This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | class Kint_SourceParserTest extends PHPUnit_Framework_TestCase |
||
0 ignored issues
–
show
|
|||
4 | { |
||
5 | public function sourceProvider() |
||
6 | { |
||
7 | $data = array(); |
||
8 | |||
9 | $data['function'] = array( |
||
10 | '<?php |
||
11 | |||
12 | !@+-~test($wat, $woot[$wat] + 4); |
||
13 | ', |
||
14 | 'line' => 3, |
||
15 | 'function' => 'Test', |
||
16 | 'result' => array( |
||
17 | array( |
||
18 | 'modifiers' => array('~', '-', '+', '@', '!'), |
||
19 | 'parameters' => array( |
||
20 | array( |
||
21 | 'path' => '$wat', |
||
22 | 'name' => '$wat', |
||
23 | 'expression' => false, |
||
24 | ), |
||
25 | array( |
||
26 | 'path' => '$woot[$wat] + 4', |
||
27 | 'name' => '$woot[...] + 4', |
||
28 | 'expression' => true, |
||
29 | ), |
||
30 | ), |
||
31 | ), |
||
32 | ), |
||
33 | ); |
||
34 | |||
35 | $data['static method'] = array( |
||
36 | '<?php |
||
37 | |||
38 | !subspace\\C :: Method([], [ ], [ 1 ]); |
||
39 | ', |
||
40 | 'line' => 3, |
||
41 | 'function' => array('namespace\\subspace\\c', 'method'), |
||
42 | 'result' => array( |
||
43 | array( |
||
44 | 'modifiers' => array('!'), |
||
45 | 'parameters' => array( |
||
46 | array( |
||
47 | 'path' => '[]', |
||
48 | 'name' => '[]', |
||
49 | 'expression' => false, |
||
50 | ), |
||
51 | array( |
||
52 | 'path' => '[ ]', |
||
53 | 'name' => '[]', |
||
54 | 'expression' => false, |
||
55 | ), |
||
56 | array( |
||
57 | 'path' => '[ 1 ]', |
||
58 | 'name' => '[...]', |
||
59 | 'expression' => false, |
||
60 | ), |
||
61 | ), |
||
62 | ), |
||
63 | ), |
||
64 | ); |
||
65 | |||
66 | $data['multiple on one line'] = array( |
||
67 | '<?php |
||
68 | |||
69 | !Test($val); @test([ ], $_SERVER["REMOTE_ADDR"]); |
||
70 | ', |
||
71 | 'line' => 3, |
||
72 | 'function' => 'test', |
||
73 | 'result' => array( |
||
74 | array( |
||
75 | 'modifiers' => array('!'), |
||
76 | 'parameters' => array( |
||
77 | array( |
||
78 | 'path' => '$val', |
||
79 | 'name' => '$val', |
||
80 | 'expression' => false, |
||
81 | ), |
||
82 | ), |
||
83 | ), |
||
84 | array( |
||
85 | 'modifiers' => array('@'), |
||
86 | 'parameters' => array( |
||
87 | array( |
||
88 | 'path' => '[ ]', |
||
89 | 'name' => '[]', |
||
90 | 'expression' => false, |
||
91 | ), |
||
92 | array( |
||
93 | 'path' => '$_SERVER["REMOTE_ADDR"]', |
||
94 | 'name' => '$_SERVER[...]', |
||
95 | 'expression' => false, |
||
96 | ), |
||
97 | ), |
||
98 | ), |
||
99 | ), |
||
100 | ); |
||
101 | |||
102 | $data['one on multiple lines start'] = array( |
||
103 | '<?php |
||
104 | |||
105 | !c::method( |
||
106 | // Wat, |
||
107 | $val, |
||
108 | $_SERVER[$val] |
||
109 | ); |
||
110 | ', |
||
111 | 'line' => 3, |
||
112 | 'function' => array('namespace\\subspace\\C', 'Method'), |
||
113 | 'result' => array( |
||
114 | array( |
||
115 | 'modifiers' => array('!'), |
||
116 | 'parameters' => array( |
||
117 | array( |
||
118 | 'path' => '$val', |
||
119 | 'name' => '$val', |
||
120 | 'expression' => false, |
||
121 | ), |
||
122 | array( |
||
123 | 'path' => '$_SERVER[$val]', |
||
124 | 'name' => '$_SERVER[...]', |
||
125 | 'expression' => false, |
||
126 | ), |
||
127 | ), |
||
128 | ), |
||
129 | ), |
||
130 | ); |
||
131 | |||
132 | $data['one on multiple lines end'] = $data['one on multiple lines start']; |
||
133 | $data['one on multiple lines end']['line'] = 7; |
||
134 | |||
135 | $data['one on multiple lines mid'] = $data['one on multiple lines start']; |
||
136 | $data['one on multiple lines mid']['line'] = 5; |
||
137 | |||
138 | $data['nested calls'] = array( |
||
139 | '<?php |
||
140 | |||
141 | !test( |
||
142 | @test($val), |
||
143 | $_SERVER[$val] |
||
144 | ); |
||
145 | ', |
||
146 | 'line' => 4, |
||
147 | 'function' => 'test', |
||
148 | 'result' => array( |
||
149 | array( |
||
150 | 'modifiers' => array('!'), |
||
151 | 'parameters' => array( |
||
152 | array( |
||
153 | 'path' => '@test($val)', |
||
154 | 'name' => '@test(...)', |
||
155 | 'expression' => false, |
||
156 | ), |
||
157 | array( |
||
158 | 'path' => '$_SERVER[$val]', |
||
159 | 'name' => '$_SERVER[...]', |
||
160 | 'expression' => false, |
||
161 | ), |
||
162 | ), |
||
163 | ), |
||
164 | array( |
||
165 | 'modifiers' => array('@'), |
||
166 | 'parameters' => array( |
||
167 | array( |
||
168 | 'path' => '$val', |
||
169 | 'name' => '$val', |
||
170 | 'expression' => false, |
||
171 | ), |
||
172 | ), |
||
173 | ), |
||
174 | ), |
||
175 | ); |
||
176 | |||
177 | $data['nested calls, single matching line'] = $data['nested calls']; |
||
178 | $data['nested calls, single matching line']['line'] = 5; |
||
179 | unset($data['nested calls, single matching line']['result'][1]); |
||
180 | |||
181 | $data['multiple line params'] = array( |
||
182 | '<?php |
||
183 | |||
184 | test( |
||
185 | $a /* mixed */ + /** in */ $b ?>comments<?php + // test |
||
186 | $c |
||
187 | ); |
||
188 | ', |
||
189 | 'line' => 4, |
||
190 | 'function' => 'test', |
||
191 | 'result' => array( |
||
192 | array( |
||
193 | 'modifiers' => array(), |
||
194 | 'parameters' => array( |
||
195 | array( |
||
196 | 'path' => '$a /* mixed */ + /** in */ $b ?>comments<?php + // test |
||
197 | $c', |
||
198 | 'name' => '$a + $b + $c', |
||
199 | 'expression' => true, |
||
200 | ), |
||
201 | ), |
||
202 | ), |
||
203 | ), |
||
204 | ); |
||
205 | |||
206 | $data['space stripping'] = array( |
||
207 | '<?php |
||
208 | |||
209 | test( $var [ "key" ] + /* test */ $var2 +$var3);', |
||
210 | 'line' => 3, |
||
211 | 'function' => 'test', |
||
212 | 'result' => array( |
||
213 | array( |
||
214 | 'modifiers' => array(), |
||
215 | 'parameters' => array( |
||
216 | array( |
||
217 | 'path' => '$var [ "key" ] + /* test */ $var2 +$var3', |
||
218 | 'name' => '$var[...] + $var2 +$var3', |
||
219 | 'expression' => true, |
||
220 | ), |
||
221 | ), |
||
222 | ), |
||
223 | ), |
||
224 | ); |
||
225 | |||
226 | $data['expressions'] = array( |
||
227 | '<?php |
||
228 | |||
229 | d( |
||
230 | true?$_SERVER:array(), |
||
231 | $x=1, |
||
232 | $x+1, |
||
233 | $x==1, |
||
234 | $x-1, |
||
235 | $x*1, |
||
236 | $x/1, |
||
237 | $x%1, |
||
238 | $x++, |
||
239 | $x--, |
||
240 | $x**4, |
||
241 | ~$x, |
||
242 | $x instanceof bltest, |
||
243 | !$x, |
||
244 | $x%1, |
||
245 | $_SERVER["HTTP_HOST"], |
||
246 | $_SERVER[ "HTTP_HOST" ], |
||
247 | $_SERVER [ "HTTP_HOST" ], |
||
248 | [] + [], |
||
249 | new DateTime(), |
||
250 | clone $db, |
||
251 | array(), |
||
252 | array( ), |
||
253 | [], |
||
254 | [ ], |
||
255 | ((((((("woot"))))))), |
||
256 | true, |
||
257 | TRUE, |
||
258 | test::TEST, |
||
259 | \test::TEST, |
||
260 | test :: TEST, |
||
261 | \test :: TEST |
||
262 | );', |
||
263 | 'line' => 10, |
||
264 | 'function' => 'd', |
||
265 | 'result' => array( |
||
266 | array( |
||
267 | 'modifiers' => array(), |
||
268 | 'parameters' => array( |
||
269 | array( |
||
270 | 'path' => 'true?$_SERVER:array()', |
||
271 | 'name' => 'true?$_SERVER:array()', |
||
272 | 'expression' => true, |
||
273 | ), |
||
274 | array( |
||
275 | 'path' => '$x=1', |
||
276 | 'name' => '$x=1', |
||
277 | 'expression' => true, |
||
278 | ), |
||
279 | array( |
||
280 | 'path' => '$x+1', |
||
281 | 'name' => '$x+1', |
||
282 | 'expression' => true, |
||
283 | ), |
||
284 | array( |
||
285 | 'path' => '$x==1', |
||
286 | 'name' => '$x==1', |
||
287 | 'expression' => true, |
||
288 | ), |
||
289 | array( |
||
290 | 'path' => '$x-1', |
||
291 | 'name' => '$x-1', |
||
292 | 'expression' => true, |
||
293 | ), |
||
294 | array( |
||
295 | 'path' => '$x*1', |
||
296 | 'name' => '$x*1', |
||
297 | 'expression' => true, |
||
298 | ), |
||
299 | array( |
||
300 | 'path' => '$x/1', |
||
301 | 'name' => '$x/1', |
||
302 | 'expression' => true, |
||
303 | ), |
||
304 | array( |
||
305 | 'path' => '$x%1', |
||
306 | 'name' => '$x%1', |
||
307 | 'expression' => true, |
||
308 | ), |
||
309 | array( |
||
310 | 'path' => '$x++', |
||
311 | 'name' => '$x++', |
||
312 | 'expression' => true, |
||
313 | ), |
||
314 | array( |
||
315 | 'path' => '$x--', |
||
316 | 'name' => '$x--', |
||
317 | 'expression' => true, |
||
318 | ), |
||
319 | array( |
||
320 | 'path' => '$x**4', |
||
321 | 'name' => '$x**4', |
||
322 | 'expression' => true, |
||
323 | ), |
||
324 | array( |
||
325 | 'path' => '~$x', |
||
326 | 'name' => '~$x', |
||
327 | 'expression' => true, |
||
328 | ), |
||
329 | array( |
||
330 | 'path' => '$x instanceof bltest', |
||
331 | 'name' => '$x instanceof bltest', |
||
332 | 'expression' => true, |
||
333 | ), |
||
334 | array( |
||
335 | 'path' => '!$x', |
||
336 | 'name' => '!$x', |
||
337 | 'expression' => true, |
||
338 | ), |
||
339 | array( |
||
340 | 'path' => '$x%1', |
||
341 | 'name' => '$x%1', |
||
342 | 'expression' => true, |
||
343 | ), |
||
344 | array( |
||
345 | 'path' => '$_SERVER["HTTP_HOST"]', |
||
346 | 'name' => '$_SERVER[...]', |
||
347 | 'expression' => false, |
||
348 | ), |
||
349 | array( |
||
350 | 'path' => '$_SERVER[ "HTTP_HOST" ]', |
||
351 | 'name' => '$_SERVER[...]', |
||
352 | 'expression' => false, |
||
353 | ), |
||
354 | array( |
||
355 | 'path' => '$_SERVER [ "HTTP_HOST" ]', |
||
356 | 'name' => '$_SERVER[...]', |
||
357 | 'expression' => false, |
||
358 | ), |
||
359 | array( |
||
360 | 'path' => '[] + []', |
||
361 | 'name' => '[] + []', |
||
362 | 'expression' => true, |
||
363 | ), |
||
364 | array( |
||
365 | 'path' => 'new DateTime()', |
||
366 | 'name' => 'new DateTime()', |
||
367 | 'expression' => true, |
||
368 | ), |
||
369 | array( |
||
370 | 'path' => 'clone $db', |
||
371 | 'name' => 'clone $db', |
||
372 | 'expression' => true, |
||
373 | ), |
||
374 | array( |
||
375 | 'path' => 'array()', |
||
376 | 'name' => 'array()', |
||
377 | 'expression' => false, |
||
378 | ), |
||
379 | array( |
||
380 | 'path' => 'array( )', |
||
381 | 'name' => 'array()', |
||
382 | 'expression' => false, |
||
383 | ), |
||
384 | array( |
||
385 | 'path' => '[]', |
||
386 | 'name' => '[]', |
||
387 | 'expression' => false, |
||
388 | ), |
||
389 | array( |
||
390 | 'path' => '[ ]', |
||
391 | 'name' => '[]', |
||
392 | 'expression' => false, |
||
393 | ), |
||
394 | array( |
||
395 | 'path' => '((((((("woot")))))))', |
||
396 | 'name' => '(...)', |
||
397 | 'expression' => false, |
||
398 | ), |
||
399 | array( |
||
400 | 'path' => 'true', |
||
401 | 'name' => 'true', |
||
402 | 'expression' => false, |
||
403 | ), |
||
404 | array( |
||
405 | 'path' => 'TRUE', |
||
406 | 'name' => 'TRUE', |
||
407 | 'expression' => false, |
||
408 | ), |
||
409 | array( |
||
410 | 'path' => 'test::TEST', |
||
411 | 'name' => 'test::TEST', |
||
412 | 'expression' => false, |
||
413 | ), |
||
414 | array( |
||
415 | 'path' => '\test::TEST', |
||
416 | 'name' => '\test::TEST', |
||
417 | 'expression' => false, |
||
418 | ), |
||
419 | array( |
||
420 | 'path' => 'test :: TEST', |
||
421 | 'name' => 'test::TEST', |
||
422 | 'expression' => false, |
||
423 | ), |
||
424 | array( |
||
425 | 'path' => '\test :: TEST', |
||
426 | 'name' => '\test::TEST', |
||
427 | 'expression' => false, |
||
428 | ), |
||
429 | ), |
||
430 | ), |
||
431 | ), |
||
432 | ); |
||
433 | |||
434 | $data['T_CURLY_OPEN in string'] = array( |
||
435 | '<?php |
||
436 | |||
437 | test("string {$var} string");', |
||
438 | 'line' => 3, |
||
439 | 'function' => 'test', |
||
440 | 'result' => array( |
||
441 | array( |
||
442 | 'modifiers' => array(), |
||
443 | 'parameters' => array( |
||
444 | array( |
||
445 | 'path' => '"string {$var} string"', |
||
446 | 'name' => '"..."', |
||
447 | 'expression' => false, |
||
448 | ), |
||
449 | ), |
||
450 | ), |
||
451 | ), |
||
452 | ); |
||
453 | |||
454 | $data['T_DOLLAR_OPEN_CURLY_BRACES, T_STRING_VARNAME in string'] = array( |
||
455 | '<?php |
||
456 | |||
457 | test("string ${var} string");', |
||
458 | 'line' => 3, |
||
459 | 'function' => 'test', |
||
460 | 'result' => array( |
||
461 | array( |
||
462 | 'modifiers' => array(), |
||
463 | 'parameters' => array( |
||
464 | array( |
||
465 | 'path' => '"string ${var} string"', |
||
466 | 'name' => '"..."', |
||
467 | 'expression' => false, |
||
468 | ), |
||
469 | ), |
||
470 | ), |
||
471 | ), |
||
472 | ); |
||
473 | |||
474 | $data['T_VARIABLE in string'] = array( |
||
475 | '<?php |
||
476 | |||
477 | test("string $var string");', |
||
478 | 'line' => 3, |
||
479 | 'function' => 'test', |
||
480 | 'result' => array( |
||
481 | array( |
||
482 | 'modifiers' => array(), |
||
483 | 'parameters' => array( |
||
484 | array( |
||
485 | 'path' => '"string $var string"', |
||
486 | 'name' => '"..."', |
||
487 | 'expression' => false, |
||
488 | ), |
||
489 | ), |
||
490 | ), |
||
491 | ), |
||
492 | ); |
||
493 | |||
494 | if (KINT_PHP56) { |
||
495 | $data['arg expansion'] = array( |
||
496 | '<?php |
||
497 | |||
498 | test($args, ...$args);', |
||
499 | 'line' => 3, |
||
500 | 'function' => 'test', |
||
501 | 'result' => array( |
||
502 | array( |
||
503 | 'modifiers' => array(), |
||
504 | 'parameters' => array( |
||
505 | array( |
||
506 | 'path' => '$args', |
||
507 | 'name' => '$args', |
||
508 | 'expression' => false, |
||
509 | ), |
||
510 | array( |
||
511 | 'path' => '...$args', |
||
512 | 'name' => '...$args', |
||
513 | 'expression' => false, |
||
514 | ), |
||
515 | ), |
||
516 | ), |
||
517 | ), |
||
518 | ); |
||
519 | } |
||
520 | |||
521 | return $data; |
||
522 | } |
||
523 | |||
524 | /** |
||
525 | * @dataProvider sourceProvider |
||
526 | */ |
||
527 | public function testGetFunctionCalls($source, $line, $function, $result) |
||
528 | { |
||
529 | $output = Kint_SourceParser::getFunctionCalls($source, $line, $function); |
||
530 | |||
531 | $this->assertCount(count($result), $output); |
||
532 | |||
533 | foreach ($result as $index => $function) { |
||
534 | $this->assertEquals($function, $output[$index]); |
||
535 | } |
||
536 | } |
||
537 | } |
||
538 |
This check examines a number of code elements and verifies that they conform to the given naming conventions.
You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods.