mediamonks /
drupal-controller-annotations
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace Drupal\controller_annotations\EventSubscriber; |
||
| 4 | |||
| 5 | use Drupal\controller_annotations\Configuration\Template; |
||
| 6 | use Drupal\controller_annotations\Templating\TemplateResolver; |
||
| 7 | use Symfony\Component\EventDispatcher\EventSubscriberInterface; |
||
| 8 | use Symfony\Component\HttpFoundation\Request; |
||
| 9 | use Symfony\Component\HttpFoundation\Response; |
||
| 10 | use Symfony\Component\HttpFoundation\StreamedResponse; |
||
| 11 | use Symfony\Component\HttpKernel\Event\FilterControllerEvent; |
||
| 12 | use Symfony\Component\HttpKernel\Event\GetResponseForControllerResultEvent; |
||
| 13 | use Symfony\Component\HttpKernel\Event\KernelEvent; |
||
| 14 | use Symfony\Component\HttpKernel\KernelEvents; |
||
| 15 | |||
| 16 | class TemplateEventSubscriber implements EventSubscriberInterface |
||
| 17 | { |
||
| 18 | /** |
||
| 19 | * @var \Twig_Environment |
||
| 20 | */ |
||
| 21 | private $twig; |
||
| 22 | |||
| 23 | /** |
||
| 24 | * @var TemplateResolver |
||
| 25 | */ |
||
| 26 | private $resolver; |
||
| 27 | |||
| 28 | /** |
||
| 29 | * @param \Twig_Environment $twig |
||
| 30 | * @param TemplateResolver $resolver |
||
| 31 | */ |
||
| 32 | 13 | public function __construct(\Twig_Environment $twig, TemplateResolver $resolver) |
|
| 33 | { |
||
| 34 | 13 | $this->twig = $twig; |
|
| 35 | 13 | $this->resolver = $resolver; |
|
| 36 | 13 | } |
|
| 37 | |||
| 38 | /** |
||
| 39 | * Guesses the template name to render and its variables and adds them to |
||
| 40 | * the request object. |
||
| 41 | * |
||
| 42 | * @param FilterControllerEvent $event A FilterControllerEvent instance |
||
| 43 | */ |
||
| 44 | 11 | public function onKernelController(FilterControllerEvent $event) |
|
| 45 | { |
||
| 46 | 11 | $template = $this->getTemplateFromRequest($event); |
|
| 47 | 11 | if (!$template instanceof Template) { |
|
| 48 | 8 | return; |
|
| 49 | } |
||
| 50 | |||
| 51 | 3 | $template->setOwner($event->getController()); |
|
|
0 ignored issues
–
show
|
|||
| 52 | 3 | $this->normalizeTemplate($template); |
|
| 53 | 3 | } |
|
| 54 | |||
| 55 | /** |
||
| 56 | * Renders the template and initializes a new response object with the |
||
| 57 | * rendered template content. |
||
| 58 | * |
||
| 59 | * @param GetResponseForControllerResultEvent $event |
||
| 60 | */ |
||
| 61 | 10 | public function onKernelView(GetResponseForControllerResultEvent $event) |
|
| 62 | { |
||
| 63 | 10 | $template = $this->getTemplateFromRequest($event); |
|
| 64 | 10 | if (!$template instanceof Template) { |
|
| 65 | 7 | return; |
|
| 66 | } |
||
| 67 | |||
| 68 | 3 | $this->setResponse($event, $template, $this->getParameters($event, $template)); |
|
| 69 | 3 | } |
|
| 70 | |||
| 71 | /** |
||
| 72 | * @param KernelEvent $event |
||
| 73 | * @return mixed |
||
| 74 | */ |
||
| 75 | 13 | private function getTemplateFromRequest(KernelEvent $event) |
|
| 76 | { |
||
| 77 | 13 | return $event->getRequest()->attributes->get('_template'); |
|
| 78 | } |
||
| 79 | |||
| 80 | /** |
||
| 81 | * @param Template $template |
||
| 82 | */ |
||
| 83 | 3 | private function normalizeTemplate(Template $template) |
|
| 84 | { |
||
| 85 | 3 | if (is_null($template->getTemplate())) { |
|
| 86 | 2 | $templateFile = $this->resolver->resolveByControllerAndAction( |
|
| 87 | 2 | get_class($template->getOwner()[0]), |
|
| 88 | 2 | $template->getOwner()[1] |
|
| 89 | ); |
||
| 90 | } else { |
||
| 91 | 2 | $templateFile = $this->resolver->normalize($template->getTemplate()); |
|
| 92 | } |
||
| 93 | |||
| 94 | 3 | $template->setTemplate($templateFile); |
|
| 95 | 3 | } |
|
| 96 | |||
| 97 | /** |
||
| 98 | * @param GetResponseForControllerResultEvent $event |
||
| 99 | * @param Template $template |
||
| 100 | * @param $parameters |
||
| 101 | */ |
||
