| 1 | <?php |
||
| 6 | class Response extends BaseResponse |
||
| 7 | { |
||
| 8 | /** |
||
| 9 | * if content is an array, then convert to json |
||
| 10 | * @param mixed $content |
||
| 11 | */ |
||
| 12 | public function setDataContent($content) |
||
| 21 | |||
| 22 | /** |
||
| 23 | * @param mixed $content The response content, see setContent() |
||
| 24 | * @param int $status The response status code |
||
| 25 | * @param array $headers An array of response headers |
||
| 26 | * |
||
| 27 | * @return Response |
||
| 28 | */ |
||
| 29 | public static function create($content = '', $status = 200, $headers = array()) |
||
| 33 | |||
| 34 | /** |
||
| 35 | * Setup response 404 |
||
| 36 | * @param string $path |
||
| 37 | */ |
||
| 38 | public function setNotFound($path) |
||
| 43 | } |
||
| 44 |
'not found : ' . $pathcan contain request data and is used in output context(s) leading to a potential security vulnerability.General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }For numeric data, we recommend to explicitly cast the data: