This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * This file is part of the Drest package. |
||
4 | * |
||
5 | * For the full copyright and license information, please view the LICENSE |
||
6 | * file that was distributed with this source code. |
||
7 | * |
||
8 | * @author Lee Davis |
||
9 | * @copyright Copyright (c) Lee Davis <@leedavis81> |
||
10 | * @link https://github.com/leedavis81/drest/blob/master/LICENSE |
||
11 | * @license http://opensource.org/licenses/MIT The MIT X License (MIT) |
||
12 | */ |
||
13 | namespace Drest\Route; |
||
14 | |||
15 | use Drest\Mapping\RouteMetaData; |
||
16 | use DrestCommon\Request\Request; |
||
17 | |||
18 | |||
19 | /** |
||
20 | * Class Matcher takes a request object and finds matching routes |
||
21 | * @package Drest\Route |
||
22 | */ |
||
23 | class Matcher |
||
24 | { |
||
25 | |||
26 | /** |
||
27 | * The route meta data this matcher should operate on |
||
28 | * @var RouteMetaData $routeMetaData |
||
29 | */ |
||
30 | protected $routeMetaData; |
||
31 | |||
32 | /** |
||
33 | * Key-value array of URL parameter names |
||
34 | * @var array $param_names |
||
35 | */ |
||
36 | protected $param_names = []; |
||
37 | |||
38 | /** |
||
39 | * Key-value array of URL parameters with + at the end |
||
40 | * @var array $param_names_path |
||
41 | */ |
||
42 | protected $param_names_path = []; |
||
43 | |||
44 | /** |
||
45 | * Key-value array of URL parameters populated after a match has been successful |
||
46 | * - or directly by using available setter |
||
47 | * @var array $route_params |
||
48 | */ |
||
49 | protected $route_params; |
||
50 | |||
51 | /** |
||
52 | * An index array of URL parameters that exist but didn't match a route pattern parameter |
||
53 | * Eg: pattern: /user/:id+ with url: /user/1/some/additional/params. |
||
54 | * The value id => 1 will go into $route_params |
||
55 | * All the rest will go in here. |
||
56 | * @var array $unmapped_route_params |
||
57 | */ |
||
58 | protected $unmapped_route_params; |
||
59 | |||
60 | /** |
||
61 | * Route meta data to test a match on |
||
62 | * @param RouteMetaData|null $routeMetaData |
||
63 | */ |
||
64 | 30 | public function __construct(RouteMetaData $routeMetaData = null) |
|
65 | { |
||
66 | 30 | if (!is_null($routeMetaData)) |
|
67 | 30 | { |
|
68 | 30 | $this->setRouteMetaData($routeMetaData); |
|
69 | 30 | } |
|
70 | 30 | } |
|
71 | |||
72 | /** |
||
73 | * Set the route meta data |
||
74 | * @param RouteMetaData $routeMetaData |
||
75 | */ |
||
76 | 30 | public function setRouteMetaData(RouteMetaData $routeMetaData) |
|
77 | { |
||
78 | 30 | $this->routeMetaData = $routeMetaData; |
|
79 | 30 | } |
|
80 | |||
81 | /** |
||
82 | * Does this request match the route pattern |
||
83 | * @param Request $request |
||
84 | * @param boolean $matchVerb - Whether you want to match the route using the request HTTP verb |
||
85 | * - useful for OPTIONS requests to provide route info |
||
86 | * @param string $basePath - add a base path to the route pattern |
||
87 | * @return boolean $result |
||
88 | */ |
||
89 | 30 | public function matches(Request $request, $matchVerb = true, $basePath = null) |
|
90 | { |
||
91 | // If we're matching the verb and we've defined them, ensure the method used is in our list of registered verbs |
||
92 | 30 | if ($matchVerb && |
|
93 | 30 | $this->routeMetaData->usesHttpVerbs() && |
|
94 | 30 | !$this->methodIsInOurListOfAllowedVerbs($request->getHttpMethod())) { |
|
95 | 28 | return false; |
|
96 | } |
||
97 | |||
98 | 29 | $patternAsRegex = $this->getMatchRegexPattern($basePath); |
|
99 | |||
100 | //Cache URL params' names and values if this route matches the current HTTP request |
||
101 | 29 | if (!preg_match('#^' . $patternAsRegex . '$#', $request->getPath(), $paramValues)) { |
|
102 | 26 | return false; |
|
103 | } |
||
104 | |||
105 | // Process the param names and save them on the route params |
||
106 | 27 | $this->processRouteParams($paramValues); |
|
107 | |||
108 | // Check the route conditions |
||
109 | 27 | if (!$this->routeConditionsAreValid()) |
|
110 | 27 | { |
|
111 | return false; |
||
112 | } |
||
113 | |||
114 | 27 | return true; |
|
115 | } |
||
116 | |||
117 | /** |
||
118 | * Get the determined route parameters |
||
119 | * @return array |
||
120 | */ |
||
121 | 27 | public function getRouteParams() |
|
122 | { |
||
123 | 27 | return $this->route_params; |
|
124 | } |
||
125 | |||
126 | |||
127 | /** |
||
128 | * Get the param names |
||
129 | * @return array |
||
130 | */ |
||
131 | 27 | public function getParamNames() |
|
132 | { |
||
133 | 27 | return $this->param_names; |
|
134 | } |
||
135 | |||
136 | /** |
||
137 | * Get the params names path |
||
138 | * @return array |
||
139 | */ |
||
140 | 27 | public function getParamNamesPath() |
|
141 | { |
||
142 | 27 | return $this->param_names_path; |
|
143 | } |
||
144 | |||
145 | /** |
||
146 | * Get any unmapped route parameters |
||
147 | * @return array $params |
||
148 | */ |
||
149 | 27 | public function getUnmappedRouteParams() |
|
150 | { |
||
151 | 27 | return $this->unmapped_route_params; |
|
152 | } |
||
153 | |||
154 | /** |
||
155 | * Get the regex pattern to match the request path |
||
156 | * @param $basePath |
||
157 | * @return string |
||
158 | */ |
||
159 | 29 | protected function getMatchRegexPattern($basePath) |
|
160 | { |
||
161 | // Convert URL params into regex patterns, construct a regex for this route, init params |
||
162 | 29 | $routePattern = (is_null($basePath)) |
|
163 | 29 | ? (string) $this->routeMetaData->getRoutePattern() |
|
164 | 29 | : '/' . $basePath . '/' . ltrim((string) $this->routeMetaData->getRoutePattern(), '/'); |
|
165 | 29 | $patternAsRegex = preg_replace_callback( |
|
166 | 29 | '#:([\w]+)\+?#', |
|
167 | 29 | [$this, 'matchesCallback'], |
|
168 | 29 | str_replace(')', ')?', $routePattern) |
|
169 | 29 | ); |
|
170 | 29 | if (substr($this->routeMetaData->getRoutePattern(), -1) === '/') { |
|
171 | $patternAsRegex .= '?'; |
||
172 | } |
||
173 | 29 | return $patternAsRegex; |
|
174 | } |
||
175 | |||
176 | |||
177 | /** |
||
178 | * Convert a URL parameter (e.g. ":id", ":id+") into a regular expression |
||
179 | * @param array - url parameters |
||
180 | * @return string - Regular expression for URL parameter |
||
181 | */ |
||
182 | 28 | protected function matchesCallback($m) |
|
183 | { |
||
184 | 28 | $this->param_names[] = $m[1]; |
|
185 | |||
186 | 28 | if (substr($m[0], -1) === '+') { |
|
187 | $this->param_names_path[$m[1]] = 1; |
||
188 | |||
189 | return '(?P<' . $m[1] . '>.+)'; |
||
190 | } |
||
191 | |||
192 | 28 | return '(?P<' . $m[1] . '>[^/]+)'; |
|
193 | } |
||
194 | |||
195 | /** |
||
196 | * Process the route names and add them as parameters |
||
197 | * @param array $paramValues |
||
198 | */ |
||
199 | 27 | protected function processRouteParams(array $paramValues) |
|
200 | { |
||
201 | 27 | foreach ($this->param_names as $name) { |
|
202 | 11 | if (isset($paramValues[$name])) { |
|
203 | 11 | if (isset($this->param_names_path[$name])) { |
|
204 | $parts = explode('/', urldecode($paramValues[$name])); |
||
205 | $this->route_params[$name] = array_shift($parts); |
||
206 | $this->unmapped_route_params = $parts; |
||
207 | } else { |
||
208 | 11 | $this->route_params[$name] = urldecode($paramValues[$name]); |
|
209 | } |
||
210 | 11 | } |
|
211 | 27 | } |
|
212 | 27 | } |
|
213 | |||
214 | /** |
||
215 | * Are the given route conditions matching |
||
216 | * @return bool |
||
217 | */ |
||
218 | 27 | protected function routeConditionsAreValid() |
|
219 | { |
||
220 | 27 | foreach ($this->routeMetaData->getRouteConditions() as $key => $condition) { |
|
0 ignored issues
–
show
|
|||
221 | 3 | if (!preg_match('/^' . $condition . '$/', $this->route_params[$key])) { |
|
222 | $this->param_names_path = $this->route_params = $this->unmapped_route_params = []; |
||
223 | return false; |
||
224 | } |
||
225 | 27 | } |
|
226 | 27 | return true; |
|
227 | } |
||
228 | |||
229 | /** |
||
230 | * Ensure our method is in out list of allowed verbs |
||
231 | * @param $httpMethod |
||
232 | * @return bool |
||
233 | */ |
||
234 | 28 | protected function methodIsInOurListOfAllowedVerbs($httpMethod) |
|
235 | { |
||
236 | 28 | if (!in_array($httpMethod, $this->routeMetaData->getVerbs())) { |
|
237 | 28 | return false; |
|
238 | } |
||
239 | 25 | return true; |
|
240 | } |
||
241 | } |
There are different options of fixing this problem.
If you want to be on the safe side, you can add an additional type-check:
If you are sure that the expression is traversable, you might want to add a doc comment cast to improve IDE auto-completion and static analysis:
Mark the issue as a false-positive: Just hover the remove button, in the top-right corner of this issue for more options.