Issues (165)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Url/CUrl.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Anax\Url;
4
5
/**
6
 * A helper to create urls.
7
 *
8
 */
9
class CUrl
10
{
11
    use \Anax\TConfigure;
12
13
14
15
    /**
16
     * Properties
17
     *
18
     */
19
    const URL_CLEAN  = 'clean';  // controller/action/param1/param2
20
    const URL_APPEND = 'append'; // index.php/controller/action/param1/param2
21
22
    private $urlType = self::URL_APPEND; // What type of urls to generate
23
24
    private $siteUrl = null; // Siteurl to prepend to all absolute urls created
25
    private $baseUrl = null; // Baseurl to prepend to all relative urls created
26
    private $scriptName = null; // Name of the frontcontroller script
27
28
29
    private $staticSiteUrl = null; // Siteurl to prepend to all absolute urls for assets
30
    private $staticBaseUrl = null; // Baseurl to prepend to all relative urls for assets
31
32
33
34
    /**
35
     * Set default values from configuration.
36
     *
37
     * @return this.
0 ignored issues
show
The doc-type this. could not be parsed: Unknown type name "this." at position 0. (view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
38
     */
39 17
    public function setDefaultsFromConfiguration()
40
    {
41 17
        $set = [
42
            "urlType",
43 2
            "siteUrl",
44 2
            "baseUrl",
45 2
            "staticSiteUrl",
46 2
            "staticBaseUrl",
47
            "scriptName",
48 15
        ];
49
        
50 3
        foreach ($set as $item) {
51
            if (!isset($this->config[$item])) {
52 12
                continue;
53
            }
54 4
            
55
            $this->$item = $this->config[$item];
56
        }
57
58 8
        return $this;
59 8
    }
60 4
61
62 4
63
    /**
64
     * Create an url and prepending the baseUrl.
65
     *
66
     * @param string $uri     part of uri to use when creating an url.
67
     *                        "" or null means baseurl to current
68
     *                        frontcontroller.
69
     * @param string $baseuri optional base to prepend uri.
70
     *
71
     * @return string as resulting url.
72
     */
73
    public function create($uri = null, $baseuri = null)
74
    {
75
        if (empty($uri) && empty($baseuri)) {
76
            // Empty uri means baseurl
77
            return $this->baseUrl
78
                . (($this->urlType == self::URL_APPEND)
79
                    ? "/$this->scriptName"
80
                    : null);
81
        } elseif (empty($uri)) {
82
            // Empty uri means baseurl with appended $baseuri
83
            ;
84
        } elseif (substr($uri, 0, 7) == "http://"
85
            || substr($uri, 0, 8) == "https://"
86
            || substr($uri, 0, 2) == "//"
87
        ) {
88
            // Fully qualified, just leave as is.
89
            return $uri;
90
        } elseif ($uri[0] == "/") {
91
            // Absolute url, prepend with siteUrl
92
            //return rtrim($this->siteUrl . rtrim($uri, '/'), '/');
93
            return $this->siteUrl . $uri;
94
        } elseif ($uri[0] == "#"
95
            || $uri[0] == "?"
96
        ) {
97
            // Hashtag url to local page, or query part leave as is.
98
            return $uri;
99
        } elseif (substr($uri, 0, 7) == "mailto:"
100
            || substr(html_entity_decode($uri), 0, 7) == "mailto:") {
101
            // Leave mailto links as is
102
            // The odd fix is for markdown converting mailto: to UTF-8
103
            // Might be a better way to solve this...
104
            return $uri;
105 8
        }
106
107 8
        // Prepend uri with baseuri
108
        $uri = rtrim($uri, "/");
109
        if (!empty($baseuri)) {
110 8
            $uri = rtrim($baseuri, "/") . "/$uri";
111
        }
112 4
113
        // Remove the trailing index part of the url
114 4
        if (basename($uri) == "index") {
115
            $uri = dirname($uri);
116 2
        }
117
118
        if ($this->urlType == self::URL_CLEAN) {
119
            return rtrim($this->baseUrl . "/" . $uri, "/");
120 2
        } else {
121
            return rtrim($this->baseUrl . "/" . $this->scriptName . "/" . $uri, "/");
122 2
        }
123 2
    }
124 2
125
126
127
    /**
128
     * Create an url and prepend the baseUrl to the directory of
129
     * the frontcontroller.
130
     *
131
     * @param string $uri part of uri to use when creating an url.
132
     *                    "" or null means baseurl to directory of
133
     *                    the current frontcontroller.
134
     *
135
     * @return string as resulting url.
136 17
     */
137
    public function createRelative($uri = null)
138 17
    {
139 17 View Code Duplication
        if (empty($uri)) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
140
            // Empty uri means baseurl
141
            return $this->baseUrl;
142
        } elseif (substr($uri, 0, 7) == "http://"
143
            || substr($uri, 0, 8) == "https://"
144
            || substr($uri, 0, 2) == "//"
145
        ) {
146
            // Fully qualified, just leave as is.
147
            return rtrim($uri, '/');
148
        } elseif ($uri[0] == '/') {
149
            // Absolute url, prepend with siteUrl
150
            return rtrim($this->siteUrl . rtrim($uri, '/'), '/');
151 18
        }
152
153 18
        $uri = rtrim($uri, '/');
154 18
        return $this->baseUrl . '/' . $uri;
155
    }
156
157
158
159
    /**
160
     * Create an url for a static asset.
161
     *
162
     * @param string $uri part of uri to use when creating an url.
163
     *
164
     * @return string as resulting url.
165
     */
166 4
    public function asset($uri = null)
167
    {
168 4 View Code Duplication
        if (empty($uri)) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
169 4
            // Allow empty
170
        } elseif (substr($uri, 0, 7) == "http://"
171
            || substr($uri, 0, 8) == "https://"
172
            || substr($uri, 0, 2) == "//"
173
        ) {
174
            // Fully qualified, just leave as is.
175
            return rtrim($uri, '/');
176
        } elseif ($uri[0] == '/') {
177
            // Absolute url, prepend with staticSiteUrl
178
            return rtrim($this->staticSiteUrl . rtrim($uri, '/'), '/');
179
        }
180
181 4
        $baseUrl = isset($this->staticBaseUrl)
182
            ? $this->staticBaseUrl
183 4
            : $this->baseUrl;
184 4
185
        return empty($uri)
186
            ? $baseUrl
187
            : $baseUrl . '/' . $uri;
188
    }
189
190
191
192
    /**
193
     * Set the siteUrl to prepend all absolute urls created.
194
     *
195
     * @param string $url part of url to use when creating an url.
196 7
     *
197
     * @return $this
198 7
     */
199 7
    public function setSiteUrl($url)
200
    {
201
        $this->siteUrl = rtrim($url, '/');
202
        return $this;
203
    }
204
205
206
207
    /**
208
     * Set the baseUrl to prepend all relative urls created.
209
     *
210
     * @param string $url part of url to use when creating an url.
211 15
     *
212
     * @return $this
213 15
     */
214 1
    public function setBaseUrl($url)
215
    {
216
        $this->baseUrl = rtrim($url, '/');
217 14
        return $this;
218 14
    }
219
220
221
222
    /**
223
     * Set the siteUrl to prepend absolute urls for assets.
224
     *
225
     * @param string $url part of url to use when creating an url.
226
     *
227
     * @return $this
228
     */
229
    public function setStaticSiteUrl($url)
230
    {
231
        $this->staticSiteUrl = rtrim($url, '/');
232
        return $this;
233
    }
234
235
236
237
    /**
238
     * Set the baseUrl to prepend relative urls for assets.
239
     *
240
     * @param string $url part of url to use when creating an url.
241
     *
242
     * @return $this
243
     */
244
    public function setStaticBaseUrl($url)
245
    {
246
        $this->staticBaseUrl = rtrim($url, '/');
247
        return $this;
248
    }
249
250
251
252
    /**
253
     * Set the scriptname to use when creating URL_APPEND urls.
254
     *
255
     * @param string $name as the scriptname, for example index.php.
256
     *
257
     * @return $this
258
     */
259
    public function setScriptName($name)
260
    {
261
        $this->scriptName = $name;
262
        return $this;
263
    }
264
265
266
267
    /**
268
     * Set the type of urls to be generated, URL_CLEAN, URL_APPEND.
269
     *
270
     * @param string $type what type of urls to create.
271
     *
272
     * @return $this
273
     */
274
    public function setUrlType($type)
275
    {
276
        if (!in_array($type, [self::URL_APPEND, self::URL_CLEAN])) {
277
            throw new \Exception("Unsupported Url type.");
278
        }
279
280
        $this->urlType = $type;
281
        return $this;
282
    }
283
284
285
286
    /**
287
     * Create a slug of a string, to be used as url.
288
     *
289
     * @param string $str the string to format as slug.
290
     *
291
     * @return str the formatted slug.
292
     */
293
    public function slugify($str)
294
    {
295
        $str = mb_strtolower(trim($str));
296
        $str = str_replace(array('å','ä','ö'), array('a','a','o'), $str);
297
        $str = preg_replace('/[^a-z0-9-]/', '-', $str);
298
        $str = trim(preg_replace('/-+/', '-', $str), '-');
299
        return $str;
300
    }
301
}
302