1 | <?php |
||
17 | class DeployController extends Controller |
||
18 | { |
||
19 | /** |
||
20 | * The origin of the webhook request. |
||
21 | * |
||
22 | * @var Morphatic\AutoDeploy\Origins\OriginInterface |
||
23 | */ |
||
24 | private $origin; |
||
25 | |||
26 | /** |
||
27 | * The URL of the repo to be cloned. |
||
28 | * |
||
29 | * @var string |
||
30 | */ |
||
31 | private $repoUrl; |
||
32 | |||
33 | /** |
||
34 | * The absolute path of the directory on the server that contains the project. |
||
35 | * |
||
36 | * @var string |
||
37 | */ |
||
38 | private $webroot; |
||
39 | |||
40 | /** |
||
41 | * The absolute path of the directory where the new deployment will be set up. |
||
42 | * |
||
43 | * @var string |
||
44 | */ |
||
45 | private $installDir; |
||
46 | |||
47 | /** |
||
48 | * A log of the results of the entire deploy process. |
||
49 | * |
||
50 | * @var Monolog\Logger |
||
51 | */ |
||
52 | private $log; |
||
53 | |||
54 | /** |
||
55 | * The commit ID for this commit. |
||
56 | * |
||
57 | * @var string |
||
58 | */ |
||
59 | private $commitId; |
||
60 | |||
61 | /** |
||
62 | * The commit ID for this commit. |
||
63 | * |
||
64 | * @var AdamBrett\ShellWrapper\Runners\Exec |
||
65 | */ |
||
66 | private $shell; |
||
67 | |||
68 | /** |
||
69 | * The result of this commit. |
||
70 | * |
||
71 | * @var array |
||
72 | */ |
||
73 | private $result; |
||
74 | |||
75 | /** |
||
76 | * Create a new DeployController instance. |
||
77 | * |
||
78 | * @param Morphatic\AutoDeploy\Origins\OriginInterface $origin The origin of the webhook |
||
79 | * @param AdamBrett\ShellWrapper\Runners\Exec $exec The shell command execution class |
||
80 | */ |
||
81 | 36 | public function __construct(OriginInterface $origin, Exec $exec) |
|
91 | |||
92 | /** |
||
93 | * Handles incoming webhook requests. |
||
94 | */ |
||
95 | 12 | public function index() |
|
132 | |||
133 | /** |
||
134 | * Runs a shell command, logs, and handles the result. |
||
135 | * |
||
136 | * @param AdamBrett\ShellWrapper\CommandInterface $cmd The text of the command to be run |
||
137 | * |
||
138 | 12 | * @return bool True if the command was successful, false on error |
|
139 | */ |
||
140 | private function ex(CommandInterface $cmd) |
||
154 | |||
155 | /** |
||
156 | * Backup the database. |
||
157 | * |
||
158 | 12 | * @return bool True if the database was successfully backed up. False on error. |
|
159 | */ |
||
160 | private function backupDatabase() |
||
203 | |||
204 | /** |
||
205 | * Create a new directory parallel to the webroot and clone the project into that directory. |
||
206 | * |
||
207 | 10 | * @return bool True if the clone is successful. False otherwise. |
|
208 | */ |
||
209 | 10 | private function pull() |
|
230 | |||
231 | /** |
||
232 | * Copy the .env file from the new deploy directory. |
||
233 | * |
||
234 | 8 | * @return bool True if the update is successful. False otherwise. |
|
235 | */ |
||
236 | 8 | private function copyEnv() |
|
244 | 8 | ||
245 | /** |
||
246 | 8 | * Update composer and run composer update. |
|
247 | * |
||
248 | * @return bool True if the update is successful. False otherwise. |
||
249 | */ |
||
250 | private function composer() |
||
264 | |||
265 | /** |
||
266 | * Run npm update. |
||
267 | * |
||
268 | * @return bool True if npm is successful. False otherwise. |
||
269 | */ |
||
270 | 8 | private function npm() |
|
280 | |||
281 | 8 | /** |
|
282 | * Run any necessary database migrations. |
||
283 | * |
||
284 | * @return bool True if the migration is successful. False otherwise. |
||
285 | */ |
||
286 | private function migrate() |
||
299 | |||
300 | /** |
||
301 | * Run any necessary database migrations. |
||
302 | * |
||
303 | * @return bool True if the migration is successful. False otherwise. |
||
304 | */ |
||
305 | private function seed() |
||
316 | 8 | ||
317 | /** |
||
318 | * Symlinks the new deploy directory to the webroot. |
||
319 | * |
||
320 | * @return bool True if the symlink is successful. False otherwise. |
||
321 | */ |
||
322 | private function deploy() |
||
334 | } |
||
335 |
$step
can contain request data and is used in code execution context(s) leading to a potential security vulnerability.General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: