes'],
                        $suite['excludes']
                    ),
                    \RecursiveIteratorIterator::CHILD_FIRST
                ) as $finfo) {
                if ($finfo->isFile()) {
                    $s->addTestFile($finfo->getPathName());
                }
            }
        }
        foreach ($suite['testfiles'] as $file) {

            if (!Toolkit::isPathAbsolute($file)) {
                $file = $base.'/'.$file;
            }
            $s->addTestFile($file);
        }
        return $s;
    }
    
    /**
     * Handles the commandline arguments passed.
     *
     * @return     array the commandline arguments
     *
     * @author     Felix Gilcher <[email protected]>
     * @since      1.0.0
     * @deprecated 1.1.0 Use PhpUnitCli
     */
    public static function processCommandlineOptions()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        $longOptions = array(
            'configuration=',
            'coverage-html=',
            'coverage-clover=',
            'coverage-source=',
            'coverage-xml=',
            'report=',
            'environment=',
            'help',
            'log-graphviz=',
            'log-json=',
            'log-metrics=',
            'log-pmd=',
            'log-tap=',
            'log-xml=',
            'include-suite=',
            'exclude-suite=',
        );
        
        try {
            $options = \PHPUnit_Util_Getopt::getopt(
                $_SERVER['argv'],
                'd:',
                $longOptions
            );
        } catch (\RuntimeException $e) {
            \PHPUnit_TextUI_TestRunner::showError($e->getMessage());
        }
        
        $arguments = array();
        
        foreach ($options[0] as $option) {
            switch ($option[0]) {
                case '--configuration':
                    $arguments['configuration'] = $option[1];
                    break;
                
                case '--coverage-clover':
                case '--coverage-xml':
                    if (self::checkCodeCoverageDeps()) {

                        $arguments['coverageClover'] = $option[1];
                    }
                    break;
                
                case '--coverage-source':
                    if (self::checkCodeCoverageDeps()) {

                        $arguments['coverageSource'] = $option[1];
                    }
                    break;
                
                case '--coverage-html':
                case '--report':
                    if (self::checkCodeCoverageDeps()) {

                        $arguments['reportDirectory'] = $option[1];
                    }
                    break;
                
                case '--environment':
                    $arguments['environment'] = $option[1];
                    break;
                
                case '--help':
                    self::showHelp();

                    exit(\PHPUnit_TextUI_TestRunner::SUCCESS_EXIT);

                    break;
function fx() {
    try {
        doSomething();
        return true;
    }
    catch (\Exception $e) {
        return false;
    }

    return false;
}
                
                case '--log-json':
                    $arguments['jsonLogfile'] = $option[1];
                    break;
                
                case '--log-graphviz':
                    if (\PHPUnit_Util_Filesystem::fileExistsInIncludePath('Image/GraphViz.php')) {
                        $arguments['graphvizLogfile'] = $option[1];
                    } else {
                        throw new \Exception('The Image_GraphViz package is not installed.');
                    }
                    break;
                
                case '--log-tap':
                    $arguments['tapLogfile'] = $option[1];
                    break;
                
                case '--log-xml':
                    $arguments['xmlLogfile'] = $option[1];
                    break;
                
                case '--log-pmd':
                    if (self::checkCodeCoverageDeps()) {

                        $arguments['pmdXML'] = $option[1];
                    }
                    break;
                
                case '--log-metrics':
                    if (self::checkCodeCoverageDeps()) {

                        $arguments['metricsXML'] = $option[1];
                    }
                    break;
                
                case '--include-suite':
                    $arguments['include-suite'] = $option[1];
                    break;
                
                case '--exclude-suite':
                    $arguments['exclude-suite'] = $option[1];
                    break;
            }
        }
        
        return $arguments;
    }
    
    /**
     * Checks whether all dependencies for writing code coverage information
     * are met.
     *
     * @return     true if all deps are met
     * @throws     AgaviException if a dependency is missing
     *
     * @author     Felix Gilcher <[email protected]>
     * @since      1.0.0
     * @deprecated 1.1.0 Use PhpUnitCli
     */
    protected static function checkCodeCoverageDeps()
    {
        if (extension_loaded('tokenizer') && extension_loaded('xdebug')) {
            return true;
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
        } else {
            if (!extension_loaded('tokenizer')) {
                throw new AgaviException('The tokenizer extension is not loaded.');
            } else {
                throw new AgaviException('The Xdebug extension is not loaded.');
            }
        }
        
        return false;
function fx() {
    try {
        doSomething();
        return true;
    }
    catch (\Exception $e) {
        return false;
    }

    return false;
}
    }
    
    /**
     * shows the help for the commandline call
     *
     * @author     Felix Gilcher <[email protected]>
     * @since      1.0.0
     * @deprecated 1.1.0 Use PhpUnitCli
     */
    protected static function showHelp()
    {
        \PHPUnit_TextUI_TestRunner::printVersionString();

        print <<<EOT
Usage: run-tests.php [switches]

  --environment <envname>  use environment named <envname> to run the tests. Defaults to "testing".

  --log-graphviz <file>    Log test execution in GraphViz markup.
  --log-json <file>        Log test execution in JSON format.
  --log-tap <file>         Log test execution in TAP format to file.
  --log-xml <file>         Log test execution in XML format to file.
  --log-metrics <file>     Write metrics report in XML format.
  --log-pmd <file>         Write violations report in PMD XML format.

  --configuration <file>   PHPUnit XML configuration file to use.

  --coverage-html <dir>    Generate code coverage report in HTML format.
  --coverage-clover <file> Write code coverage data in Clover XML format.
  --coverage-source <dir>  Write code coverage / source data in XML format.

  --include-suite <suites> run only suites named <suite>, accepts a list of suites, comma separated.
  --exclude-suite <suites> run all but suites named <suite>, accepts a list of suites, comma separated.

  --help                   Prints this usage information.


EOT;
    }
}


horros / agavi2

Issues (1131)

Security Analysis not enabled

src/testing/AgaviTesting.class.php (17 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like