koinephp /
StrongParameters
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace Koine; |
||
| 4 | |||
| 5 | use Koine\Parameters\ParameterMissingException; |
||
| 6 | use Koine\Parameters\UnpermittedParameterException; |
||
| 7 | |||
| 8 | /** |
||
| 9 | * @author Marcelo Jacobus <[email protected]> |
||
| 10 | */ |
||
| 11 | class Parameters extends Hash |
||
| 12 | { |
||
| 13 | /** |
||
| 14 | * If new created params should throw exceptions or ignore unpermitted params |
||
| 15 | * @var boolean |
||
| 16 | */ |
||
| 17 | public static $throwExceptions = true; |
||
| 18 | |||
| 19 | /** |
||
| 20 | * If should throw exceptions or ignore unpermitted params |
||
| 21 | * @var boolean |
||
| 22 | */ |
||
| 23 | protected $throw = true; |
||
| 24 | |||
| 25 | /** |
||
| 26 | * Makes sure a parameter was passed |
||
| 27 | * |
||
| 28 | * @param string $key the parameter key |
||
| 29 | * @return Parameters |
||
| 30 | * @throws ParameterMissingException when parameter is missing |
||
| 31 | */ |
||
| 32 | public function requireParam($key) |
||
| 33 | { |
||
| 34 | $param = $this->fetch($key, function ($key) { |
||
| 35 | throw new ParameterMissingException("Missing param '$key'"); |
||
| 36 | }); |
||
| 37 | |||
| 38 | if ($this->valueIsEmpty($param)) { |
||
| 39 | throw new ParameterMissingException("Missing param '$key'"); |
||
| 40 | } |
||
| 41 | |||
| 42 | return $param; |
||
| 43 | } |
||
| 44 | |||
| 45 | /** |
||
| 46 | * Filters unwanted params |
||
| 47 | * @param array $permittedParams |
||
| 48 | * @return Parameters |
||
| 49 | * @throws UnpermittedParameterException when parameters are set to throw |
||
| 50 | * exception on unpermitted params |
||
| 51 | */ |
||
| 52 | public function permit(array $permittedParams) |
||
| 53 | { |
||
| 54 | $params = clone $this; |
||
| 55 | |||
| 56 | $this->filter($params, $permittedParams); |
||
| 57 | |||
| 58 | return $params; |
||
| 59 | } |
||
| 60 | |||
| 61 | /** |
||
| 62 | * Filter out or throws exception according to the permitted params |
||
| 63 | * @param Parameter $params |
||
| 64 | * @param array $permitted |
||
| 65 | * @throws UnpermittedParameterException when params not permitted are passed in |
||
| 66 | */ |
||
| 67 | public function filter(Parameters $params, array $permitted = array()) |
||
| 68 | { |
||
| 69 | $this->cleanUnwanted($params, $permitted); |
||
| 70 | $this->handleArrays($params, $permitted); |
||
| 71 | $this->handleCollections($params, $permitted); |
||
| 72 | } |
||
| 73 | |||
| 74 | /** |
||
| 75 | * Handle Parameters that have only integer indexes |
||
| 76 | * @param Parameter $params |
||
| 77 | * @param array $permitted |
||
| 78 | */ |
||
| 79 | private function handleCollections(Parameters $params, array $permitted = array()) |
||
| 80 | { |
||
| 81 | // if is empty, any value is allowed |
||
| 82 | if (empty($permitted)) { |
||
| 83 | return; |
||
| 84 | } |
||
| 85 | |||
| 86 | $keys = $params->keys(); |
||
| 87 | $intKeys = $keys->select(function ($value) { |
||
| 88 | return is_int($value); |
||
| 89 | }); |
||
| 90 | |||
| 91 | if ($keys->count() === $intKeys->count()) { |
||
| 92 | foreach ($keys as $key) { |
||
| 93 | $value = $params[$key]; |
||
| 94 | |||
| 95 | if ($value instanceof Parameters) { |
||
| 96 | $this->filter($value, $permitted); |
||
| 97 | } |
||
| 98 | } |
||
| 99 | } |
||
| 100 | } |
||
| 101 | |||
| 102 | /** |
||
| 103 | * Handle permissions that are given in the hash form |
||
| 104 | * @param Parameter $params |
||
| 105 | * @param array $permitted |
||
| 106 | */ |
||
| 107 | private function handleArrays(Parameters $params, array $permitted = array()) |
||
| 108 | { |
||
| 109 | foreach ($permitted as $key => $allowed) { |
||
| 110 | if (is_array($allowed) && $params->hasKey($key)) { |
||
| 111 | $value = $params[$key]; |
||
| 112 | |||
| 113 | if ($value instanceof Parameters) { |
||
| 114 | $this->filter($value, $allowed); |
||
| 115 | } else { |
||
| 116 | $this->handleUnpermittedParam($key, $params); |
||
| 117 | } |
||
| 118 | } |
||
| 119 | } |
||
| 120 | } |
||
| 121 | |||
| 122 | /** |
||
| 123 | * Filters out or throws exception when parameters are neigher keys nor values |
||
| 124 | * in the permitted array |
||
| 125 | * @param Parameter $params |
||
| 126 | * @param array $permitted |
||
| 127 | * @throws ParameterMissingException when parameter is missing |
||
| 128 | */ |
||
| 129 | private function cleanUnwanted(Parameters $params, $permitted) |
||
| 130 | { |
||
| 131 | foreach ($params->toArray() as $key => $value) { |
||
| 132 | if (is_array($value) && !is_int($key)) { |
||
| 133 | if (!array_key_exists($key, $permitted)) { |
||
| 134 | $this->handleUnpermittedParam($key, $params); |
||
| 135 | } |
||
| 136 | } elseif (!is_int($key) && !in_array($key, $permitted) && !array_key_exists($key, $permitted)) { |
||
| 137 | $this->handleUnpermittedParam($key, $params); |
||
| 138 | } |
||
| 139 | } |
||
| 140 | } |
||
| 141 | |||
| 142 | /** |
||
| 143 | * Get the flag throw |
||
| 144 | * |
||
| 145 | * @return boolean; |
||
|
0 ignored issues
–
show
|
|||
| 146 | */ |
||
| 147 | public function getThrowExceptions() |
||
| 148 | { |
||
| 149 | return static::$throwExceptions; |
||
| 150 | } |
||
| 151 | |||
| 152 | /** |
||
| 153 | * Empty Hash or empty array? |
||
| 154 | * @return boolean |
||
| 155 | */ |
||
| 156 | protected function valueIsEmpty($value) |
||
| 157 | { |
||
| 158 | return ( |
||
| 159 | is_object($value) && |
||
| 160 | $value instanceof Parameters && |
||
| 161 | $value->isEmpty() |
||
| 162 | ) || (is_array($value) && !count($value)); |
||
| 163 | } |
||
| 164 | |||
| 165 | /** |
||
| 166 | * Handle the unpermitted param either by removing it or throwing an exception |
||
| 167 | * @param string $key |
||
| 168 | * @param Parameters $params |
||
| 169 | * @throws ParameterMissingException when parameter is missing |
||
| 170 | */ |
||
| 171 | protected function handleUnpermittedParam($key, $params) |
||
| 172 | { |
||
| 173 | if ($this->getThrowExceptions()) { |
||
| 174 | $message = "Parameter '$key' is not allowed"; |
||
| 175 | throw new UnpermittedParameterException($message); |
||
| 176 | } |
||
| 177 | |||
| 178 | $params->delete($key); |
||
| 179 | } |
||
| 180 | } |
||
| 181 |
This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.