Issues in UDP.php (master) - Issues in master - kakserpom/phpdaemon - Measure and Improve Code Quality continuously with Scrutinizer

Issues (1507)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

PHPDaemon/BoundSocket/UDP.php (16 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
namespace PHPDaemon\BoundSocket;

use PHPDaemon\Core\Daemon;
use PHPDaemon\Core\Debug;
use PHPDaemon\Core\Timer;
use PHPDaemon\Core\EventLoop;

/**
 * UDP
 *
 * @package Core
 *
 * @author  Vasily Zorin <[email protected]>
 */
class UDP extends Generic
{
    /**
     * Hostname
     * @var string
     */
    protected $host;

    /**
     * Port
     * @var integer
     */
    protected $port;

    /**
     * Listener mode?
     * @var boolean
     */
    protected $listenerMode = true;

    /**
     * Default port
     * @var integer
     */
    protected $defaultPort;

    /**
     * Reuse?
     * @var boolean
     */
    protected $reuse = true;

    /**
     * Ports map
     * @var array [portNumber => Connection]
     */
    protected $portsMap = [];

    /**
     * Sets default port
     * @param integer $port Port
     * @return void
     */
    public function setDefaultPort($port)
    {
        $this->defaultPort = $port;
    }

    /**
     * Send UDP packet
     * @param string $data Data
     * @param integer $flags Flags
     * @param string $host Host
     * @param integer $port Port
     * @return integer
     */
    public function sendTo($data, $flags, $host, $port)
    {
        return socket_sendto($this->fd, $data, mb_orig_strlen($data), $flags, $host, $port);
    }

    /**
     * Unassigns addr
     * @param string $addr Address
     * @return void
     */
    public function unassignAddr($addr)
    {
        unset($this->portsMap[$addr]);
    }

    /**
     * Sets reuse
     * @param integer $reuse Port

     * @return void
     */
    public function setReuse($reuse = true)
    {
        $this->reuse = $reuse;
class Id
{
    public $id;

    public function __construct($id)
    {
        $this->id = $id;
    }

}

class Account
{
    /** @var  Id $id */
    public $id;
}

$account_id = false;

if (starsAreRight()) {
    $account_id = new Id(42);
}

$account = new Account();
if ($account instanceof Id)
{
    $account->id = $account_id;
}
    }

    /**
     * Bind given addreess
     * @return boolean Success.
     */
    public function bindSocket()
    {
        $sock = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
        if (!$sock) {

            $errno = socket_last_error();
            Daemon::$process->log(get_class($this) . ': Couldn\'t create UDP-socket (' . $errno . ' - ' . socket_strerror($errno) . ').');
            return false;
        }
        if (!isset($this->port)) {
            if (isset($this->defaultPort)) {
                $this->port = $this->defaultPort;
            } else {

                Daemon::log(get_class($this) . ' (' . get_class($this->pool) . '): no port defined for \'' . $this->uri['uri'] . '\'');
            }
        }
        if ($this->reuse) {

            if (!socket_set_option($sock, SOL_SOCKET, SO_REUSEADDR, 1)) {
                $errno = socket_last_error();
                Daemon::$process->log(get_class($this) . ': Couldn\'t set option REUSEADDR to socket (' . $errno . ' - ' . socket_strerror($errno) . ').');
                return false;
            }
            if (defined('SO_REUSEPORT') && !@socket_set_option($sock, SOL_SOCKET, SO_REUSEPORT, 1)) {
                $errno = socket_last_error();
                Daemon::$process->log(get_class($this) . ': Couldn\'t set option REUSEPORT to socket (' . $errno . ' - ' . socket_strerror($errno) . ').');
                return false;
            }
        }
        if (!@socket_bind($sock, $this->host, $this->port)) {

            $errno = socket_last_error();
            $addr = $this->host . ':' . $this->port;
            Daemon::$process->log(get_class($this) . ': Couldn\'t bind UDP-socket \'' . $addr . '\' (' . $errno . ' - ' . socket_strerror($errno) . ').');
            return false;
        }
        socket_getsockname($sock, $this->host, $this->port);
        $addr = $this->host . ':' . $this->port;
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}
        socket_set_nonblock($sock);
        $this->setFd($sock);
        return true;
    }

    /**
     * Called when socket is bound
     * @return boolean Success
     */
    protected function onBound()
    {
        if (!$this->ev) {
            Daemon::log(get_class($this) . '::' . __METHOD__ . ': Couldn\'t set event on bound socket: ' . Debug::dump($this->fd));
            return false;
        }
        return true;
    }

    /**
     * Enable socket events
     * @return void
     */
    public function enable()

