Issues (94)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/ExceptionHandlers/BaseThrowableHandler.php (4 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php declare(strict_types=1);
2
3
namespace Limoncello\Application\ExceptionHandlers;
4
5
/**
6
 * Copyright 2015-2020 [email protected]
7
 *
8
 * Licensed under the Apache License, Version 2.0 (the "License");
9
 * you may not use this file except in compliance with the License.
10
 * You may obtain a copy of the License at
11
 *
12
 * http://www.apache.org/licenses/LICENSE-2.0
13
 *
14
 * Unless required by applicable law or agreed to in writing, software
15
 * distributed under the License is distributed on an "AS IS" BASIS,
16
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17
 * See the License for the specific language governing permissions and
18
 * limitations under the License.
19
 */
20
21
use Exception;
22
use Limoncello\Contracts\Application\ApplicationConfigurationInterface as A;
23
use Limoncello\Contracts\Application\CacheSettingsProviderInterface;
24
use Limoncello\Contracts\Exceptions\ThrowableHandlerInterface;
25
use Limoncello\Contracts\Http\ThrowableResponseInterface;
26
use Limoncello\Core\Application\ThrowableResponseTrait;
27
use Psr\Container\ContainerExceptionInterface;
28
use Psr\Container\ContainerInterface;
29
use Psr\Container\NotFoundExceptionInterface;
30
use Psr\Log\LoggerInterface;
31
use Throwable;
32
use Zend\Diactoros\Response\HtmlResponse;
33
use Zend\Diactoros\Response\JsonResponse;
34
use Zend\Diactoros\Response\TextResponse;
35
36
/**
37
 * @package Limoncello\Application
38
 *
39
 * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
40
 */
41
abstract class BaseThrowableHandler implements ThrowableHandlerInterface
42
{
43
    /** Default HTTP code. */
44
    protected const DEFAULT_HTTP_ERROR_CODE = 500;
45
46
    /**
47
     * @param ContainerInterface $container
48
     *
49
     * @return array
50
     *
51
     * @throws ContainerExceptionInterface
52
     * @throws NotFoundExceptionInterface
53
     *
54
     * @SuppressWarnings(PHPMD.IfStatementAssignment)
55
     */
56
    protected function getSettings(ContainerInterface $container): array
57
    {
58
        $appConfig = null;
59
60
        /** @var CacheSettingsProviderInterface $settingsProvider */
61
        if ($container->has(CacheSettingsProviderInterface::class) === true &&
62
            ($settingsProvider = $container->get(CacheSettingsProviderInterface::class)) !== null
63
        ) {
64
            $appConfig = $settingsProvider->getApplicationConfiguration();
65
        }
66
67
        return [
68
            $appConfig[A::KEY_IS_DEBUG] ?? false,
69
            $appConfig[A::KEY_APP_NAME] ?? null,
70
            $appConfig[A::KEY_EXCEPTION_DUMPER] ?? null,
71
        ];
72
    }
73
74
    /**
75
     * @param Throwable          $exception
76
     * @param ContainerInterface $container
77
     * @param string             $message
78
     *
79
     * @return void
80
     *
81
     * @throws ContainerExceptionInterface
82
     * @throws NotFoundExceptionInterface
83
     *
84
     * @SuppressWarnings(PHPMD.EmptyCatchBlock)
85
     */
86
    protected function logException(Throwable $exception, ContainerInterface $container, string $message): void
87
    {
88
        if ($container->has(LoggerInterface::class) === true) {
89
            /** @var LoggerInterface $logger */
90
            $logger = $container->get(LoggerInterface::class);
91
92
            // The sad truth is that when you have a problem logging might not be available (e.g. no permissions
93
            // to write on a disk). We can't do much with it and can only hope that the error information will be
94
            // delivered to the user other way.
95
            try {
96
                $logger->critical($message, ['exception' => $exception]);
97
            } catch (Exception $secondException) {
0 ignored issues
show
Coding Style Comprehensibility introduced by
Consider adding a comment why this CATCH block is empty.
Loading history...
98
            }
99
        }
100
    }
101
102
    /**
103
     * @param Throwable $throwable
104
     * @param string    $text
105
     * @param int       $status
106
     *
107
     * @return ThrowableResponseInterface
108
     */
109
    protected function createThrowableTextResponse(
110
        Throwable $throwable,
111
        string $text,
112
        int $status
113
    ): ThrowableResponseInterface {
114
        return new class ($throwable, $text, $status) extends TextResponse implements ThrowableResponseInterface
0 ignored issues
show
There is at least one abstract method in this class. Maybe declare it as abstract, or implement the remaining methods: getBody, getHeader, getHeaderLine, getHeaders, getProtocolVersion, getReasonPhrase, getStatusCode, hasHeader, withAddedHeader, withBody, withHeader, withProtocolVersion, withStatus, withoutHeader
Loading history...
115
        {
116
            use ThrowableResponseTrait;
117
118
            /**
119
             * @param Throwable $throwable
120
             * @param string    $text
121
             * @param int       $status
122
             */
123
            public function __construct(Throwable $throwable, string $text, int $status)
124
            {
125
                parent::__construct($text, $status);
126
                $this->setThrowable($throwable);
127
            }
128
        };
129
    }
130
131
    /**
132
     * @param Throwable $throwable
133
     * @param string    $text
134
     * @param int       $status
135
     *
136
     * @return ThrowableResponseInterface
137
     */
138
    protected function createThrowableHtmlResponse(
139
        Throwable $throwable,
140
        string $text,
141
        int $status
142
    ): ThrowableResponseInterface {
143
        return new class ($throwable, $text, $status) extends HtmlResponse implements ThrowableResponseInterface
0 ignored issues
show
There is at least one abstract method in this class. Maybe declare it as abstract, or implement the remaining methods: getBody, getHeader, getHeaderLine, getHeaders, getProtocolVersion, getReasonPhrase, getStatusCode, hasHeader, withAddedHeader, withBody, withHeader, withProtocolVersion, withStatus, withoutHeader
Loading history...
144
        {
145
            use ThrowableResponseTrait;
146
147
            /**
148
             * @param Throwable $throwable
149
             * @param string    $text
150
             * @param int       $status
151
             */
152
            public function __construct(Throwable $throwable, string $text, int $status)
153
            {
154
                parent::__construct($text, $status);
155
                $this->setThrowable($throwable);
156
            }
157
        };
158
    }
159
160
    /**
161
     * @param Throwable $throwable
162
     * @param string    $json
163
     * @param int       $status
164
     *
165
     * @return ThrowableResponseInterface
166
     */
167
    protected function createThrowableJsonResponse(
168
        Throwable $throwable,
169
        string $json,
170
        int $status
171
    ): ThrowableResponseInterface {
172
        return new class ($throwable, $json, $status) extends JsonResponse implements ThrowableResponseInterface
0 ignored issues
show
There is at least one abstract method in this class. Maybe declare it as abstract, or implement the remaining methods: getBody, getHeader, getHeaderLine, getHeaders, getProtocolVersion, getReasonPhrase, getStatusCode, hasHeader, withAddedHeader, withBody, withHeader, withProtocolVersion, withStatus, withoutHeader
Loading history...
173
        {
174
            use ThrowableResponseTrait;
175
176
            /**
177
             * @param Throwable $throwable
178
             * @param string    $json
179
             * @param int       $status
180
             */
181
            public function __construct(Throwable $throwable, string $json, int $status)
182
            {
183
                parent::__construct($json, $status);
184
                $this->setThrowable($throwable);
185
            }
186
        };
187
    }
188
}
189