This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | namespace Nkey\Caribu\Mvc\Util; |
||
3 | |||
4 | use Nkey\Caribu\Mvc\Controller\Request; |
||
5 | |||
6 | /** |
||
7 | * Provides the request parsing functionality |
||
8 | * |
||
9 | * @author Maik Greubel <[email protected]> |
||
10 | * |
||
11 | * This file is part of Caribu MVC package |
||
12 | */ |
||
13 | trait RequestParser |
||
14 | { |
||
15 | |||
16 | /** |
||
17 | * Parse the context prefix variables to determine in which path |
||
18 | * context the request has been performed. |
||
19 | * |
||
20 | * @param Request $request |
||
21 | */ |
||
22 | 27 | private static function parseContextPrefix(Request &$request, $serverVars = array()) |
|
23 | { |
||
24 | // Since apache 2.3.13 we have now an additional index which provides the context |
||
25 | 27 | if (isset($serverVars['CONTEXT_PREFIX']) && $serverVars['CONTEXT_PREFIX'] != '') { |
|
26 | 1 | $request->setContextPrefix( $serverVars['CONTEXT_PREFIX'] . '/' ); |
|
27 | 26 | } elseif (isset($serverVars['REDIRECT_BASE'])) { |
|
28 | // Try to determine the context from redirect base |
||
29 | 4 | $request->setContextPrefix ( $serverVars['REDIRECT_BASE'] ); |
|
30 | 22 | } elseif (isset($serverVars['SCRIPT_FILENAME']) && isset($serverVars['SCRIPT_NAME'])) { |
|
31 | // Fallback - get context out of script path |
||
32 | 4 | if (isset($serverVars['HTTP_HOST'])) { |
|
33 | 4 | $scriptName = preg_replace('/^.+[\\\\\\/]/', '', $serverVars['SCRIPT_FILENAME']); |
|
34 | 4 | $request->contextPrefix = str_replace($scriptName, '', $serverVars['SCRIPT_NAME']); |
|
0 ignored issues
–
show
|
|||
35 | } |
||
36 | } |
||
37 | 27 | } |
|
38 | |||
39 | /** |
||
40 | * Parse the prepared uri into its parts |
||
41 | * |
||
42 | * @param Request $request |
||
43 | * The unprepared request object |
||
44 | * @param string $uri |
||
45 | * The prepared uri |
||
46 | * @param string $defaultController |
||
47 | * The name of default controller if nothing is requested |
||
48 | * @param string $defaultAction |
||
49 | * The name of default action if nothing is requested |
||
50 | * |
||
51 | * @return array Parsed parts for later usage |
||
52 | */ |
||
53 | 27 | private static function parseUri(Request &$request, |
|
54 | $uri, $defaultController, $defaultAction) |
||
55 | { |
||
56 | // All beyond the context prefix is our application request uri |
||
57 | 27 | $contextUri = $uri; |
|
58 | 27 | if (null != $request->getContextPrefix() && '/' != $request->getContextPrefix()) { |
|
59 | 9 | $contextUri = str_replace($request->getContextPrefix(), '', $uri); |
|
60 | } |
||
61 | |||
62 | // Split parts |
||
63 | 27 | $parts = array(); |
|
64 | 27 | if ($contextUri != '') { |
|
65 | 23 | while (isset($contextUri[0]) && $contextUri[0] == '/') { |
|
66 | 23 | $contextUri = substr($contextUri, 1); |
|
67 | } |
||
68 | 23 | $parts = explode('/', $contextUri); |
|
69 | } |
||
70 | |||
71 | // Check if there was a controller requested |
||
72 | 27 | if (count($parts) > 0) { |
|
73 | 23 | $request->setController( ucfirst(trim($parts[0])) ); |
|
74 | 23 | array_shift($parts); |
|
75 | 23 | if (! $request->getController()) { |
|
76 | 1 | $request->setController( $defaultController ); |
|
77 | } |
||
78 | } |
||
79 | |||
80 | // Check if there was an action requested |
||
81 | 27 | if (count($parts) > 0) { |
|
82 | 21 | $request->setAction( trim($parts[0]) ); |
|
83 | 21 | array_shift($parts); |
|
84 | 21 | if (! $request->getAction()) { |
|
85 | $request->setAction( $defaultAction ); |
||
86 | } |
||
87 | } |
||
88 | |||
89 | 27 | return $parts; |
|
90 | } |
||
91 | |||
92 | /** |
||
93 | * Parse a single http header element into parameter for the request object |
||
94 | * |
||
95 | * @param Request $req |
||
96 | * The destination request object |
||
97 | * @param array $serverVars |
||
98 | * The server variables provided by sapi |
||
99 | * @param string $elementName |
||
100 | * The element to parse |
||
101 | * @param string $paramName |
||
102 | * The destination parameter name |
||
103 | */ |
||
104 | 27 | private static function parseElement(Request &$req, |
|
105 | $serverVars, $elementName, $paramName) |
||
106 | { |
||
107 | 27 | if (isset($serverVars[$elementName])) { |
|
108 | 7 | $req->setParam( $paramName, $serverVars[$elementName] ); |
|
109 | } |
||
110 | 27 | } |
|
111 | |||
112 | /** |
||
113 | * Parse the server variables which represents HTTP headers into parameter values for the request object |
||
114 | * |
||
115 | * @param Request $req |
||
116 | * The request object |
||
117 | * @param array $serverVars |
||
118 | * The server variables provided by sapi |
||
119 | */ |
||
120 | 27 | private static function parseParameters(Request &$req, $serverVars) |
|
121 | { |
||
122 | 27 | self::parseElement($req, $serverVars, 'HTTP_ACCEPT', 'Accept'); |
|
123 | 27 | self::parseElement($req, $serverVars, 'HTTP_ACCEPT_LANGUAGE', 'Accept-Language'); |
|
124 | 27 | self::parseElement($req, $serverVars, 'HTTP_ACCEPT_ENCODING', 'Accept-Encoding'); |
|
125 | 27 | self::parseElement($req, $serverVars, 'HTTP_UA_CPU', 'User-Agent-CPU'); |
|
126 | 27 | self::parseElement($req, $serverVars, 'HTTP_USER_AGENT', 'User-Agent'); |
|
127 | 27 | self::parseElement($req, $serverVars, 'HTTP_HOST', 'Host'); |
|
128 | 27 | self::parseElement($req, $serverVars, 'HTTP_CACHE_COTROL', 'Cache-Control'); |
|
129 | 27 | self::parseElement($req, $serverVars, 'HTTP_CONNECTION', 'Connection'); |
|
130 | 27 | self::parseElement($req, $serverVars, 'HTTP_X_FORWARDED_FOR', 'X-Forwarded-For'); |
|
131 | |||
132 | 27 | if (isset($req->params['Accept-Language'])) { |
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request .
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. ![]() |
|||
133 | 1 | $accepted = explode(',', $req->params['Accept-Language']); |
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request .
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. ![]() |
|||
134 | 1 | $req->params['Accept-Language-Best'] = $accepted[0]; |
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request .
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. ![]() |
|||
135 | 1 | foreach ($accepted as $acceptedLang) { |
|
136 | 1 | $matches = array(); |
|
137 | // TODO: Respect the quality field from rfc2616 |
||
138 | 1 | if (preg_match("/^((?i)[a-z]{2}[-_](?:[a-z]{2}){1,2}(?:_[a-z]{2})?).*/", $acceptedLang, $matches)) { |
|
139 | 1 | $req->params['Accept-Language-Best'] = $matches[1]; |
|
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request .
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. ![]() |
|||
140 | 1 | break; |
|
141 | } |
||
142 | } |
||
143 | } |
||
144 | 27 | } |
|
145 | |||
146 | /** |
||
147 | * Parse the remote host variables to determine client address |
||
148 | * |
||
149 | * @param Request $request |
||
150 | */ |
||
151 | 27 | private static function parseRemoteHost(Request &$request, $serverVars = array()) |
|
152 | { |
||
153 | 27 | if (isset($serverVars['REMOTE_ADDR'])) { |
|
154 | 8 | $request->remoteHost = $serverVars['REMOTE_ADDR']; |
|
0 ignored issues
–
show
The property
remoteHost cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request .
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. ![]() |
|||
155 | } |
||
156 | 27 | if (isset($serverVars['HTTP_X_FORWARDED_FOR'])) { |
|
157 | 1 | $request->remoteHost = $serverVars['HTTP_X_FORWARDED_FOR']; |
|
0 ignored issues
–
show
The property
remoteHost cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request .
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. ![]() |
|||
158 | } |
||
159 | 27 | } |
|
160 | |||
161 | /** |
||
162 | * Parse the super globals for request parameters |
||
163 | * |
||
164 | * @param Request $request |
||
165 | * Request object to put the parameters in |
||
166 | */ |
||
167 | 27 | private static function parseGetPostSessionCookie(Request &$request) |
|
0 ignored issues
–
show
parseGetPostSessionCookie uses the super-global variable $_GET which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
![]() parseGetPostSessionCookie uses the super-global variable $_POST which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
![]() parseGetPostSessionCookie uses the super-global variable $_COOKIE which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
![]() parseGetPostSessionCookie uses the super-global variable $_FILES which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
![]() parseGetPostSessionCookie uses the super-global variable $_SESSION which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
![]() |
|||
168 | { |
||
169 | 27 | foreach ($_GET as $name => $value) { |
|
170 | $request->params[$name] = $value; |
||
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request .
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. ![]() |
|||
171 | } |
||
172 | 27 | foreach ($_POST as $name => $value) { |
|
173 | $request->params[$name] = $value; |
||
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request .
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. ![]() |
|||
174 | } |
||
175 | 27 | foreach ($_COOKIE as $name => $value) { |
|
176 | $request->params[$name] = $value; |
||
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request .
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. ![]() |
|||
177 | } |
||
178 | 27 | foreach ($_FILES as $name => $value) { |
|
179 | $request->params[$name] = $value; |
||
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request .
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. ![]() |
|||
180 | } |
||
181 | 27 | if (isset($_SESSION)) { |
|
182 | foreach ($_SESSION as $name => $value) { |
||
183 | $request->params[$name] = $value; |
||
0 ignored issues
–
show
The property
params cannot be accessed from this context as it is declared private in class Nkey\Caribu\Mvc\Controller\Request .
This check looks for access to properties that are not accessible from the current context. If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class. ![]() |
|||
184 | } |
||
185 | } |
||
186 | 27 | } |
|
187 | } |
||
188 |
This check looks for access to properties that are not accessible from the current context.
If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class.