Issues (311)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

lib/timber-url-helper.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
class TimberURLHelper {
4
5
	/**
6
	 *
7
	 *
8
	 * @return string
9
	 */
10
	public static function get_current_url() {
11
		$pageURL = "http://";
12
		if ( isset( $_SERVER['HTTPS'] ) && $_SERVER["HTTPS"] == "on" ) {
13
			$pageURL = "https://";;
14
		}
15
		if ( isset($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"] && $_SERVER["SERVER_PORT"] != "80" ) {
16
			$pageURL .= self::get_host() . ":" . $_SERVER["SERVER_PORT"] . $_SERVER["REQUEST_URI"];
17
		} else {
18
			$pageURL .= self::get_host() . $_SERVER["REQUEST_URI"];
19
		}
20
		return $pageURL;
21
	}
22
23
	/**
24
	 *
25
	 *
26
	 * @param string  $url
27
	 * @return bool
28
	 */
29
	public static function is_url( $url ) {
30
		if ( !is_string( $url ) ) {
31
			return false;
32
		}
33
		$url = strtolower( $url );
34
		if ( strstr( $url, '://' ) ) {
35
			return true;
36
		}
37
		return false;
38
	}
39
40
	/**
41
	 *
42
	 *
43
	 * @return string
44
	 */
45
	public static function get_path_base() {
46
		$struc = get_option( 'permalink_structure' );
47
		$struc = explode( '/', $struc );
48
		$p = '/';
49
		foreach ( $struc as $s ) {
50
			if ( !strstr( $s, '%' ) && strlen( $s ) ) {
51
				$p .= $s . '/';
52
			}
53
		}
54
		return $p;
55
	}
56
57
	/**
58
	 *
59
	 *
60
	 * @param string  $url
61
	 * @param bool    $force
62
	 * @return string
63
	 */
64
	public static function get_rel_url( $url, $force = false ) {
65
		$url_info = parse_url( $url );
66
		if ( isset( $url_info['host'] ) && $url_info['host'] != self::get_host() && !$force ) {
67
			return $url;
68
		}
69
		$link = '';
70
		if ( isset( $url_info['path'] ) ) {
71
			$link = $url_info['path'];
72
		}
73
		if ( isset( $url_info['query'] ) && strlen( $url_info['query'] ) ) {
74
			$link .= '?' . $url_info['query'];
75
		}
76
		if ( isset( $url_info['fragment'] ) && strlen( $url_info['fragment'] ) ) {
77
			$link .= '#' . $url_info['fragment'];
78
		}
79
		$link = TimberURLHelper::remove_double_slashes( $link );
80
		return $link;
81
	}
82
83
	/**
84
	 * Some setups like HTTP_HOST, some like SERVER_NAME, it's complicated
85
	 * @link http://stackoverflow.com/questions/2297403/http-host-vs-server-name
86
	 * @return string the HTTP_HOST or SERVER_NAME
87
	 */
88
	public static function get_host() {
89
		if (isset($_SERVER['HTTP_HOST'])) {
90
			return $_SERVER['HTTP_HOST'];
91
		}
92
		if (isset($_SERVER['SERVER_NAME'])) {
93
			return $_SERVER['SERVER_NAME'];
94
		}
95
		return '';
96
	}
97
98
	/**
99
	 *
100
	 *
101
	 * @param string  $url
102
	 * @return bool
103
	 */
104
	public static function is_local( $url ) {
105
		if ( strstr( $url, self::get_host() ) ) {
106
			return true;
107
		}
108
		return false;
109
	}
110
111
	/**
112
	 *
113
	 *
114
	 * @param string  $src
115
	 * @return string
116
	 */
117
	public static function get_full_path( $src ) {
118
		$root = ABSPATH;
119
		$old_root_path = $root . $src;
120
		$old_root_path = str_replace( '//', '/', $old_root_path );
121
		return $old_root_path;
122
	}
123
124
	/**
125
	 * Takes a url and figures out its place based in the file system based on path
126
	 * NOTE: Not fool-proof, makes a lot of assumptions about the file path
127
	 * matching the URL path
128
	 *
129
	 * @param string  $url
130
	 * @return string
131
	 */
132
	public static function url_to_file_system( $url ) {
133
		$url_parts = parse_url( $url );
134
		$path = ABSPATH . $url_parts['path'];
135
		$path = str_replace( '//', '/', $path );
136
		return $path;
137
	}
138
139
	public static function file_system_to_url( $fs ) {
140
		$relative_path = self::get_rel_path( $fs );
141
		$home = home_url( '/'.$relative_path );
142
		return $home;
143
	}
144
145
	/**
146
	 *
147
	 *
148
	 * @param string  $src
149
	 * @return string
150
	 */
151
	public static function get_rel_path( $src ) {
152
		if ( strstr( $src, ABSPATH ) ) {
153
			return str_replace( ABSPATH, '', $src );
154
		}
155
		//its outside the wordpress directory, alternate setups:
156
		$src = str_replace( WP_CONTENT_DIR, '', $src );
157
		return WP_CONTENT_SUBDIR . $src;
158
	}
159
160
	/**
161
	 *
162
	 *
163
	 * @param string  $url
164
	 * @return string
165
	 */
166
	public static function remove_double_slashes( $url ) {
167
		$url = str_replace( '//', '/', $url );
168
		if ( strstr( $url, 'http:' ) && !strstr( $url, 'http://' ) ) {
169
			$url = str_replace( 'http:/', 'http://', $url );
170
		}
171
		return $url;
172
	}
173
174
	/**
175
	 *
176
	 *
177
	 * @param string  $url
178
	 * @param string  $path
179
	 * @return string
180
	 */
181
	public static function prepend_to_url( $url, $path ) {
182
		if ( strstr( strtolower( $url ), 'http' ) ) {
183
			$url_parts = parse_url( $url );
184
			$url = $url_parts['scheme'] . '://' . $url_parts['host'] . $path . $url_parts['path'];
185
			if ( isset( $url_parts['query'] ) ) {
186
				$url .= $url_parts['query'];
187
			}
188
			if ( isset( $url_parts['fragment'] ) ) {
189
				$url .= $url_parts['fragment'];
190
			}
191
		} else {
192
			$url = $url . $path;
193
		}
194
		return self::remove_double_slashes( $url );
195
	}
196
197
	/**
198
	 *
199
	 *
200
	 * @param string  $path
201
	 * @return string
202
	 */
203
	public static function preslashit( $path ) {
204
		if ( strpos( $path, '/' ) != 0 ) {
205
			$path = '/' . $path;
206
		}
207
		return $path;
208
	}
209
210
	/**
211
	 * This will evaluate wheter a URL is at an aboslute location (like http://example.org/whatever)
212
	 *
213
	 * @return boolean true if $path is an absolute url, false if relative.
214
	 */
215
	public static function is_absolute( $path ) {
216
		return (boolean) ( strstr( $path, 'http' ) );
217
	}
218
219
	/**
220
	 * This function is slightly different from the one below in the case of:
221
	 * an image hosted on the same domain BUT on a different site than the
222
	 * Wordpress install will be reported as external content.
223
	 *
224
	 * @param string  $url a URL to evaluate against
225
	 * @return boolean if $url points to an external location returns true
226
	 */
227
	public static function is_external_content( $url ) {
228
		$is_external = TimberURLHelper::is_absolute( $url ) && ! TimberURLHelper::is_internal_content( $url );
229
230
		return $is_external;
231
	}
232
233
	private static function is_internal_content($url) {
234
		// using content_url() instead of site_url or home_url is IMPORTANT
235
		// otherwise you run into errors with sites that:
236
		// 1. use WPML plugin
237
		// 2. or redefine content directory
238
		$is_content_url = strstr( $url, content_url() );
239
240
		// this case covers when the upload directory has been redefined
241
		$upload_dir = wp_upload_dir();
242
		$is_upload_url = strstr( $url, $upload_dir['baseurl'] );
243
244
		return $is_content_url || $is_upload_url;
245
	}
246
    
247
	/**
248
	 *
249
	 *
250
	 * @param string  $url
251
	 * @return bool     true if $path is an external url, false if relative or local.
252
	 *                  true if it's a subdomain (http://cdn.example.org = true)
253
	 */
254
	public static function is_external( $url ) {
255
		$has_http = strstr( strtolower( $url ), 'http' );
256
		$on_domain = strstr( $url, self::get_host() );
257
		if ( $has_http && !$on_domain ) {
258
			return true;
259
		}
260
		return false;
261
	}
262
263
	/**
264
	 * Pass links through untrailingslashit unless they are a single /
265
	 *
266
	 * @param string  $link
267
	 * @return string
268
	 */
269
	public static function remove_trailing_slash( $link ) {
270
		if ( $link != "/" )
271
			$link = untrailingslashit( $link );
272
		return $link;
273
	}
274
275
	/**
276
	 * Download an external file via a URL
277
	 *
278
	 * @param string  $url
279
	 * @param int     $timeout
280
	 * @return string|WP_Error the location of the temporay file name or an error
281
	 * @deprecated since 0.20.0
282
	 */
283
	static function download_url( $url, $timeout = 300 ) {
0 ignored issues
show
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
284
		if ( !$url ) {
285
			return new WP_Error( 'http_no_url', __( 'Invalid URL Provided.' ) );
286
		}
287
288
		$tmpfname = wp_tempnam( $url );
289
		if ( !$tmpfname ) {
290
			return new WP_Error( 'http_no_file', __( 'Could not create Temporary file.' ) );
291
		}
292
293
		$response = wp_remote_get( $url, array( 'timeout' => $timeout, 'stream' => true, 'filename' => $tmpfname ) );
294
295
		if ( is_wp_error( $response ) ) {
296
			unlink( $tmpfname );
297
			return $response;
298
		}
299
		if ( 200 != wp_remote_retrieve_response_code( $response ) ) {
300
			unlink( $tmpfname );
301
			return new WP_Error( 'http_404', trim( wp_remote_retrieve_response_message( $response ) ) );
302
		}
303
		return $tmpfname;
304
	}
305
306
	/**
307
	 * Returns the url parameters, for example for url http://example.org/blog/post/news/2014/whatever
308
	 * this will return array('blog', 'post', 'news', '2014', 'whatever');
309
	 * OR if sent an integer like: TimberUrlHelper::get_params(2); this will return 'news';
310
	 *
311
	 * @param int $i the position of the parameter to grab.
0 ignored issues
show
Should the type for parameter $i not be false|integer?

This check looks for @param annotations where the type inferred by our type inference engine differs from the declared type.

It makes a suggestion as to what type it considers more descriptive.

Most often this is a case of a parameter that can be null in addition to its declared types.

Loading history...
312
	 * @return array|string
313
	 */
314
	public static function get_params( $i = false ) {
315
		$args = explode( '/', trim( strtolower( $_SERVER['REQUEST_URI'] ) ) );
316
		$newargs = array();
317
		foreach ( $args as $arg ) {
318
			if ( strlen( $arg ) ) {
319
				$newargs[] = $arg;
320
			}
321
		}
322
		if ( $i === false ) {
323
			return $newargs;
324
		}
325
		if ( $i < 0 ) {
326
			//count from end
327
			$i = count( $newargs ) + $i;
328
		}
329
		if ( isset( $newargs[$i] ) ) {
330
			return $newargs[$i];
331
		}
332
	}
333
334
}
335