for testing and deploying your application
for finding and fixing issues
for empowering human code reviews
<?php
namespace JayaCode\Framework\Core\Http;
use Symfony\Component\HttpFoundation\Response as BaseResponse;
class Response extends BaseResponse
{
/**
* if content is an array, then convert to json
* @param mixed $content
* @return BaseResponse
*/
public function setContent($content)
if (is_array($content)) {
$this->headers->set('Content-Type', 'application/json');
$content = json_encode($content);
}
return parent::setContent($content);
$content
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }
For numeric data, we recommend to explicitly cast the data:
$sanitized = (integer) $tainted;
* @param mixed $content The response content, see setContent()
* @param int $status The response status code
* @param array $headers An array of response headers
*
* @return Response
public static function create($content = '', $status = 200, $headers = array())
return new static($content, $status, $headers);
* Setup response 404
* @param string $path
public function setNotFound($path)
$this->setStatusCode(404);
$this->setContent("not found : " . $path);
jayacode /
framework
$contentcan contain request data and is used in output context(s) leading to a potential security vulnerability.General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }For numeric data, we recommend to explicitly cast the data: