| 1 | <?php /** MicroConsole */ |
||
| 22 | class Console |
||
| 23 | { |
||
| 24 | /** @var string $command Parsed command */ |
||
| 25 | protected $command; |
||
| 26 | |||
| 27 | |||
| 28 | /** |
||
| 29 | * Constructor command |
||
| 30 | * |
||
| 31 | * @access public |
||
| 32 | * @result void |
||
| 33 | */ |
||
| 34 | public function __construct() |
||
| 37 | |||
| 38 | /** |
||
| 39 | * Run action of console command by name |
||
| 40 | * |
||
| 41 | * @access public |
||
| 42 | * |
||
| 43 | * @param string $name Command name |
||
| 44 | * |
||
| 45 | * @return ResponseInterface |
||
| 46 | * @throws \RuntimeException|\InvalidArgumentException|Exception |
||
| 47 | */ |
||
| 48 | public function action($name) |
||
| 69 | } |
||
| 70 |
$commandcan contain request data and is used in code execution context(s) leading to a potential security vulnerability.1 path for user data to reach this point
$_GET,and$query ?: $_GETis passed to ServerRequest::__construct()in vendor/src/ServerRequestFactory.php on line 71
in vendor/src/ServerRequest.php on line 101
in vendor/src/ServerRequest.php on line 156
$rawQueryis assignedin src/mvc/MvcResolver.php on line 53
$queryis assignedin src/mvc/MvcResolver.php on line 55
$queryis assignedin src/mvc/MvcResolver.php on line 56
in src/mvc/MvcResolver.php on line 58
$this->uriis passed through substr(), andsubstr($this->uri, 0, $key ?: strlen($this->uri))is passed through explode(), and$uriBlocksis assignedin src/mvc/MvcResolver.php on line 84
$uriBlocksis passed to MvcResolver::prepareAction()in src/mvc/MvcResolver.php on line 93
$uriBlocksis passed through array_shift(), and MvcResolver::$action is assignedin src/mvc/MvcResolver.php on line 202
in src/mvc/MvcResolver.php on line 264
$actionis assignedin src/base/Application.php on line 88
(string) $actionis passed to Console::action()in src/base/Application.php on line 97
$nameis passed through ucfirst(), and$commandis assignedin src/cli/Console.php on line 51
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }For numeric data, we recommend to explicitly cast the data: