Issues in VersionParser.php (master) - Issues in master - humbug/phar-updater - Measure and Improve Code Quality continuously with Scrutinizer

Issues (18)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/VersionParser.php (1 issue)

Labels

Severity

Major 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/**
 * Humbug
 *
 * @category   Humbug
 * @package    Humbug
 * @copyright  Copyright (c) 2015 Pádraic Brady (http://blog.astrumfutura.com)
 * @license    https://github.com/padraic/phar-updater/blob/master/LICENSE New BSD License
 *
 * This class is partially patterned after Composer's version parser.
 */

namespace Humbug\SelfUpdate;

class VersionParser
{

    /**
     * @var array
     */
    private $versions;

    /**
     * @var string
     */
    private $modifier = '[._-]?(?:(stable|beta|b|RC|alpha|a|patch|pl|p)(?:[.-]?(\d+))?)?([.-]?dev)?';

    /**
     * @param array $versions
     */
    public function __construct(array $versions = array())
    {
        $this->versions = $versions;
    }

    /**
     * Get the most recent stable numbered version from versions passed to
     * constructor (if any)
     *
     * @return string
     */
    public function getMostRecentStable()
    {
        return $this->selectRecentStable();
    }

    /**
     * Get the most recent unstable numbered version from versions passed to
     * constructor (if any)
     *
     * @return string
     */
    public function getMostRecentUnStable()
    {
        return $this->selectRecentUnstable();
    }

    /**
     * Get the most recent stable or unstable numbered version from versions passed to
     * constructor (if any)
     *
     * @return string
     */
    public function getMostRecentAll()
    {
        return $this->selectRecentAll();
    }

    /**
     * Checks if given version string represents a stable numbered version
     *
     * @param string $version
     * @return bool
     */
    public function isStable($version)
    {
        return $this->stable($version);
    }

    /**
     * Checks if given version string represents a 'pre-release' version, i.e.
     * it's unstable but not development level.
     *
     * @param string $version
     * @return bool
     */
    public function isPreRelease($version)
    {
        return !$this->stable($version) && !$this->development($version);
    }

    /**
     * Checks if given version string represents an unstable or dev-level
     * numbered version
     *
     * @param string $version
     * @return bool
     */
    public function isUnstable($version)
    {
        return !$this->stable($version);
    }

    /**
     * Checks if given version string represents a dev-level numbered version
     *
     * @param string $version
     * @return bool
     */
    public function isDevelopment($version)
    {
        return $this->development($version);
    }

    private function selectRecentStable()
    {
        $candidates = array();
        foreach ($this->versions as $version) {
            if (!$this->stable($version)) {
                continue;
            }
            $candidates[] = $version;
        }
        if (empty($candidates)) {
            return false;
        }
        return $this->findMostRecent($candidates);
    }

    private function selectRecentUnstable()
    {
        $candidates = array();
        foreach ($this->versions as $version) {
            if ($this->stable($version) || $this->development($version)) {
                continue;
            }
            $candidates[] = $version;
        }
        if (empty($candidates)) {
            return false;
        }
        return $this->findMostRecent($candidates);
    }

    private function selectRecentAll()
    {
        $candidates = array();
        foreach ($this->versions as $version) {
            if ($this->development($version)) {
                continue;
            }
            $candidates[] = $version;
        }
        if (empty($candidates)) {
            return false;
        }
        return $this->findMostRecent($candidates);
    }

    private function findMostRecent(array $candidates)
    {
        $candidate = null;
        $tracker = null;
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}
        foreach ($candidates as $version) {
            if (version_compare($candidate, $version, '<')) {
                $candidate = $version;
            }
        }
        return $candidate;
    }

    private function stable($version)
    {
        $version = preg_replace('{#.+$}i', '', $version);
        if ($this->development($version)) {
            return false;
        }
        preg_match('{'.$this->modifier.'$}i', strtolower($version), $match);
        if (!empty($match[3])) {
            return false;
        }
        if (!empty($match[1])) {
            if ('beta' === $match[1] || 'b' === $match[1]
            || 'alpha' === $match[1] || 'a' === $match[1]
            || 'rc' === $match[1]) {
                return false;
            }
        }
        return true;
    }

    private function development($version)
    {
        if ('dev-' === substr($version, 0, 4) || '-dev' === substr($version, -4)) {
            return true;
        }
        if (1 == preg_match("/-\d+-[a-z0-9]{8,}$/", $version)) {
            return true;
        }
        return false;
    }
}


1		<?php
2		/**
3		* Humbug
4		*
5		* @category Humbug
6		* @package Humbug
7		* @copyright Copyright (c) 2015 Pádraic Brady (http://blog.astrumfutura.com)
8		* @license https://github.com/padraic/phar-updater/blob/master/LICENSE New BSD License
9		*
10		* This class is partially patterned after Composer's version parser.
11		*/
12
13		namespace Humbug\SelfUpdate;
14
15		class VersionParser
16		{
17
18		/**
19		* @var array
20		*/
21		private $versions;
22
23		/**
24		* @var string
25		*/
26		private $modifier = '[._-]?(?:(stable\|beta\|b\|RC\|alpha\|a\|patch\|pl\|p)(?:[.-]?(\d+))?)?([.-]?dev)?';
27
28		/**
29		* @param array $versions
30		*/
31		public function __construct(array $versions = array())
32		{
33		$this->versions = $versions;
34		}
35
36		/**
37		* Get the most recent stable numbered version from versions passed to
38		* constructor (if any)
39		*
40		* @return string
41		*/
42		public function getMostRecentStable()
43		{
44		return $this->selectRecentStable();
45		}
46
47		/**
48		* Get the most recent unstable numbered version from versions passed to
49		* constructor (if any)
50		*
51		* @return string
52		*/
53		public function getMostRecentUnStable()
54		{
55		return $this->selectRecentUnstable();
56		}
57
58		/**
59		* Get the most recent stable or unstable numbered version from versions passed to
60		* constructor (if any)
61		*
62		* @return string
63		*/
64		public function getMostRecentAll()
65		{
66		return $this->selectRecentAll();
67		}
68
69		/**
70		* Checks if given version string represents a stable numbered version
71		*
72		* @param string $version
73		* @return bool
74		*/
75		public function isStable($version)
76		{
77		return $this->stable($version);
78		}
79
80		/**
81		* Checks if given version string represents a 'pre-release' version, i.e.
82		* it's unstable but not development level.
83		*
84		* @param string $version
85		* @return bool
86		*/
87		public function isPreRelease($version)
88		{
89		return !$this->stable($version) && !$this->development($version);
90		}
91
92		/**
93		* Checks if given version string represents an unstable or dev-level
94		* numbered version
95		*
96		* @param string $version
97		* @return bool
98		*/
99		public function isUnstable($version)
100		{
101		return !$this->stable($version);
102		}
103
104		/**
105		* Checks if given version string represents a dev-level numbered version
106		*
107		* @param string $version
108		* @return bool
109		*/
110		public function isDevelopment($version)
111		{
112		return $this->development($version);
113		}
114
115	View Code Duplication	private function selectRecentStable()
116		{
117		$candidates = array();
118		foreach ($this->versions as $version) {
119		if (!$this->stable($version)) {
120		continue;
121		}
122		$candidates[] = $version;
123		}
124		if (empty($candidates)) {
125		return false;
126		}
127		return $this->findMostRecent($candidates);
128		}
129
130	View Code Duplication	private function selectRecentUnstable()
131		{
132		$candidates = array();
133		foreach ($this->versions as $version) {
134		if ($this->stable($version) \|\| $this->development($version)) {
135		continue;
136		}
137		$candidates[] = $version;
138		}
139		if (empty($candidates)) {
140		return false;
141		}
142		return $this->findMostRecent($candidates);
143		}
144
145	View Code Duplication	private function selectRecentAll()
146		{
147		$candidates = array();
148		foreach ($this->versions as $version) {
149		if ($this->development($version)) {
150		continue;
151		}
152		$candidates[] = $version;
153		}
154		if (empty($candidates)) {
155		return false;
156		}
157		return $this->findMostRecent($candidates);
158		}
159
160		private function findMostRecent(array $candidates)
161		{
162		$candidate = null;
163		$tracker = null;
		0 ignored issues – show Unused Code introduced 2017-04-14 16:46 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$tracker` is not used, you could remove the assignment. This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value'; $higher = false; if (rand(1, 6) > 3) { $higher = true; } else { $higher = false; } Both the `$myVar` assignment in line 1 and the `$higher` assignment in line 2 are dead. The first because `$myVar` is never used and the second because `$higher` is always overwritten for every possible time line. Loading history...
164		foreach ($candidates as $version) {
165		if (version_compare($candidate, $version, '<')) {
166		$candidate = $version;
167		}
168		}
169		return $candidate;
170		}
171
172		private function stable($version)
173		{
174		$version = preg_replace('{#.+$}i', '', $version);
175		if ($this->development($version)) {
176		return false;
177		}
178		preg_match('{'.$this->modifier.'$}i', strtolower($version), $match);
179		if (!empty($match[3])) {
180		return false;
181		}
182		if (!empty($match[1])) {
183		if ('beta' === $match[1] \|\| 'b' === $match[1]
184		\|\| 'alpha' === $match[1] \|\| 'a' === $match[1]
185		\|\| 'rc' === $match[1]) {
186		return false;
187		}
188		}
189		return true;
190		}
191
192		private function development($version)
193		{
194		if ('dev-' === substr($version, 0, 4) \|\| '-dev' === substr($version, -4)) {
195		return true;
196		}
197		if (1 == preg_match("/-\d+-[a-z0-9]{8,}$/", $version)) {
198		return true;
199		}
200		return false;
201		}
202		}
203

humbug / phar-updater

Issues (18)

Security Analysis no request data

src/VersionParser.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like