This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace Egzaminer; |
||
4 | |||
5 | use AltoRouter; |
||
6 | use Egzaminer\Controller\ErrorController; |
||
7 | use Exception; |
||
8 | use PDO; |
||
9 | use PDOException; |
||
10 | use RuntimeException; |
||
11 | use Tamtamchik\SimpleFlash\Flash; |
||
12 | use Whoops\Handler\PrettyPageHandler; |
||
13 | use Whoops\Run as Whoops; |
||
14 | |||
15 | class App |
||
16 | { |
||
17 | const VERSION = '0.14.0'; |
||
18 | |||
19 | /** |
||
20 | * @var string |
||
21 | */ |
||
22 | private $url; |
||
23 | |||
24 | /** |
||
25 | * @var AltoRouter |
||
26 | */ |
||
27 | private $router; |
||
28 | |||
29 | /** |
||
30 | * @var array |
||
31 | */ |
||
32 | private $config; |
||
33 | |||
34 | /** |
||
35 | * @var array |
||
36 | */ |
||
37 | private $container; |
||
38 | |||
39 | public function __construct(string $url) |
||
40 | { |
||
41 | $this->config = $this->getConfig('site'); |
||
42 | |||
43 | try { |
||
44 | if ($this->config['debug']) { |
||
45 | $whoops = new Whoops(); |
||
46 | $whoops->pushHandler(new PrettyPageHandler()); |
||
0 ignored issues
–
show
The method
Whoops\Run::pushHandler() has been deprecated with message: use appendHandler and prependHandler instead
This method has been deprecated. The supplier of the class has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead. ![]() |
|||
47 | $whoops->register(); |
||
48 | } |
||
49 | |||
50 | $this->container = [ |
||
51 | 'config' => $this->config, |
||
52 | 'dbh' => $this->dbConnect($this->getConfig('db')), |
||
53 | 'dir' => $this->getDir(), |
||
54 | 'flash' => new Flash(), |
||
55 | 'request' => [ |
||
56 | 'get' => $_GET, |
||
57 | 'post' => $_POST, |
||
58 | 'session' => &$_SESSION, |
||
59 | 'files' => $_FILES, |
||
60 | ], |
||
61 | 'rootDir' => \dirname(__DIR__), |
||
62 | 'version' => self::VERSION, |
||
63 | ]; |
||
64 | |||
65 | $this->container['auth'] = new Auth($this->getConfig('users'), $this->container['request']); |
||
66 | } catch (Exception $e) { |
||
67 | http_response_code(500); |
||
68 | echo $e->getMessage(); |
||
69 | $this->terminate(); |
||
70 | } |
||
71 | |||
72 | $this->router = new AltoRouter(); |
||
73 | $this->setRequestUrl($url); |
||
74 | } |
||
75 | |||
76 | public function getConfig(string $name): array |
||
77 | { |
||
78 | $path = \dirname(__DIR__).'/config/'.$name.'.php'; |
||
79 | |||
80 | try { |
||
81 | if (!file_exists($path)) { |
||
82 | http_response_code(500); |
||
83 | |||
84 | throw new RuntimeException('Config file '.$name.'.php does not exist'); |
||
85 | } |
||
86 | } catch (Exception $e) { |
||
87 | echo $e->getMessage(); |
||
88 | $this->terminate(); |
||
89 | } |
||
90 | |||
91 | return include $path; |
||
92 | } |
||
93 | |||
94 | /** |
||
95 | * Run app. |
||
96 | * |
||
97 | * @throws Exception |
||
98 | */ |
||
99 | public function invoke() |
||
100 | { |
||
101 | $this->loadRoutes(); |
||
102 | |||
103 | $match = $this->router->match($this->url); |
||
104 | |||
105 | try { |
||
106 | // call closure or throw 404 status |
||
107 | if ($match && \is_callable($match['target'])) { |
||
108 | echo \call_user_func_array([ |
||
109 | new $match['target'][0]($this->container), $match['target'][1], |
||
110 | ], $match['params']); |
||
111 | } else { |
||
112 | throw new RuntimeException('Page not exist! No route match'); |
||
113 | } |
||
114 | } catch (Exception $e) { |
||
115 | if ($this->config['debug']) { |
||
116 | throw new DebugException($e->getMessage()); |
||
117 | } |
||
118 | |||
119 | echo (new ErrorController($this->container))->showAction(); |
||
120 | |||
121 | $this->terminate(); |
||
122 | } |
||
123 | } |
||
124 | |||
125 | /** |
||
126 | * Load routes. |
||
127 | * |
||
128 | * @throws Exception |
||
129 | * |
||
130 | * @return void |
||
131 | */ |
||
132 | public function loadRoutes() |
||
133 | { |
||
134 | $routesArray = (array) include __DIR__.'/routes.php'; |
||
135 | |||
136 | foreach ($routesArray as $key => $route) { |
||
137 | if (2 === \count($route)) { |
||
138 | $this->router->map( |
||
139 | $route[0][0], |
||
140 | $route[0][1], |
||
141 | [ |
||
142 | 'Egzaminer\Controller\\'.$route[0][2][0], |
||
143 | $route[0][2][1], |
||
144 | ], |
||
145 | $key.'/'.$route[0][0] |
||
146 | ); |
||
147 | $route = $route[1]; |
||
148 | } |
||
149 | |||
150 | $this->router->map( |
||
151 | $route[0], |
||
152 | $route[1], |
||
153 | [ |
||
154 | 'Egzaminer\Controller\\'.$route[2][0], |
||
155 | $route[2][1], |
||
156 | ], |
||
157 | $key.'/'.$route[0] |
||
158 | ); |
||
159 | } |
||
160 | } |
||
161 | |||
162 | /** |
||
163 | * @param array $config |
||
164 | * |
||
165 | * @throws DebugException |
||
166 | * |
||
167 | * @return PDO |
||
168 | */ |
||
169 | private function dbConnect(array $config): PDO |
||
170 | { |
||
171 | $dbh = null; |
||
172 | |||
173 | try { |
||
174 | $dsn = 'mysql' |
||
175 | .':dbname='.$config['name'] |
||
176 | .';host='.$config['host'] |
||
177 | .';charset=utf8'; |
||
178 | |||
179 | $user = $config['user']; |
||
180 | $password = $config['pass']; |
||
181 | |||
182 | $dbh = new PDO($dsn, $user, $password); |
||
183 | |||
184 | if ($this->config['debug']) { |
||
185 | $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); |
||
186 | } |
||
187 | } catch (PDOException $e) { |
||
188 | http_response_code(500); |
||
189 | |||
190 | if ($this->config['debug']) { |
||
191 | throw new DebugException($e->getMessage()); |
||
192 | } |
||
193 | |||
194 | echo 'Error 500'; |
||
195 | $this->terminate(); |
||
196 | } |
||
197 | |||
198 | return $dbh; |
||
199 | } |
||
200 | |||
201 | public function terminate($code = 1) |
||
202 | { |
||
203 | exit($code); |
||
204 | } |
||
205 | |||
206 | public function setRequestUrl(string $request) |
||
207 | { |
||
208 | $this->url = substr($request, \strlen($this->getDir())); |
||
209 | } |
||
210 | |||
211 | public function getDir(): string |
||
212 | { |
||
213 | if (\dirname($_SERVER['SCRIPT_NAME']) === '/') { |
||
214 | return ''; |
||
215 | } |
||
216 | |||
217 | return \dirname($_SERVER['SCRIPT_NAME']); |
||
218 | } |
||
219 | } |
||
220 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: