maikgreubel /
caribu-mvc
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | namespace Nkey\Caribu\Mvc\Util; |
||
| 3 | |||
| 4 | use Nkey\Caribu\Mvc\Controller\Request; |
||
| 5 | |||
| 6 | /** |
||
| 7 | * Provides the request parsing functionality |
||
| 8 | * |
||
| 9 | * @author Maik Greubel <[email protected]> |
||
| 10 | * |
||
| 11 | * This file is part of Caribu MVC package |
||
| 12 | */ |
||
| 13 | trait RequestParser |
||
| 14 | { |
||
| 15 | |||
| 16 | /** |
||
| 17 | * Parse the context prefix variables to determine in which path |
||
| 18 | * context the request has been performed. |
||
| 19 | * |
||
| 20 | * @param Request $request |
||
| 21 | */ |
||
| 22 | 27 | private static function parseContextPrefix(Request &$request, $serverVars = array()) |
|
| 23 | { |
||
| 24 | // Since apache 2.3.13 we have now an additional index which provides the context |
||
| 25 | 27 | if (isset($serverVars['CONTEXT_PREFIX']) && $serverVars['CONTEXT_PREFIX'] != '') { |
|
| 26 | 1 | $request->setContextPrefix( $serverVars['CONTEXT_PREFIX'] . '/' ); |
|
| 27 | 26 | } elseif (isset($serverVars['REDIRECT_BASE'])) { |
|
| 28 | // Try to determine the context from redirect base |
||
| 29 | 4 | $request->setContextPrefix ( $serverVars['REDIRECT_BASE'] ); |
|
| 30 | 22 | } elseif (isset($serverVars['SCRIPT_FILENAME']) && isset($serverVars['SCRIPT_NAME'])) { |
|
| 31 | // Fallback - get context out of script path |
||
| 32 | 4 | if (isset($serverVars['HTTP_HOST'])) { |
|
| 33 | 4 | $scriptName = preg_replace('/^.+[\\\\\\/]/', '', $serverVars['SCRIPT_FILENAME']); |
|
| 34 | 4 | $request->contextPrefix = str_replace($scriptName, '', $serverVars['SCRIPT_NAME']); |
|
|
0 ignored issues
–
show
|
|||
| 35 | } |
||
| 36 | } |
||
| 37 | 27 | } |
|
| 38 | |||
| 39 | /** |
||
| 40 | * Parse the prepared uri into its parts |
||
| 41 | * |
||
| 42 | * @param Request $request |
||
| 43 | * The unprepared request object |
||
| 44 | * @param string $uri |
||
| 45 | * The prepared uri |
||
| 46 | * @param string $defaultController |
||
| 47 | * The name of default controller if nothing is requested |
||
| 48 | * @param string $defaultAction |
||
| 49 | * The name of default action if nothing is requested |
||
| 50 | * |
||
| 51 | * @return array Parsed parts for later usage |
||
| 52 | */ |
||
| 53 | 27 | private static function parseUri(Request &$request, |
|
| 54 | $uri, $defaultController, $defaultAction) |
||
| 55 | { |
||
| 56 | // All beyond the context prefix is our application request uri |
||
| 57 | 27 | $contextUri = $uri; |
|
| 58 | 27 | if (null != $request->getContextPrefix() && '/' != $request->getContextPrefix()) { |
|
| 59 | 9 | $contextUri = str_replace($request->getContextPrefix(), '', $uri); |
|
| 60 | } |
||
| 61 | |||
| 62 | // Split parts |
||
| 63 | 27 | $parts = array(); |
|
| 64 | 27 | if ($contextUri != '') { |
|
| 65 | 23 | while (isset($contextUri[0]) && $contextUri[0] == '/') { |
|
| 66 | 23 | $contextUri = substr($contextUri, 1); |
|
| 67 | } |
||
| 68 | 23 | $parts = explode('/', $contextUri); |
|
| 69 | } |
||
| 70 | |||
| 71 | // Check if there was a controller requested |
||
| 72 | 27 | if (count($parts) > 0) { |
|
| 73 | 23 | $request->setController( ucfirst(trim($parts[0])) ); |
|
| 74 | 23 | array_shift($parts); |
|
| 75 | 23 | if (! $request->getController()) { |
|
| 76 | 1 | $request->setController( $defaultController ); |
|
| 77 | } |
||
| 78 | } |
||
| 79 | |||
| 80 | // Check if there was an action requested |
||
| 81 | 27 | if (count($parts) > 0) { |
|
| 82 | 21 | $request->setAction( trim($parts[0]) ); |
|
| 83 | 21 | array_shift($parts); |
|
| 84 | 21 | if (! $request->getAction()) { |
|
| 85 | $request->setAction( $defaultAction ); |
||
| 86 | } |
||
| 87 | } |
||
| 88 | |||
| 89 | 27 | return $parts; |
|
| 90 | } |
||
| 91 | |||
| 92 | /** |
||
| 93 | * Parse a single http header element into parameter for the request object |
||
| 94 | * |
||
| 95 | * @param Request $req |
||
| 96 | * The destination request object |
||
| 97 | * @param array $serverVars |
||
| 98 | * The server variables provided by sapi |
||
| 99 | * @param string $elementName |
||
| 100 | * The element to parse |
||
| 101 | * @param string $paramName |
||
| 102 | * The destination parameter name |
||
| 103 | */ |
||
| 104 | 27 | private static function parseElement(Request &$req, |
|
| 105 | $serverVars, $elementName, $paramName) |
||
| 106 | { |
||
| 107 | 27 | if (isset($serverVars[$elementName])) { |
|
| 108 | 7 | $req->setParam( $paramName, $serverVars[$elementName] ); |
|
| 109 | } |
||
| 110 | 27 | } |
|
| 111 | |||
| 112 | /** |
||
| 113 | * Parse the server variables which represents HTTP headers into parameter values for the request object |
||
| 114 | * |
||
| 115 | * @param Request $req |
||
| 116 | * The request object |
||
| 117 | * @param array $serverVars |
||
| 118 | * The server variables provided by sapi |
||
| 119 | */ |
||
| 120 | 27 | private static function parseParameters(Request &$req, $serverVars) |
|
| 121 | { |
||
| 122 | 27 | self::parseElement($req, $serverVars, 'HTTP_ACCEPT', 'Accept'); |
|
| 123 | 27 | self::parseElement($req, $serverVars, 'HTTP_ACCEPT_LANGUAGE', 'Accept-Language'); |
|
| 124 | 27 | self::parseElement($req, $serverVars, 'HTTP_ACCEPT_ENCODING', 'Accept-Encoding'); |
|
| 125 | 27 | self::parseElement($req, $serverVars, 'HTTP_UA_CPU', 'User-Agent-CPU'); |
|
| 126 | 27 | self::parseElement($req, $serverVars, 'HTTP_USER_AGENT', 'User-Agent'); |
|
| 127 | 27 | self::parseElement($req, $serverVars, 'HTTP_HOST', 'Host'); |
|
| 128 | 27 | self::parseElement($req, $serverVars, 'HTTP_CACHE_COTROL', 'Cache-Control'); |
|
| 129 | 27 | self::parseElement($req, $serverVars, 'HTTP_CONNECTION', 'Connection'); |
|
| 130 | 27 | self::parseElement($req, $serverVars, 'HTTP_X_FORWARDED_FOR', 'X-Forwarded-For'); |
|
| 131 | |||
| 132 | 27 | if (isset($req->params['Accept-Language'])) { |
|
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request.
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. Loading history...
|
|||
| 133 | 1 | $accepted = explode(',', $req->params['Accept-Language']); |
|
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request.
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. Loading history...
|
|||
| 134 | 1 | $req->params['Accept-Language-Best'] = $accepted[0]; |
|
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request.
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. Loading history...
|
|||
| 135 | 1 | foreach ($accepted as $acceptedLang) { |
|
| 136 | 1 | $matches = array(); |
|
| 137 | // TODO: Respect the quality field from rfc2616 |
||
| 138 | 1 | if (preg_match("/^((?i)[a-z]{2}[-_](?:[a-z]{2}){1,2}(?:_[a-z]{2})?).*/", $acceptedLang, $matches)) { |
|
| 139 | 1 | $req->params['Accept-Language-Best'] = $matches[1]; |
|
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request.
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. Loading history...
|
|||
| 140 | 1 | break; |
|
| 141 | } |
||
| 142 | } |
||
| 143 | } |
||
| 144 | 27 | } |
|
| 145 | |||
| 146 | /** |
||
| 147 | * Parse the remote host variables to determine client address |
||
| 148 | * |
||
| 149 | * @param Request $request |
||
| 150 | */ |
||
| 151 | 27 | private static function parseRemoteHost(Request &$request, $serverVars = array()) |
|
| 152 | { |
||
| 153 | 27 | if (isset($serverVars['REMOTE_ADDR'])) { |
|
| 154 | 8 | $request->remoteHost = $serverVars['REMOTE_ADDR']; |
|
|
0 ignored issues
–
show
The property
remoteHost cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request.
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. Loading history...
|
|||
| 155 | } |
||
| 156 | 27 | if (isset($serverVars['HTTP_X_FORWARDED_FOR'])) { |
|
| 157 | 1 | $request->remoteHost = $serverVars['HTTP_X_FORWARDED_FOR']; |
|
|
0 ignored issues
–
show
The property
remoteHost cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request.
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. Loading history...
|
|||
| 158 | } |
||
| 159 | 27 | } |
|
| 160 | |||
| 161 | /** |
||
| 162 | * Parse the super globals for request parameters |
||
| 163 | * |
||
| 164 | * @param Request $request |
||
| 165 | * Request object to put the parameters in |
||
| 166 | */ |
||
| 167 | 27 | private static function parseGetPostSessionCookie(Request &$request) |
|
|
0 ignored issues
–
show
parseGetPostSessionCookie uses the super-global variable $_GET which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
Loading history...
parseGetPostSessionCookie uses the super-global variable $_POST which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
Loading history...
parseGetPostSessionCookie uses the super-global variable $_COOKIE which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
Loading history...
parseGetPostSessionCookie uses the super-global variable $_FILES which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
Loading history...
parseGetPostSessionCookie uses the super-global variable $_SESSION which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
Loading history...
|
|||
| 168 | { |
||
| 169 | 27 | foreach ($_GET as $name => $value) { |
|
| 170 | $request->params[$name] = $value; |
||
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request.
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. Loading history...
|
|||
| 171 | } |
||
| 172 | 27 | foreach ($_POST as $name => $value) { |
|
| 173 | $request->params[$name] = $value; |
||
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request.
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. Loading history...
|
|||
| 174 | } |
||
| 175 | 27 | foreach ($_COOKIE as $name => $value) { |
|
| 176 | $request->params[$name] = $value; |
||
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request.
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. Loading history...
|
|||
| 177 | } |
||
| 178 | 27 | foreach ($_FILES as $name => $value) { |
|
| 179 | $request->params[$name] = $value; |
||
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request.
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. Loading history...
|
|||
| 180 | } |
||
| 181 | 27 | if (isset($_SESSION)) { |
|
| 182 | foreach ($_SESSION as $name => $value) { |
||
| 183 | $request->params[$name] = $value; |
||
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request.
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. Loading history...
|
|||
| 184 | } |
||
| 185 | } |
||
| 186 | 27 | } |
|
| 187 | } |
||
| 188 |
This check looks for access to properties that are not accessible from the current context.
If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class.