Issues in ApnMessage.php (master) - Issues in master - laravel-notification-channels/apn - Measure and Improve Code Quality continuously with Scrutinizer

Issues (7)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/ApnMessage.php (2 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

namespace NotificationChannels\Apn;

use DateTime;
use Pushok\Client;

class ApnMessage
{
    /**
     * The title of the notification.
     *
     * @var string
     */
    public $title;

    /**
     * The body of the notification.
     *
     * @var string
     */
    public $body;

    /**
     * The badge of the notification.
     *
     * @var int
     */
    public $badge;

    /**
     * The sound for the notification.
     *
     * @var string|null
     */
    public $sound;

    /**
     * The category for action button.
     *
     * @var string|null
     * */
    public $category;

    /**
     * Value indicating incoming resource in the notification.
     *
     * @var int|null
     */
    public $contentAvailable = null;

    /**
     * The key to a title string in the Localizable.strings file for the current localization.
     *
     * @var string|null
     */
    public $titleLocKey;

    /**
     * Variable string values to appear in place of the format specifiers in title-loc-key.
     *
     * @var string|null
     */
    public $titleLocArgs;

    /**
     * If a string is specified, the iOS system displays an alert that includes the Close and View buttons.
     *
     * @var string|null
     */
    public $actionLocKey;

    /**
     * A key to an alert-message string in a Localizable.strings file for the current localization.
     *
     * @var string|null
     */
    public $locKey;

    /**
     * Variable string values to appear in place of the format specifiers in loc-key.
     *
     * @var array|null
     */
    public $locArgs;

    /**
     * Additional data of the notification.
     *
     * @var array
     */
    public $custom = [];

    /**
     * Value indicating when the message will expire.
     *
     * @var \string
     */
    public $pushType = null;

    /**
     * The expiration time of the notification.
     *
     * @var \DateTime|null
     */
    public $expiresAt = null;

    /**
     * Message specific client.
     *
     * @var \Pushok\Client|null
     */
    public $client = null;

    /**
     * The notification service app extension flag.
     *
     * @var int|null
     */
    public $mutableContent = null;

    /**
     * @param string|null $title
     * @param string|null $body
     * @param array $custom
     * @param null|int $badge
     *
     * @return static
     */
    public static function create($title = null, $body = null, $custom = [], $badge = null)
    {
        return new static($title, $body, $custom, $badge);
    }

    /**
     * @param string|null $title
     * @param string|null $body
     * @param array $custom
     * @param null|int $badge
     */
    public function __construct($title = null, $body = null, $custom = [], $badge = null)
    {
        $this->title = $title;
        $this->body = $body;
        $this->custom = $custom;
        $this->badge = $badge;
    }

    /**
     * Set the alert title of the notification.
     *
     * @param string $title
     *
     * @return $this
     */
    public function title($title)
    {
        $this->title = $title;

        return $this;
    }

    /**
     * Set the alert message of the notification.
     *
     * @param string $body
     *
     * @return $this
     */
    public function body($body)
    {
        $this->body = $body;

        return $this;
    }

    /**
     * Set the badge of the notification.
     *
     * @param int $badge
     *
     * @return $this
     */
    public function badge($badge)
    {
        $this->badge = $badge;

        return $this;
    }

    /**
     * Set the sound for the notification.
     *
     * @param string|null $sound
     *
     * @return $this
     */
    public function sound($sound = 'default')
    {
        $this->sound = $sound;

        return $this;
    }

    /**
     * Set category for this notification.
     *
     * @param string|null $category
     *
     * @return $this
     * */
    public function category($category)
    {
        $this->category = $category;

        return $this;
    }

    /**
     * Set content available value for this notification.
     *
     * @param int $value
     *
     * @return $this
     */
    public function contentAvailable($value = 1)
    {
        $this->contentAvailable = $value;

        return $this;
    }

    /**
     * Set the push type for this notification.
     *
     * @param  string $pushType
     *
     * @return $this
     */
    public function pushType(string $pushType)
    {
        $this->pushType = $pushType;


        return $this;
    }

    /**
     * Set the expiration time for the message.
     *
     * @param  \DateTime $expiresAt
     *
     * @return $this
     */
    public function expiresAt(DateTime $expiresAt)
    {
        $this->expiresAt = $expiresAt;

        return $this;
    }

    /**
     * Set a title-loc-key.
     *
     * @param  string|null $titleLocKey
     * @return $this
     */
    public function titleLocKey($titleLocKey = null)
    {
        $this->titleLocKey = $titleLocKey;

        return $this;
    }

    /**
     * Set the title-loc-args.
     *
     * @param  array|null $titleLocArgs
     * @return $this
     */
    public function titleLocArgs(array $titleLocArgs = null)
    {
        $this->titleLocArgs = $titleLocArgs;
class Id
{
    public $id;

    public function __construct($id)
    {
        $this->id = $id;
    }

}

class Account
{
    /** @var  Id $id */
    public $id;
}

$account_id = false;

if (starsAreRight()) {
    $account_id = new Id(42);
}

$account = new Account();
if ($account instanceof Id)
{
    $account->id = $account_id;
}

        return $this;
    }

    /**
     * Set an action-loc-key.
     *
     * @param  string|null $actionLocKey
     * @return $this
     */
    public function actionLocKey($actionLocKey = null)
    {
        $this->actionLocKey = $actionLocKey;

        return $this;
    }

    /**
     * Set a loc-key.
     *
     * @param  string $locKey
     * @return $this
     */
    public function setLocKey($locKey)
    {
        $this->locKey = $locKey;

        return $this;
    }

    /**
     * Set the loc-args.
     *
     * @param  array $locArgs
     * @return $this
     */
    public function setLocArgs($locArgs)
    {
        $this->locArgs = $locArgs;

        return $this;
    }

    /**
     * Add custom data to the notification.
     *
     * @param string $key
     * @param mixed $value
     *
     * @return $this
     */
    public function custom($key, $value)
    {
        $this->custom[$key] = $value;

        return $this;
    }

    /**
     * Override the data of the notification.
     *
     * @param array $custom
     *
     * @return $this
     */
    public function setCustom($custom)
    {
        $this->custom = $custom;

        return $this;
    }

    /**
     * Add an action to the notification.
     *
     * @param string $action
     * @param mixed $params
     *
     * @return $this
     */
    public function action($action, $params = null)
    {
        return $this->custom('action', [
            'action' => $action,
            'params' => $params,
        ]);
    }

    /**
     * Set message specific client.
     *
     * @param \Pushok\Client
     * @return $this
     */
    public function via(Client $client)
    {
        $this->client = $client;

        return $this;
    }

    /**
     * Set mutable content value for this notification.
     *
     * @param int $value
     *
     * @return $this
     */
    public function mutableContent($value = 1)
    {
        $this->mutableContent = $value;

        return $this;
    }
}


GitHub Access Token became invalid

Issues (7)

Security Analysis no request data

src/ApnMessage.php (2 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

1		<?php
2
3		namespace NotificationChannels\Apn;
4
5		use DateTime;
6		use Pushok\Client;
7
8		class ApnMessage
9		{
10		/**
11		* The title of the notification.
12		*
13		* @var string
14		*/
15		public $title;
16
17		/**
18		* The body of the notification.
19		*
20		* @var string
21		*/
22		public $body;
23
24		/**
25		* The badge of the notification.
26		*
27		* @var int
28		*/
29		public $badge;
30
31		/**
32		* The sound for the notification.
33		*
34		* @var string\|null
35		*/
36		public $sound;
37
38		/**
39		* The category for action button.
40		*
41		* @var string\|null
42		* */
43		public $category;
44
45		/**
46		* Value indicating incoming resource in the notification.
47		*
48		* @var int\|null
49		*/
50		public $contentAvailable = null;
51
52		/**
53		* The key to a title string in the Localizable.strings file for the current localization.
54		*
55		* @var string\|null
56		*/
57		public $titleLocKey;
58
59		/**
60		* Variable string values to appear in place of the format specifiers in title-loc-key.
61		*
62		* @var string\|null
63		*/
64		public $titleLocArgs;
65
66		/**
67		* If a string is specified, the iOS system displays an alert that includes the Close and View buttons.
68		*
69		* @var string\|null
70		*/
71		public $actionLocKey;
72
73		/**
74		* A key to an alert-message string in a Localizable.strings file for the current localization.
75		*
76		* @var string\|null
77		*/
78		public $locKey;
79
80		/**
81		* Variable string values to appear in place of the format specifiers in loc-key.
82		*
83		* @var array\|null
84		*/
85		public $locArgs;
86
87		/**
88		* Additional data of the notification.
89		*
90		* @var array
91		*/
92		public $custom = [];
93
94		/**
95		* Value indicating when the message will expire.
96		*
97		* @var \string
98		*/
99		public $pushType = null;
100
101		/**
102		* The expiration time of the notification.
103		*
104		* @var \DateTime\|null
105		*/
106		public $expiresAt = null;
107
108		/**
109		* Message specific client.
110		*
111		* @var \Pushok\Client\|null
112		*/
113		public $client = null;
114
115		/**
116		* The notification service app extension flag.
117		*
118		* @var int\|null
119		*/
120		public $mutableContent = null;
121
122		/**
123		* @param string\|null $title
124		* @param string\|null $body
125		* @param array $custom
126		* @param null\|int $badge
127		*
128		* @return static
129		*/
130	1	public static function create($title = null, $body = null, $custom = [], $badge = null)
131		{
132	1	return new static($title, $body, $custom, $badge);
133		}
134
135		/**
136		* @param string\|null $title
137		* @param string\|null $body
138		* @param array $custom
139		* @param null\|int $badge
140		*/
141	39	public function __construct($title = null, $body = null, $custom = [], $badge = null)
142		{
143	39	$this->title = $title;
144	39	$this->body = $body;
145	39	$this->custom = $custom;
146	39	$this->badge = $badge;
147	39	}
148
149		/**
150		* Set the alert title of the notification.
151		*
152		* @param string $title
153		*
154		* @return $this
155		*/
156	2	public function title($title)
157		{
158	2	$this->title = $title;
159
160	2	return $this;
161		}
162
163		/**
164		* Set the alert message of the notification.
165		*
166		* @param string $body
167		*
168		* @return $this
169		*/
170	2	public function body($body)
171		{
172	2	$this->body = $body;
173
174	2	return $this;
175		}
176
177		/**
178		* Set the badge of the notification.
179		*
180		* @param int $badge
181		*
182		* @return $this
183		*/
184	3	public function badge($badge)
185		{
186	3	$this->badge = $badge;
187
188	3	return $this;
189		}
190
191		/**
192		* Set the sound for the notification.
193		*
194		* @param string\|null $sound
195		*
196		* @return $this
197		*/
198	3	public function sound($sound = 'default')
199		{
200	3	$this->sound = $sound;
201
202	3	return $this;
203		}
204
205		/**
206		* Set category for this notification.
207		*
208		* @param string\|null $category
209		*
210		* @return $this
211		* */
212	2	public function category($category)
213		{
214	2	$this->category = $category;
215
216	2	return $this;
217		}
218
219		/**
220		* Set content available value for this notification.
221		*
222		* @param int $value
223		*
224		* @return $this
225		*/
226	2	public function contentAvailable($value = 1)
227		{
228	2	$this->contentAvailable = $value;
229
230	2	return $this;
231		}
232
233		/**
234		* Set the push type for this notification.
235		*
236		* @param string $pushType
237		*
238		* @return $this
239		*/
240	5	public function pushType(string $pushType)
241		{
242	5	$this->pushType = $pushType;
		0 ignored issues – show Documentation Bug introduced 2020-02-19 22:36 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `$pushType` of type `string` is incompatible with the declared type `object<string>` of property `$pushType`. Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property. Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property.. Loading history...
243
244	5	return $this;
245		}
246
247		/**
248		* Set the expiration time for the message.
249		*
250		* @param \DateTime $expiresAt
251		*
252		* @return $this
253		*/
254	2	public function expiresAt(DateTime $expiresAt)
255		{
256	2	$this->expiresAt = $expiresAt;
257
258	2	return $this;
259		}
260
261		/**
262		* Set a title-loc-key.
263		*
264		* @param string\|null $titleLocKey
265		* @return $this
266		*/
267	1	public function titleLocKey($titleLocKey = null)
268		{
269	1	$this->titleLocKey = $titleLocKey;
270
271	1	return $this;
272		}
273
274		/**
275		* Set the title-loc-args.
276		*
277		* @param array\|null $titleLocArgs
278		* @return $this
279		*/
280	1	public function titleLocArgs(array $titleLocArgs = null)
281		{
282	1	$this->titleLocArgs = $titleLocArgs;
		0 ignored issues – show Documentation Bug introduced 2020-06-02 00:55 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `$titleLocArgs` can also be of type `array`. However, the property `$titleLocArgs` is declared as type `string\|null`. Maybe add an additional type check? Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly. For example, imagine you have a variable `$accountId` that can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to the `id` property of an instance of the `Account` class. This class holds a proper account, so the id value must no longer be false. Either this assignment is in error or a type check should be added for that assignment. class Id { public $id; public function __construct($id) { $this->id = $id; } } class Account { /** @var Id $id */ public $id; } $account_id = false; if (starsAreRight()) { $account_id = new Id(42); } $account = new Account(); if ($account instanceof Id) { $account->id = $account_id; } Loading history...
283
284	1	return $this;
285		}
286
287		/**
288		* Set an action-loc-key.
289		*
290		* @param string\|null $actionLocKey
291		* @return $this
292		*/
293	1	public function actionLocKey($actionLocKey = null)
294		{
295	1	$this->actionLocKey = $actionLocKey;
296
297	1	return $this;
298		}
299
300		/**
301		* Set a loc-key.
302		*
303		* @param string $locKey
304		* @return $this
305		*/
306	1	public function setLocKey($locKey)
307		{
308	1	$this->locKey = $locKey;
309
310	1	return $this;
311		}
312
313		/**
314		* Set the loc-args.
315		*
316		* @param array $locArgs
317		* @return $this
318		*/
319	1	public function setLocArgs($locArgs)
320		{
321	1	$this->locArgs = $locArgs;
322
323	1	return $this;
324		}
325
326		/**
327		* Add custom data to the notification.
328		*
329		* @param string $key
330		* @param mixed $value
331		*
332		* @return $this
333		*/
334	3	public function custom($key, $value)
335		{
336	3	$this->custom[$key] = $value;
337
338	3	return $this;
339		}
340
341		/**
342		* Override the data of the notification.
343		*
344		* @param array $custom
345		*
346		* @return $this
347		*/
348	1	public function setCustom($custom)
349		{
350	1	$this->custom = $custom;
351
352	1	return $this;
353		}
354
355		/**
356		* Add an action to the notification.
357		*
358		* @param string $action
359		* @param mixed $params
360		*
361		* @return $this
362		*/
363	1	public function action($action, $params = null)
364		{
365	1	return $this->custom('action', [
366	1	'action' => $action,
367	1	'params' => $params,
368		]);
369		}
370
371		/**
372		* Set message specific client.
373		*
374		* @param \Pushok\Client
375		* @return $this
376		*/
377	3	public function via(Client $client)
378		{
379	3	$this->client = $client;
380
381	3	return $this;
382		}
383
384		/**
385		* Set mutable content value for this notification.
386		*
387		* @param int $value
388		*
389		* @return $this
390		*/
391	2	public function mutableContent($value = 1)
392		{
393	2	$this->mutableContent = $value;
394
395	2	return $this;
396		}
397		}
398

laravel-notification-channels / apn

GitHub Access Token became invalid

Issues (7)

Security Analysis no request data

src/ApnMessage.php (2 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like