Passed
Push — master ( 69cdea...cc536d )
by Mostafa Abd El-Salam
03:48
created

HasPermissions::hasPermissionViaRole()   A

Complexity

Conditions 1
Paths 1

Size

Total Lines 4
Code Lines 2

Duplication

Lines 0
Ratio 0 %

Code Coverage

Tests 2
CRAP Score 1

Importance

Changes 0
Metric Value
dl 0
loc 4
ccs 2
cts 2
cp 1
rs 10
c 0
b 0
f 0
cc 1
eloc 2
nc 1
nop 1
crap 1
1
<?php
2
declare(strict_types=1);
3
4
namespace Maklad\Permission\Traits;
5
6
use Illuminate\Support\Collection;
7
use Jenssegers\Mongodb\Eloquent\Builder;
8
use Jenssegers\Mongodb\Eloquent\Model;
9
use Jenssegers\Mongodb\Relations\BelongsToMany;
10
use Maklad\Permission\Contracts\PermissionInterface as Permission;
11
use Maklad\Permission\Exceptions\GuardDoesNotMatch;
12
use Maklad\Permission\Guard;
13
use Maklad\Permission\Helpers;
14
use Maklad\Permission\Models\Role;
15
use Maklad\Permission\PermissionRegistrar;
16
17
/**
18
 * Trait HasPermissions
19
 * @package Maklad\Permission\Traits
20
 */
21
trait HasPermissions
22
{
23
    public static function bootHasPermissions()
24
    {
25 123
        static::deleting(function (Model $model) {
26 6
            if (isset($model->forceDeleting) && !$model->forceDeleting) {
27 2
                return;
28
            }
29
30 4
            $model->permissions()->sync([]);
31 123
        });
32 123
    }
33
34
    /**
35
     * A role may be given various permissions.
36
     * @return BelongsToMany
37
     */
38 54
    public function permissions(): BelongsToMany
39
    {
40 54
        return $this->belongsToMany(
0 ignored issues
show
Bug introduced by
It seems like belongsToMany() must be provided by classes using this trait. How about adding it as abstract method to this trait?

This check looks for methods that are used by a trait but not required by it.

To illustrate, let’s look at the following code example

trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

The trait Idable provides a method equalsId that in turn relies on the method getId(). If this method does not exist on a class mixing in this trait, the method will fail.

Adding the getId() as an abstract method to the trait will make sure it is available.

Loading history...
41 54
            config('permission.models.permission'),
42 54
            config('permission.collection_names.role_has_permissions')
43
        );
44
    }
45
46
    /**
47
     * A role belongs to some users of the model associated with its guard.
48
     */
49 2
    public function users(): BelongsToMany
50
    {
51 2
        return $this->belongsToMany($this->helpers->getModelForGuard($this->attributes['guard_name']));
0 ignored issues
show
Bug introduced by
The property helpers does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
Bug introduced by
The property attributes does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
Bug introduced by
It seems like belongsToMany() must be provided by classes using this trait. How about adding it as abstract method to this trait?

This check looks for methods that are used by a trait but not required by it.

To illustrate, let’s look at the following code example

trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

The trait Idable provides a method equalsId that in turn relies on the method getId(). If this method does not exist on a class mixing in this trait, the method will fail.

Adding the getId() as an abstract method to the trait will make sure it is available.

Loading history...
Security Code Execution introduced by
$this->helpers->getModel...tributes['guard_name']) can contain request data and is used in code execution context(s) leading to a potential security vulnerability.

9 paths for user data to reach this point

  1. Path: $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned in ServerBag.php on line 62
  1. $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned
    in vendor/ServerBag.php on line 62
  2. ParameterBag::$parameters is assigned
    in vendor/ServerBag.php on line 77
  3. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  4. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  5. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  6. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  7. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  8. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  9. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  10. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 51
  2. Path: Read from $_POST, and $_POST is passed to Request::createRequestFromFactory() in Request.php on line 314
  1. Read from $_POST, and $_POST is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  2. $request is passed to Request::__construct()
    in vendor/Request.php on line 2068
  3. $request is passed to Request::initialize()
    in vendor/Request.php on line 255
  4. $request is passed to ParameterBag::__construct()
    in vendor/Request.php on line 273
  5. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  6. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  7. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  8. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  9. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  10. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  11. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  12. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  13. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 51
  3. Path: Read from $_SERVER, and $server is assigned in Request.php on line 304
  1. Read from $_SERVER, and $server is assigned
    in vendor/Request.php on line 304
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  13. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  14. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 51
  4. Path: Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned in Request.php on line 307
  1. Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned
    in vendor/Request.php on line 307
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  13. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  14. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 51
  5. Path: Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned in Request.php on line 310
  1. Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned
    in vendor/Request.php on line 310
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  13. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  14. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 51
  6. Path: $server['HTTP_HOST'] seems to return tainted data, and $server is assigned in Request.php on line 380
  1. $server['HTTP_HOST'] seems to return tainted data, and $server is assigned
    in vendor/Request.php on line 380
  2. $server is assigned
    in vendor/Request.php on line 428
  3. $server is assigned
    in vendor/Request.php on line 429
  4. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 431
  5. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  6. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  7. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  8. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  9. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  10. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  11. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  12. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  13. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  14. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  15. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  16. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 51
  7. Path: $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 43
  1. $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 43
  2. $headers is assigned
    in vendor/ServerBag.php on line 44
  3. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 279
  4. $values is assigned
    in vendor/HeaderBag.php on line 29
  5. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 30
  6. $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  7. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  8. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 65
  9. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 113
  10. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1831
  11. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1862
  12. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 95
  13. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  14. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  15. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  16. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  17. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  18. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  19. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  20. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 51
  8. Path: $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 44
  1. $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 44
  2. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 279
  3. $values is assigned
    in vendor/HeaderBag.php on line 29
  4. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 30
  5. $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  6. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  7. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 65
  8. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 113
  9. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1831
  10. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1862
  11. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 95
  12. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  13. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  14. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  15. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  16. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  17. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  18. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  19. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 51
  9. Path: Read from $_SERVER, and $server is assigned in src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 22
  1. Read from $_SERVER, and $server is assigned
    in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 22
  2. Data is passed through array_replace()
    in vendor/Request.php on line 357
  3. Data is passed through call_user_func()
    in vendor/Request.php on line 2059
  4. \Illuminate\Http\Request::create($uri, 'GET', array(), array(), array(), $server) is passed to Container::instance()
    in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 31
  5. Container::$instances is assigned
    in vendor/src/Illuminate/Container/Container.php on line 379
  6. Tainted property Container::$instances is read
    in vendor/src/Illuminate/Container/Container.php on line 620
  7. Container::resolve() returns tainted data
    in vendor/src/Illuminate/Container/Container.php on line 586
  8. Container::make() returns tainted data
    in vendor/src/Illuminate/Container/Container.php on line 1195
  9. Container::offsetGet() returns tainted data, and $table is assigned
    in vendor/src/Illuminate/Session/SessionManager.php on line 73
  10. $table is passed to DatabaseSessionHandler::__construct()
    in vendor/src/Illuminate/Session/SessionManager.php on line 78
  11. DatabaseSessionHandler::$table is assigned
    in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 64
  12. Tainted property DatabaseSessionHandler::$table is read, and $this->table is passed to Connection::table()
    in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 279
  13. $table is passed to Builder::from()
    in vendor/src/Illuminate/Database/Connection.php on line 265
  14. Builder::$from is assigned
    in vendor/src/Illuminate/Database/Query/Builder.php on line 327
  15. Tainted property Builder::$from is read, and $query->from is passed to Grammar::wrapTable()
    in vendor/src/Illuminate/Database/Query/Grammars/Grammar.php on line 783
  16. $this->tablePrefix . $table is passed to Grammar::wrap()
    in vendor/src/Illuminate/Database/Grammar.php on line 36
  17. $value is passed through explode(), and explode('.', $value) is passed to Grammar::wrapSegments()
    in vendor/src/Illuminate/Database/Grammar.php on line 62
  18. $segments is passed to collect()
    in vendor/src/Illuminate/Database/Grammar.php on line 96
  19. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  20. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  21. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  22. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  23. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 51

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
52
    }
53
54
    /**
55
     * Grant the given permission(s) to a role.
56
     *
57
     * @param string|array|Permission|\Illuminate\Support\Collection $permissions
58
     *
59
     * @return $this
60
     * @throws GuardDoesNotMatch
61
     */
62 46 View Code Duplication
    public function givePermissionTo(...$permissions)
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
63
    {
64 46
        $permissions = collect($permissions)
65 46
            ->flatten()
66 46
            ->map(function ($permission) {
67 44
                return $this->getStoredPermission($permission);
68 46
            })
69 44
            ->each(function ($permission) {
70 42
                $this->ensureModelSharesGuard($permission);
71 44
            })
72 41
            ->all();
73
74 41
        $this->permissions()->saveMany($permissions);
75
76 41
        $this->forgetCachedPermissions();
77
78 41
        return $this;
79
    }
80
81
    /**
82
     * Remove all current permissions and set the given ones.
83
     *
84
     * @param string|array|Permission|\Illuminate\Support\Collection $permissions
85
     *
86
     * @return $this
87
     * @throws GuardDoesNotMatch
88
     */
89 4
    public function syncPermissions(...$permissions)
90
    {
91 4
        $this->permissions()->sync([]);
92
93 4
        return $this->givePermissionTo($permissions);
94
    }
95
96
    /**
97
     * Revoke the given permission.
98
     *
99
     * @param string|array|Permission|\Illuminate\Support\Collection $permissions
100
     *
101
     * @return $this
102
     * @throws \Maklad\Permission\Exceptions\GuardDoesNotMatch
103
     */
104 6 View Code Duplication
    public function revokePermissionTo(...$permissions)
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
105
    {
106 6
        collect($permissions)
107 6
            ->flatten()
108 6
            ->map(function ($permission) {
109 6
                $permission = $this->getStoredPermission($permission);
110 6
                $this->permissions()->detach($permission);
0 ignored issues
show
Documentation introduced by
$permission is of type object<Maklad\Permission...ts\PermissionInterface>, but the function expects a array.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
111
112 6
                return $permission;
113 6
            });
114
115 6
        $this->forgetCachedPermissions();
116
117 6
        return $this;
118
    }
119
120
    /**
121
     * @param string|Permission $permission
122
     *
123
     * @return Permission
124
     * @throws \ReflectionException
125
     */
126 45
    protected function getStoredPermission($permission): Permission
127
    {
128 45
        if (\is_string($permission)) {
129 32
            return \app(Permission::class)->findByName($permission, $this->getDefaultGuardName());
130
        }
131
132 16
        return $permission;
133
    }
134
135
    /**
136
     * @param Model $roleOrPermission
137
     *
138
     * @throws GuardDoesNotMatch
139
     * @throws \ReflectionException
140
     */
141 83
    protected function ensureModelSharesGuard(Model $roleOrPermission)
142
    {
143 83 View Code Duplication
        if (! $this->getGuardNames()->contains($roleOrPermission->guard_name)) {
0 ignored issues
show
Security Code Execution introduced by
$roleOrPermission->guard_name can contain request data and is used in code execution context(s) leading to a potential security vulnerability.

9 paths for user data to reach this point

  1. Path: $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned in ServerBag.php on line 62
  1. $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned
    in vendor/ServerBag.php on line 62
  2. ParameterBag::$parameters is assigned
    in vendor/ServerBag.php on line 77
  3. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  4. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  5. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  6. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  7. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  8. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  9. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  10. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  11. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  12. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  13. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  14. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  15. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  16. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  17. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  18. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  19. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  20. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  21. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  22. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  23. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 143
  2. Path: Read from $_POST, and $_POST is passed to Request::createRequestFromFactory() in Request.php on line 314
  1. Read from $_POST, and $_POST is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  2. $request is passed to Request::__construct()
    in vendor/Request.php on line 2068
  3. $request is passed to Request::initialize()
    in vendor/Request.php on line 255
  4. $request is passed to ParameterBag::__construct()
    in vendor/Request.php on line 273
  5. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  6. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  7. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  8. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  9. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  10. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  11. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  12. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  13. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  14. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  15. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  16. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  17. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  18. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  19. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  20. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  21. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  22. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  23. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  24. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  25. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  26. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 143
  3. Path: Read from $_SERVER, and $server is assigned in Request.php on line 304
  1. Read from $_SERVER, and $server is assigned
    in vendor/Request.php on line 304
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  13. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  14. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  15. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  16. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  17. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  18. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  19. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  20. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  21. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  22. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  23. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  24. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  25. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  26. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  27. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 143
  4. Path: Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned in Request.php on line 307
  1. Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned
    in vendor/Request.php on line 307
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  13. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  14. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  15. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  16. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  17. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  18. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  19. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  20. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  21. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  22. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  23. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  24. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  25. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  26. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  27. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 143
  5. Path: Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned in Request.php on line 310
  1. Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned
    in vendor/Request.php on line 310
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  13. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  14. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  15. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  16. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  17. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  18. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  19. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  20. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  21. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  22. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  23. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  24. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  25. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  26. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  27. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 143
  6. Path: $server['HTTP_HOST'] seems to return tainted data, and $server is assigned in Request.php on line 380
  1. $server['HTTP_HOST'] seems to return tainted data, and $server is assigned
    in vendor/Request.php on line 380
  2. $server is assigned
    in vendor/Request.php on line 428
  3. $server is assigned
    in vendor/Request.php on line 429
  4. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 431
  5. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  6. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  7. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  8. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  9. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  10. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  11. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  12. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  13. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  14. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  15. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  16. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  17. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  18. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  19. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  20. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  21. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  22. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  23. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  24. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  25. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  26. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  27. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  28. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  29. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 143
  7. Path: $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 43
  1. $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 43
  2. $headers is assigned
    in vendor/ServerBag.php on line 44
  3. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 279
  4. $values is assigned
    in vendor/HeaderBag.php on line 29
  5. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 30
  6. $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  7. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  8. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 65
  9. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 113
  10. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1831
  11. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1862
  12. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 95
  13. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  14. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  15. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  16. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  17. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  18. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  19. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  20. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  21. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  22. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  23. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  24. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  25. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  26. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  27. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  28. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  29. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  30. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  31. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  32. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  33. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 143
  8. Path: $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 44
  1. $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 44
  2. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 279
  3. $values is assigned
    in vendor/HeaderBag.php on line 29
  4. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 30
  5. $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  6. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  7. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 65
  8. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 113
  9. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1831
  10. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1862
  11. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 95
  12. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  13. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  14. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  15. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  16. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  17. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  18. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  19. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  20. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  21. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  22. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  23. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  24. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  25. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  26. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  27. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  28. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  29. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  30. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  31. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  32. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 143
  9. Path: Read from $_SERVER, and $server is assigned in src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 22
  1. Read from $_SERVER, and $server is assigned
    in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 22
  2. Data is passed through array_replace()
    in vendor/Request.php on line 357
  3. Data is passed through call_user_func()
    in vendor/Request.php on line 2059
  4. \Illuminate\Http\Request::create($uri, 'GET', array(), array(), array(), $server) is passed to Container::instance()
    in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 31
  5. Container::$instances is assigned
    in vendor/src/Illuminate/Container/Container.php on line 379
  6. Tainted property Container::$instances is read
    in vendor/src/Illuminate/Container/Container.php on line 620
  7. Container::resolve() returns tainted data
    in vendor/src/Illuminate/Container/Container.php on line 586
  8. Container::make() returns tainted data
    in vendor/src/Illuminate/Container/Container.php on line 1195
  9. Container::offsetGet() returns tainted data, and $table is assigned
    in vendor/src/Illuminate/Session/SessionManager.php on line 73
  10. $table is passed to DatabaseSessionHandler::__construct()
    in vendor/src/Illuminate/Session/SessionManager.php on line 78
  11. DatabaseSessionHandler::$table is assigned
    in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 64
  12. Tainted property DatabaseSessionHandler::$table is read, and $this->table is passed to Connection::table()
    in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 279
  13. $table is passed to Builder::from()
    in vendor/src/Illuminate/Database/Connection.php on line 265
  14. Builder::$from is assigned
    in vendor/src/Illuminate/Database/Query/Builder.php on line 327
  15. Tainted property Builder::$from is read, and $query->from is passed to Grammar::wrapTable()
    in vendor/src/Illuminate/Database/Query/Grammars/Grammar.php on line 783
  16. $this->tablePrefix . $table is passed to Grammar::wrap()
    in vendor/src/Illuminate/Database/Grammar.php on line 36
  17. $value is passed through explode(), and explode('.', $value) is passed to Grammar::wrapSegments()
    in vendor/src/Illuminate/Database/Grammar.php on line 62
  18. $segments is passed to collect()
    in vendor/src/Illuminate/Database/Grammar.php on line 96
  19. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  20. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  21. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  22. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  23. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  24. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  25. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  26. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  27. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  28. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  29. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  30. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  31. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  32. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  33. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  34. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  35. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  36. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 143

Used in code-execution context

  1. Collection::contains() uses Collection::first() ($callback)
    in vendor/src/Illuminate/Support/Collection.php on line 223
  2. Collection::first() uses Arr::first() ($callback)
    in vendor/src/Illuminate/Support/Collection.php on line 584
  3. Arr::first() uses call_user_func() ($callback)
    in vendor/src/Illuminate/Support/Arr.php on line 175

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
Duplication introduced by
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
144 5
            $expected = $this->getGuardNames();
145 5
            $given    = $roleOrPermission->guard_name;
146 5
            $helpers  = new Helpers();
147
148 5
            throw new GuardDoesNotMatch($helpers->getGuardDoesNotMatchMessage($expected, $given));
149
        }
150 79
    }
151
152
    /**
153
     * @return Collection
154
     * @throws \ReflectionException
155
     */
156 86
    protected function getGuardNames(): Collection
157
    {
158 86
        return (new Guard())->getNames($this);
159
    }
160
161
    /**
162
     * @return string
163
     * @throws \ReflectionException
164
     */
165 78
    protected function getDefaultGuardName(): string
166
    {
167 78
        return (new Guard())->getDefaultName($this);
168
    }
169
170
    /**
171
     * Forget the cached permissions.
172
     */
173 80
    public function forgetCachedPermissions()
174
    {
175 80
        app(PermissionRegistrar::class)->forgetCachedPermissions();
176 80
    }
177
178
    /**
179
     * Convert to Permission Models
180
     *
181
     * @param string|array|Collection $permissions
182
     *
183
     * @return Collection
184
     */
185 7 View Code Duplication
    private function convertToPermissionModels($permissions): Collection
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
186
    {
187 7
        if (\is_array($permissions)) {
188 3
            $permissions = collect($permissions);
189
        }
190
191 7
        if (! $permissions instanceof Collection) {
192 5
            $permissions = collect([$permissions]);
193
        }
194
195 7
        $permissions = $permissions->map(function ($permission) {
196 7
            return $this->getStoredPermission($permission);
197 7
        });
198
199 6
        return $permissions;
200
    }
201
202
    /**
203
     * Return a collection of permission names associated with this user.
204
     *
205
     * @return Collection
206
     */
207 1
    public function getPermissionNames(): Collection
208
    {
209 1
        return $this->getAllPermissions()->pluck('name');
210
    }
211
212
    /**
213
     * Return all the permissions the model has via roles.
214
     */
215 3
    public function getPermissionsViaRoles(): Collection
216
    {
217 3
        return $this->load('roles', 'roles.permissions')
0 ignored issues
show
Bug introduced by
It seems like load() must be provided by classes using this trait. How about adding it as abstract method to this trait?

This check looks for methods that are used by a trait but not required by it.

To illustrate, let’s look at the following code example

trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

The trait Idable provides a method equalsId that in turn relies on the method getId(). If this method does not exist on a class mixing in this trait, the method will fail.

Adding the getId() as an abstract method to the trait will make sure it is available.

Loading history...
218 3
            ->roles->flatMap(function (Role $role) {
219 2
                return $role->permissions;
220 3
            })->sort()->values();
221
    }
222
223
    /**
224
     * Return all the permissions the model has, both directly and via roles.
225
     */
226 2
    public function getAllPermissions(): Collection
227
    {
228 2
        return $this->permissions
0 ignored issues
show
Bug introduced by
The property permissions does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
229 2
            ->merge($this->getPermissionsViaRoles())
230 2
            ->sort()
231 2
            ->values();
232
    }
233
234
    /**
235
     * Determine if the model may perform the given permission.
236
     *
237
     * @param string|Permission $permission
238
     * @param string|null $guardName
239
     *
240
     * @return bool
241
     * @throws \ReflectionException
242
     */
243 24
    public function hasPermissionTo($permission, $guardName = null): bool
244
    {
245 24
        if (\is_string($permission)) {
246 15
            $permission = \app(Permission::class)->findByName(
247 15
                $permission,
248 15
                $guardName ?? $this->getDefaultGuardName()
249
            );
250
        }
251
252 22
        return $this->hasDirectPermission($permission) || $this->hasPermissionViaRole($permission);
253
    }
254
255
    /**
256
     * Determine if the model has any of the given permissions.
257
     *
258
     * @param array ...$permissions
259
     *
260
     * @return bool
261
     * @throws \ReflectionException
262
     */
263 8
    public function hasAnyPermission(...$permissions): bool
264
    {
265 8
        if (\is_array($permissions[0])) {
266 6
            $permissions = $permissions[0];
267
        }
268
269 8
        foreach ($permissions as $permission) {
270 8
            if ($this->hasPermissionTo($permission)) {
271 8
                return true;
272
            }
273
        }
274
275 5
        return false;
276
    }
277
278
    /**
279
     * Determine if the model has, via roles, the given permission.
280
     *
281
     * @param Permission $permission
282
     *
283
     * @return bool
284
     */
285 17
    protected function hasPermissionViaRole(Permission $permission): bool
286
    {
287 17
        return $this->hasRole($permission->roles);
0 ignored issues
show
Bug introduced by
Accessing roles on the interface Maklad\Permission\Contracts\PermissionInterface suggest that you code against a concrete implementation. How about adding an instanceof check?

If you access a property on an interface, you most likely code against a concrete implementation of the interface.

Available Fixes

  1. Adding an additional type check:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeInterface $object) {
        if ($object instanceof SomeClass) {
            $a = $object->a;
        }
    }
    
  2. Changing the type hint:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeClass $object) {
        $a = $object->a;
    }
    
Loading history...
Bug introduced by
It seems like hasRole() must be provided by classes using this trait. How about adding it as abstract method to this trait?

This check looks for methods that are used by a trait but not required by it.

To illustrate, let’s look at the following code example

trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

The trait Idable provides a method equalsId that in turn relies on the method getId(). If this method does not exist on a class mixing in this trait, the method will fail.

Adding the getId() as an abstract method to the trait will make sure it is available.

Loading history...
288
    }
289
290
    /**
291
     * Determine if the model has the given permission.
292
     *
293
     * @param string|Permission $permission
294
     *
295
     * @return bool
296
     * @throws \ReflectionException
297
     */
298 23
    public function hasDirectPermission($permission): bool
299
    {
300 23
        if (\is_string($permission)) {
301 1
            $permission = \app(Permission::class)->findByName($permission, $this->getDefaultGuardName());
302
        }
303
304 23
        return $this->permissions->contains('id', $permission->id);
305
    }
306
307
    /**
308
     * Return all permissions the directory coupled to the model.
309
     */
310 1
    public function getDirectPermissions(): Collection
311
    {
312 1
        return $this->permissions;
313
    }
314
315
    /**
316
     * Scope the model query to certain permissions only.
317
     *
318
     * @param Builder $query
319
     * @param string|array|Permission|Collection $permissions
320
     *
321
     * @return Builder
322
     */
323 7
    public function scopePermission(Builder $query, $permissions): Builder
324
    {
325 7
        $permissions = $this->convertToPermissionModels($permissions);
326
327 6
        $roles = \collect([]);
328
329 6
        foreach ($permissions as $permission) {
330 6
            $roles = $roles->merge($permission->roles);
331
        }
332 6
        $roles = $roles->unique();
333
334 6
        return $query->orWhereIn('permission_ids', $permissions->pluck('_id'))
335 6
            ->orWhereIn('role_ids', $roles->pluck('_id'));
336
    }
337
}
338