    {
        if ($this->enabled) {
            return;
        }
        if (!$this->fd) {
            return;
        }
        $this->enabled = true;

        if ($this->ev === null) {
            if ($this->eventLoop === null) {
                // @TODO нужно перенести куда-то выше, не годиться тут инициировать
                $this->eventLoop = EventLoop::$instance;
            }

            $this->ev = $this->eventLoop->event($this->fd, \Event::READ | \Event::PERSIST, [$this, 'onReadUdp']);

            $this->onBound();
        } else {
            $this->onAcceptEv();

        }
        $this->ev->add();
    }

    /**
     * Called when we got UDP packet
     * @param resource $stream Descriptor

     * @param integer $events Events
     * @param mixed $arg Attached variable
     * @return boolean Success.
     */
    public function onReadUdp($stream = null, $events = 0, $arg = null)

    {
        if (Daemon::$process->reload) {
            return false;
        }

        if ($this->pool->maxConcurrency) {
            if ($this->pool->count() >= $this->pool->maxConcurrency) {
                $this->overload = true;
class MyClass { }

$x = new MyClass();
$x->foo = true;
                return false;
            }
        }

        $host = null;
        do {
            $l = @socket_recvfrom($this->fd, $buf, 10240, MSG_DONTWAIT, $host, $port);
            if (!$l) {
                break;
            }
            $key = '[' . $host . ']:' . $port;
            if (!isset($this->portsMap[$key])) {
                if ($this->pool->allowedClients !== null) {
                    if (!self::netMatch($this->pool->allowedClients, $host)) {

                        Daemon::log('Connection is not allowed (' . $host . ')');
                    }
                    continue;
                }
                $class = $this->pool->connectionClass;
                $conn = new $class(null, $this->pool);
                $conn->setDgram(true);
                $conn->onWriteEv(null);
                $conn->setPeername($host, $port);
                $conn->setParentSocket($this);
                $this->portsMap[$key] = $conn;
                $conn->timeoutRef = setTimeout(function ($timer) use ($conn) {
                    $conn->finish();
                    $timer->finish();
                }, $conn->timeout * 1e6);
                $conn->onUdpPacket($buf);
            } else {
                $conn = $this->portsMap[$key];
                $conn->onUdpPacket($buf);
                Timer::setTimeout($conn->timeoutRef);
            }
        } while (true);
        return $host !== null;
    }
}


1		<?php
2		namespace PHPDaemon\BoundSocket;
3
4		use PHPDaemon\Core\Daemon;
5		use PHPDaemon\Core\Debug;
6		use PHPDaemon\Core\Timer;
7		use PHPDaemon\Core\EventLoop;
8
9		/**
10		* UDP
11		*
12		* @package Core
13		*
14		* @author Vasily Zorin <[email protected]>
15		*/
16		class UDP extends Generic
17		{
18		/**
19		* Hostname
20		* @var string
21		*/
22		protected $host;
23
24		/**
25		* Port
26		* @var integer
27		*/
28		protected $port;
29
30		/**
31		* Listener mode?
32		* @var boolean
33		*/
34		protected $listenerMode = true;
35
36		/**
37		* Default port
38		* @var integer
39		*/
40		protected $defaultPort;
41
42		/**
43		* Reuse?
44		* @var boolean
45		*/
46		protected $reuse = true;
47
48		/**
49		* Ports map
50		* @var array [portNumber => Connection]
51		*/
52		protected $portsMap = [];
53
54		/**
55		* Sets default port
56		* @param integer $port Port
57		* @return void
58		*/
59		public function setDefaultPort($port)
60		{
61		$this->defaultPort = $port;
62		}
63
64		/**
65		* Send UDP packet
66		* @param string $data Data
67		* @param integer $flags Flags
68		* @param string $host Host
69		* @param integer $port Port
70		* @return integer
71		*/
72		public function sendTo($data, $flags, $host, $port)
73		{
74		return socket_sendto($this->fd, $data, mb_orig_strlen($data), $flags, $host, $port);
75		}
76
77		/**
78		* Unassigns addr
79		* @param string $addr Address
80		* @return void
81		*/
82		public function unassignAddr($addr)
83		{
84		unset($this->portsMap[$addr]);
85		}
86
87		/**
88		* Sets reuse
89		* @param integer $reuse Port
		0 ignored issues – show Documentation introduced 2015-12-06 14:42 UTC by Report Bug Copy Issue Report Show Similar Issues like this Should the type for parameter `$reuse` not be `boolean\|integer`? This check looks for `@param` annotations where the type inferred by our type inference engine differs from the declared type. It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. Loading history...
90		* @return void
91		*/
92		public function setReuse($reuse = true)
93		{
94		$this->reuse = $reuse;
		0 ignored issues – show Documentation Bug introduced 2018-01-16 22:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `$reuse` can also be of type `integer`. However, the property `$reuse` is declared as type `boolean`. Maybe add an additional type check? Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly. For example, imagine you have a variable `$accountId` that can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to the `id` property of an instance of the `Account` class. This class holds a proper account, so the id value must no longer be false. Either this assignment is in error or a type check should be added for that assignment. class Id { public $id; public function __construct($id) { $this->id = $id; } } class Account { /** @var Id $id */ public $id; } $account_id = false; if (starsAreRight()) { $account_id = new Id(42); } $account = new Account(); if ($account instanceof Id) { $account->id = $account_id; } Loading history...
95		}
96
97		/**
98		* Bind given addreess
99		* @return boolean Success.
100		*/
101		public function bindSocket()
102		{
103		$sock = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
104	View Code Duplication	if (!$sock) {
		0 ignored issues – show Duplication introduced 2015-12-06 14:42 UTC by Report Bug Copy Issue Report Show Similar Issues like this This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
105		$errno = socket_last_error();
106		Daemon::$process->log(get_class($this) . ': Couldn\'t create UDP-socket (' . $errno . ' - ' . socket_strerror($errno) . ').');
107		return false;
108		}
109		if (!isset($this->port)) {
110		if (isset($this->defaultPort)) {
111		$this->port = $this->defaultPort;
112	View Code Duplication	} else {
		0 ignored issues – show Duplication introduced 2015-12-06 14:42 UTC by Report Bug Copy Issue Report Show Similar Issues like this This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
113		Daemon::log(get_class($this) . ' (' . get_class($this->pool) . '): no port defined for \'' . $this->uri['uri'] . '\'');
114		}
115		}
116	View Code Duplication	if ($this->reuse) {
		0 ignored issues – show Duplication introduced 2015-12-06 14:42 UTC by Report Bug Copy Issue Report Show Similar Issues like this This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
117		if (!socket_set_option($sock, SOL_SOCKET, SO_REUSEADDR, 1)) {
118		$errno = socket_last_error();
119		Daemon::$process->log(get_class($this) . ': Couldn\'t set option REUSEADDR to socket (' . $errno . ' - ' . socket_strerror($errno) . ').');
120		return false;
121		}
122		if (defined('SO_REUSEPORT') && !@socket_set_option($sock, SOL_SOCKET, SO_REUSEPORT, 1)) {
123		$errno = socket_last_error();
124		Daemon::$process->log(get_class($this) . ': Couldn\'t set option REUSEPORT to socket (' . $errno . ' - ' . socket_strerror($errno) . ').');
125		return false;
126		}
127		}
128	View Code Duplication	if (!@socket_bind($sock, $this->host, $this->port)) {
		0 ignored issues – show Duplication introduced 2015-12-06 14:42 UTC by Report Bug Copy Issue Report Show Similar Issues like this This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
129		$errno = socket_last_error();
130		$addr = $this->host . ':' . $this->port;
131		Daemon::$process->log(get_class($this) . ': Couldn\'t bind UDP-socket \'' . $addr . '\' (' . $errno . ' - ' . socket_strerror($errno) . ').');
132		return false;
133		}
134		socket_getsockname($sock, $this->host, $this->port);
135		$addr = $this->host . ':' . $this->port;
		0 ignored issues – show Unused Code introduced 2015-12-06 14:42 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$addr` is not used, you could remove the assignment. This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value'; $higher = false; if (rand(1, 6) > 3) { $higher = true; } else { $higher = false; } Both the `$myVar` assignment in line 1 and the `$higher` assignment in line 2 are dead. The first because `$myVar` is never used and the second because `$higher` is always overwritten for every possible time line. Loading history...
136		socket_set_nonblock($sock);
137		$this->setFd($sock);
138		return true;
139		}
140
141		/**
142		* Called when socket is bound
143		* @return boolean Success
144		*/
145		protected function onBound()
146		{
147		if (!$this->ev) {
148		Daemon::log(get_class($this) . '::' . __METHOD__ . ': Couldn\'t set event on bound socket: ' . Debug::dump($this->fd));
149		return false;
150		}
151		return true;
152		}
153
154		/**
155		* Enable socket events
156		* @return void
157		*/
158	View Code Duplication	public function enable()
		0 ignored issues – show Duplication introduced 2018-01-16 22:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
159		{
160		if ($this->enabled) {
161		return;
162		}
163		if (!$this->fd) {
164		return;
165		}
166		$this->enabled = true;
167
168		if ($this->ev === null) {
169		if ($this->eventLoop === null) {
170		// @TODO нужно перенести куда-то выше, не годиться тут инициировать
171		$this->eventLoop = EventLoop::$instance;
172		}
173
174		$this->ev = $this->eventLoop->event($this->fd, \Event::READ \| \Event::PERSIST, [$this, 'onReadUdp']);
		0 ignored issues – show Documentation Bug introduced 2020-06-02 22:19 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `$this->eventLoop->event(...ay($this, 'onReadUdp'))` of type `object<Event>` is incompatible with the declared type `object<EventListener\Event>` of property `$ev`. Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property. Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property.. Loading history...
175		$this->onBound();
176		} else {
177		$this->onAcceptEv();
		0 ignored issues – show Bug introduced 2015-12-06 14:42 UTC by Report Bug Copy Issue Report Show Similar Issues like this The call to `onAcceptEv()` misses some required arguments starting with `$listener`. Loading history...
178		}
179		$this->ev->add();
180		}
181
182		/**
183		* Called when we got UDP packet
184		* @param resource $stream Descriptor
		0 ignored issues – show Documentation introduced 2015-12-06 14:42 UTC by Report Bug Copy Issue Report Show Similar Issues like this Should the type for parameter `$stream` not be `resource\|null`? This check looks for `@param` annotations where the type inferred by our type inference engine differs from the declared type. It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. Loading history...
185		* @param integer $events Events
186		* @param mixed $arg Attached variable
187		* @return boolean Success.
188		*/
189		public function onReadUdp($stream = null, $events = 0, $arg = null)
		0 ignored issues – show Unused Code introduced 2018-01-16 22:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this The parameter `$stream` is not used and could be removed. This check looks from parameters that have been defined for a function or method, but which are not used in the method body. Loading history... Unused Code introduced 2018-01-16 22:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this The parameter `$events` is not used and could be removed. This check looks from parameters that have been defined for a function or method, but which are not used in the method body. Loading history... Unused Code introduced 2018-01-16 22:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this The parameter `$arg` is not used and could be removed. This check looks from parameters that have been defined for a function or method, but which are not used in the method body. Loading history...
190		{
191		if (Daemon::$process->reload) {
192		return false;
193		}
194
195		if ($this->pool->maxConcurrency) {
196		if ($this->pool->count() >= $this->pool->maxConcurrency) {
197		$this->overload = true;
		0 ignored issues – show Bug introduced 2015-12-06 14:42 UTC by Report Bug Copy Issue Report Show Similar Issues like this The property `overload` does not exist. Did you maybe forget to declare it? In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { } $x = new MyClass(); $x->foo = true; Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass { public $foo; } $x = new MyClass(); $x->foo = true; Loading history...
198		return false;
199		}
200		}
201
202		$host = null;
203		do {
204		$l = @socket_recvfrom($this->fd, $buf, 10240, MSG_DONTWAIT, $host, $port);
205		if (!$l) {
206		break;
207		}
208		$key = '[' . $host . ']:' . $port;
209		if (!isset($this->portsMap[$key])) {
210		if ($this->pool->allowedClients !== null) {
211		if (!self::netMatch($this->pool->allowedClients, $host)) {
		0 ignored issues – show Bug introduced 2016-05-13 22:23 UTC by Report Bug Copy Issue Report Show Similar Issues like this The property `allowedClients` does not seem to exist in `PHPDaemon\Network\Pool`. An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name. If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading. Loading history...
212		Daemon::log('Connection is not allowed (' . $host . ')');
213		}
214		continue;
215		}
216		$class = $this->pool->connectionClass;
217		$conn = new $class(null, $this->pool);
218		$conn->setDgram(true);
219		$conn->onWriteEv(null);
220		$conn->setPeername($host, $port);
221		$conn->setParentSocket($this);
222		$this->portsMap[$key] = $conn;
223		$conn->timeoutRef = setTimeout(function ($timer) use ($conn) {
224		$conn->finish();
225		$timer->finish();
226		}, $conn->timeout * 1e6);
227		$conn->onUdpPacket($buf);
228		} else {
229		$conn = $this->portsMap[$key];
230		$conn->onUdpPacket($buf);
231		Timer::setTimeout($conn->timeoutRef);
232		}
233		} while (true);
234		return $host !== null;
235		}
236		}
237

kakserpom / phpdaemon

Issues (1507)

Security Analysis not enabled

PHPDaemon/BoundSocket/UDP.php (16 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like