| 102 | 3 | private function setResponse(GetResponseForControllerResultEvent $event, Template $template, $parameters) |
|
| 103 | { |
||
| 104 | // make sure the owner (controller+dependencies) is not cached or stored elsewhere |
||
| 105 | 3 | $template->setOwner([]); |
|
| 106 | |||
| 107 | 3 | if ($template->isStreamable()) { |
|
| 108 | 2 | $callback = function () use ($template, $parameters) { |
|
| 109 | 2 | $this->twig->display($template->getTemplate(), $parameters); |
|
| 110 | 2 | }; |
|
| 111 | |||
| 112 | 2 | $event->setResponse(new StreamedResponse($callback)); |
|
| 113 | } else { |
||
| 114 | 2 | $event->setResponse(new Response($this->twig->render($template->getTemplate(), $parameters))); |
|
| 115 | } |
||
| 116 | 3 | } |
|
| 117 | |||
| 118 | /** |
||
| 119 | * @param GetResponseForControllerResultEvent $event |
||
| 120 | * @param Template $template |
||
| 121 | * @return array|mixed |
||
| 122 | */ |
||
| 123 | 3 | private function getParameters(GetResponseForControllerResultEvent $event, Template $template) |
|
| 124 | { |
||
| 125 | 3 | $parameters = $event->getControllerResult(); |
|
| 126 | |||
| 127 | 3 | $owner = $template->getOwner(); |
|
| 128 | 3 | list($controller, $action) = $owner; |
|
| 129 | |||
| 130 | // when the annotation declares no default vars and the action returns |
||
| 131 | // null, all action method arguments are used as default vars |
||
| 132 | 3 | if (null === $parameters) { |
|
| 133 | 1 | $parameters = $this->resolveDefaultParameters($event->getRequest(), $template, $controller, $action); |
|
| 134 | } |
||
| 135 | |||
| 136 | 3 | return $parameters; |
|
| 137 | } |
||
| 138 | |||
| 139 | /** |
||
| 140 | * @param Request $request |
||
| 141 | * @param Template $template |
||
| 142 | * @param object $controller |
||
| 143 | * @param string $action |
||
| 144 | * @return array |
||
| 145 | */ |
||
| 146 | 1 | private function resolveDefaultParameters(Request $request, Template $template, $controller, $action) |
|
| 147 | { |
||
| 148 | 1 | $arguments = $template->getVars(); |
|
| 149 | |||
| 150 | 1 | if (0 === count($arguments)) { |
|
| 151 | 1 | $r = new \ReflectionObject($controller); |
|
| 152 | |||
| 153 | 1 | $arguments = []; |
|
| 154 | 1 | foreach ($r->getMethod($action)->getParameters() as $param) { |
|
| 155 | 1 | $arguments[] = $param; |
|
| 156 | } |
||
| 157 | } |
||
| 158 | |||
| 159 | 1 | return $this->resolveParametersWithReflection($request, $arguments); |
|
| 160 | } |
||
| 161 | |||
| 162 | /** |
||
| 163 | * fetch the arguments of @Template.vars or everything if desired |
||
| 164 | * and assign them to the designated template |
||
| 165 | * |
||
| 166 | * @param Request $request |
||
| 167 | * @param array $arguments |
||
| 168 | * @return array |
||
| 169 | */ |
||
| 170 | 1 | private function resolveParametersWithReflection(Request $request, array $arguments) |
|
| 171 | { |
||
| 172 | 1 | $parameters = []; |
|
| 173 | 1 | foreach ($arguments as $argument) { |
|
| 174 | 1 | if ($argument instanceof \ReflectionParameter) { |
|
| 175 | 1 | $name = $argument->getName(); |
|
| 176 | 1 | $parameters[$name] = !$request->attributes->has($name) |
|
| 177 | 1 | && $argument->isDefaultValueAvailable() |
|
| 178 | 1 | ? $argument->getDefaultValue() |
|
| 179 | 1 | : $request->attributes->get($name); |
|
| 180 | } else { |
||
| 181 | 1 | $parameters[$argument] = $request->attributes->get($argument); |
|
| 182 | } |
||
| 183 | } |
||
| 184 | |||
| 185 | 1 | return $parameters; |
|
| 186 | } |
||
| 187 | |||
| 188 | /** |
||
| 189 | * @return array |
||
| 190 | */ |
||
| 191 | 7 | public static function getSubscribedEvents() |
|
| 192 | { |
||
| 193 | return [ |
||
| 194 | 7 | KernelEvents::CONTROLLER => ['onKernelController', 100], |
|
| 195 | 7 | KernelEvents::VIEW => ['onKernelView', 10], |
|
| 196 | ]; |
||
| 197 | } |
||
| 198 | } |
||
| 199 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: