1 | <?php |
||
6 | class Response extends BaseResponse |
||
7 | { |
||
8 | /** |
||
9 | * if content is an array, then convert to json |
||
10 | * @param mixed $content |
||
11 | */ |
||
12 | public function setDataContent($content) |
||
21 | |||
22 | /** |
||
23 | * @param mixed $content The response content, see setContent() |
||
24 | * @param int $status The response status code |
||
25 | * @param array $headers An array of response headers |
||
26 | * |
||
27 | * @return Response |
||
28 | */ |
||
29 | public static function create($content = '', $status = 200, $headers = array()) |
||
33 | |||
34 | /** |
||
35 | * Setup response 404 |
||
36 | * @param string $path |
||
37 | */ |
||
38 | public function setNotFound($path) |
||
43 | } |
||
44 |
'not found : ' . $path
can contain request data and is used in output context(s) leading to a potential security vulnerability.General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: