This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Part of CodeIgniter Simple and Secure Twig |
||
4 | * |
||
5 | * @author Kenji Suzuki <https://github.com/kenjis> |
||
6 | * @license MIT License |
||
7 | * @copyright 2015 Kenji Suzuki |
||
8 | * @link https://github.com/kenjis/codeigniter-ss-twig |
||
9 | */ |
||
10 | defined('BASEPATH') OR exit('No direct script access allowed'); |
||
11 | |||
12 | // If you don't use Composer, uncomment below |
||
13 | /* |
||
14 | require_once APPPATH . 'third_party/Twig-1.xx.x/lib/Twig/Autoloader.php'; |
||
15 | Twig_Autoloader::register(); |
||
16 | */ |
||
17 | |||
18 | class Twig |
||
19 | { |
||
20 | /** |
||
21 | * @var array Paths to Twig templates |
||
22 | */ |
||
23 | private $paths = []; |
||
24 | |||
25 | /** |
||
26 | * @var array Twig Environment Options |
||
27 | * @see http://twig.sensiolabs.org/doc/api.html#environment-options |
||
28 | */ |
||
29 | private $config = []; |
||
30 | |||
31 | /** |
||
32 | * @var array Functions to add to Twig |
||
33 | */ |
||
34 | private $functions_asis = [ |
||
35 | 'base_url', 'site_url', |
||
36 | ]; |
||
37 | |||
38 | /** |
||
39 | * @var array Functions with `is_safe` option |
||
40 | * @see http://twig.sensiolabs.org/doc/advanced.html#automatic-escaping |
||
41 | */ |
||
42 | private $functions_safe = [ |
||
43 | 'form_open', 'form_close', 'form_error', 'form_hidden', 'set_value', |
||
44 | // 'form_open_multipart', 'form_upload', 'form_submit', 'form_dropdown', |
||
45 | // 'set_radio', 'set_select', 'set_checkbox', |
||
46 | ]; |
||
47 | |||
48 | /** |
||
49 | * @var bool Whether functions are added or not |
||
50 | */ |
||
51 | private $functions_added = FALSE; |
||
52 | |||
53 | /** |
||
54 | * @var Twig_Environment |
||
55 | */ |
||
56 | private $twig; |
||
57 | |||
58 | /** |
||
59 | * @var Twig_Loader_Filesystem |
||
60 | */ |
||
61 | private $loader; |
||
62 | |||
63 | public function __construct($params = []) |
||
64 | { |
||
65 | View Code Duplication | if (isset($params['functions'])) |
|
0 ignored issues
–
show
|
|||
66 | { |
||
67 | $this->functions_asis = |
||
68 | array_unique( |
||
69 | array_merge($this->functions_asis, $params['functions']) |
||
70 | ); |
||
71 | unset($params['functions']); |
||
72 | } |
||
73 | View Code Duplication | if (isset($params['functions_safe'])) |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
74 | { |
||
75 | $this->functions_safe = |
||
76 | array_unique( |
||
77 | array_merge($this->functions_safe, $params['functions_safe']) |
||
78 | ); |
||
79 | unset($params['functions_safe']); |
||
80 | } |
||
81 | |||
82 | if (isset($params['paths'])) |
||
83 | { |
||
84 | $this->paths = $params['paths']; |
||
85 | unset($params['paths']); |
||
86 | } |
||
87 | else |
||
88 | { |
||
89 | $this->paths = [VIEWPATH]; |
||
90 | } |
||
91 | |||
92 | // default Twig config |
||
93 | $this->config = [ |
||
94 | 'cache' => APPPATH . 'cache/twig', |
||
95 | 'debug' => ENVIRONMENT !== 'production', |
||
96 | 'autoescape' => 'html', |
||
97 | ]; |
||
98 | |||
99 | $this->config = array_merge($this->config, $params); |
||
100 | } |
||
101 | |||
102 | protected function resetTwig() |
||
103 | { |
||
104 | $this->twig = null; |
||
105 | $this->createTwig(); |
||
106 | } |
||
107 | |||
108 | protected function createTwig() |
||
109 | { |
||
110 | // $this->twig is singleton |
||
111 | if ($this->twig !== null) |
||
112 | { |
||
113 | return; |
||
114 | } |
||
115 | |||
116 | if ($this->loader === null) |
||
117 | { |
||
118 | $this->loader = new \Twig_Loader_Filesystem($this->paths); |
||
119 | } |
||
120 | |||
121 | $twig = new \Twig_Environment($this->loader, $this->config); |
||
122 | |||
123 | if ($this->config['debug']) |
||
124 | { |
||
125 | $twig->addExtension(new \Twig_Extension_Debug()); |
||
126 | } |
||
127 | |||
128 | $this->twig = $twig; |
||
129 | } |
||
130 | |||
131 | protected function setLoader($loader) |
||
132 | { |
||
133 | $this->loader = $loader; |
||
134 | } |
||
135 | |||
136 | /** |
||
137 | * Registers a Global |
||
138 | * |
||
139 | * @param string $name The global name |
||
140 | * @param mixed $value The global value |
||
141 | */ |
||
142 | public function addGlobal($name, $value) |
||
143 | { |
||
144 | $this->createTwig(); |
||
145 | $this->twig->addGlobal($name, $value); |
||
146 | } |
||
147 | |||
148 | /** |
||
149 | * Renders Twig Template and Set Output |
||
150 | * |
||
151 | * @param string $view Template filename without `.twig` |
||
152 | * @param array $params Array of parameters to pass to the template |
||
153 | */ |
||
154 | public function display($view, $params = []) |
||
155 | { |
||
156 | $CI =& get_instance(); |
||
157 | $CI->output->set_output($this->render($view, $params)); |
||
0 ignored issues
–
show
The property
output does not seem to exist in CI_Controller .
An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name. If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading. ![]() |
|||
158 | } |
||
159 | |||
160 | /** |
||
161 | * Renders Twig Template and Returns as String |
||
162 | * |
||
163 | * @param string $view Template filename without `.twig` |
||
164 | * @param array $params Array of parameters to pass to the template |
||
165 | * @return string |
||
166 | */ |
||
167 | public function render($view, $params = []) |
||
168 | { |
||
169 | $this->createTwig(); |
||
170 | // We call addFunctions() here, because we must call addFunctions() |
||
171 | // after loading CodeIgniter functions in a controller. |
||
172 | $this->addFunctions(); |
||
173 | |||
174 | $view = $view . '.twig'; |
||
175 | return $this->twig->render($view, $params); |
||
176 | } |
||
177 | |||
178 | protected function addFunctions() |
||
179 | { |
||
180 | // Runs only once |
||
181 | if ($this->functions_added) |
||
182 | { |
||
183 | return; |
||
184 | } |
||
185 | |||
186 | // as is functions |
||
187 | foreach ($this->functions_asis as $function) |
||
188 | { |
||
189 | if (function_exists($function)) |
||
190 | { |
||
191 | $this->twig->addFunction( |
||
192 | new \Twig_SimpleFunction( |
||
193 | $function, |
||
194 | $function |
||
195 | ) |
||
196 | ); |
||
197 | } |
||
198 | } |
||
199 | |||
200 | // safe functions |
||
201 | foreach ($this->functions_safe as $function) |
||
202 | { |
||
203 | if (function_exists($function)) |
||
204 | { |
||
205 | $this->twig->addFunction( |
||
206 | new \Twig_SimpleFunction( |
||
207 | $function, |
||
208 | $function, |
||
209 | ['is_safe' => ['html']] |
||
210 | ) |
||
211 | ); |
||
212 | } |
||
213 | } |
||
214 | |||
215 | // customized functions |
||
216 | if (function_exists('anchor')) |
||
217 | { |
||
218 | $this->twig->addFunction( |
||
219 | new \Twig_SimpleFunction( |
||
220 | 'anchor', |
||
221 | [$this, 'safe_anchor'], |
||
222 | ['is_safe' => ['html']] |
||
223 | ) |
||
224 | ); |
||
225 | } |
||
226 | |||
227 | $this->functions_added = TRUE; |
||
228 | } |
||
229 | |||
230 | /** |
||
231 | * @param string $uri |
||
232 | * @param string $title |
||
233 | * @param array $attributes [changed] only array is acceptable |
||
234 | * @return string |
||
235 | */ |
||
236 | public function safe_anchor($uri = '', $title = '', $attributes = []) |
||
237 | { |
||
238 | $uri = html_escape($uri); |
||
239 | $title = html_escape($title); |
||
240 | |||
241 | $new_attr = []; |
||
242 | foreach ($attributes as $key => $val) |
||
243 | { |
||
244 | $new_attr[html_escape($key)] = html_escape($val); |
||
245 | } |
||
246 | |||
247 | return anchor($uri, $title, $new_attr); |
||
0 ignored issues
–
show
$new_attr is of type array , but the function expects a string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
248 | } |
||
249 | |||
250 | /** |
||
251 | * @return \Twig_Environment |
||
252 | */ |
||
253 | public function getTwig() |
||
254 | { |
||
255 | $this->createTwig(); |
||
256 | return $this->twig; |
||
257 | } |
||
258 | } |
||
259 |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.