1 | <?php /** MicroConsole */ |
||
22 | class Console |
||
23 | { |
||
24 | /** @var string $command Parsed command */ |
||
25 | protected $command; |
||
26 | |||
27 | |||
28 | /** |
||
29 | * Constructor command |
||
30 | * |
||
31 | * @access public |
||
32 | * @result void |
||
33 | */ |
||
34 | public function __construct() |
||
37 | |||
38 | /** |
||
39 | * Run action of console command by name |
||
40 | * |
||
41 | * @access public |
||
42 | * |
||
43 | * @param string $name Command name |
||
44 | * |
||
45 | * @return ResponseInterface |
||
46 | * @throws \RuntimeException|\InvalidArgumentException|Exception |
||
47 | */ |
||
48 | public function action($name) |
||
69 | } |
||
70 |
$command
can contain request data and is used in code execution context(s) leading to a potential security vulnerability.1 path for user data to reach this point
$_GET,
and$query ?: $_GET
is passed to ServerRequest::__construct()in vendor/src/ServerRequestFactory.php on line 71
in vendor/src/ServerRequest.php on line 101
in vendor/src/ServerRequest.php on line 156
$rawQuery
is assignedin src/mvc/MvcResolver.php on line 53
$query
is assignedin src/mvc/MvcResolver.php on line 55
$query
is assignedin src/mvc/MvcResolver.php on line 56
in src/mvc/MvcResolver.php on line 58
$this->uri
is passed through substr(), andsubstr($this->uri, 0, $key ?: strlen($this->uri))
is passed through explode(), and$uriBlocks
is assignedin src/mvc/MvcResolver.php on line 84
$uriBlocks
is passed to MvcResolver::prepareAction()in src/mvc/MvcResolver.php on line 93
$uriBlocks
is passed through array_shift(), and MvcResolver::$action is assignedin src/mvc/MvcResolver.php on line 202
in src/mvc/MvcResolver.php on line 264
$action
is assignedin src/base/Application.php on line 88
(string) $action
is passed to Console::action()in src/base/Application.php on line 97
$name
is passed through ucfirst(), and$command
is assignedin src/cli/Console.php on line 51
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: