Oauth2ServerServiceProvider::boot() - Code Metrics - Inspection of "First commit" - mvdstam/oauth2-server-laravel - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( 7f1549...5746c2 )

by Max van der

created 2017-03-28 13:03 UTC

Oauth2ServerServiceProvider::boot() A

↳ Parent: Oauth2ServerServiceProvider

Complexity

Conditions	1
Paths	1

Size

Total Lines	8
Code Lines	6

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	6
CRAP Score	1

Importance

Changes

Metric	Value
dl	0
loc	8
ccs	6
cts	6
cp	1
rs	9.4285
c	0
b	0
f	0
cc	1
eloc	6
nc	1
nop	0
crap	1

<?php


namespace Mvdstam\Oauth2ServerLaravel\Providers;


use DateInterval;
use Illuminate\Support\ServiceProvider;
use League\OAuth2\Server\AuthorizationServer;
use League\OAuth2\Server\CryptKey;
use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
use League\OAuth2\Server\Entities\AuthCodeEntityInterface;
use League\OAuth2\Server\Entities\ClientEntityInterface;
use League\OAuth2\Server\Entities\RefreshTokenEntityInterface;
use League\OAuth2\Server\Entities\ScopeEntityInterface;
use League\OAuth2\Server\Entities\UserEntityInterface;
use League\OAuth2\Server\Grant\AuthCodeGrant;
use League\OAuth2\Server\Grant\GrantTypeInterface;
use League\OAuth2\Server\Grant\ImplicitGrant;
use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
use League\OAuth2\Server\Repositories\AuthCodeRepositoryInterface;
use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
use League\OAuth2\Server\Repositories\ScopeRepositoryInterface;
use League\OAuth2\Server\Repositories\UserRepositoryInterface;
use League\OAuth2\Server\ResourceServer;
use Mvdstam\Oauth2ServerLaravel\Commands\CreateClientCommand;
use Mvdstam\Oauth2ServerLaravel\Commands\CreateScopeCommand;
use Mvdstam\Oauth2ServerLaravel\Commands\CreateUserCommand;
use Mvdstam\Oauth2ServerLaravel\Contracts\JWTFactoryInterface;
use Mvdstam\Oauth2ServerLaravel\Entities\AccessToken;
use Mvdstam\Oauth2ServerLaravel\Entities\AuthCode;
use Mvdstam\Oauth2ServerLaravel\Entities\Client;
use Mvdstam\Oauth2ServerLaravel\Entities\RefreshToken;
use Mvdstam\Oauth2ServerLaravel\Entities\Scope;
use Mvdstam\Oauth2ServerLaravel\Entities\User;
use Mvdstam\Oauth2ServerLaravel\Factories\JWTFactory;
use Mvdstam\Oauth2ServerLaravel\Repositories\AccessTokenRepository;
use Mvdstam\Oauth2ServerLaravel\Repositories\AuthCodeRepository;
use Mvdstam\Oauth2ServerLaravel\Repositories\ClientRepository;
use Mvdstam\Oauth2ServerLaravel\Repositories\RefreshTokenRepository;
use Mvdstam\Oauth2ServerLaravel\Repositories\ScopeRepository;
use Mvdstam\Oauth2ServerLaravel\Repositories\UserRepository;

class Oauth2ServerServiceProvider extends ServiceProvider
{

    public function boot()
    {
        $this
            ->loadRoutes()
            ->loadMigrations()
            ->publishConfig()
            ->registerCommands();
    }

    public function register()
    {
        // Merge config
        $this->mergeConfigFrom(
            dirname(__DIR__).'/config/oauth2-server.php', 'oauth2-server'
        );

        /*
         * Bind entities
         */
        $this->app->bind(AccessTokenEntityInterface::class, AccessToken::class);
        $this->app->bind(AuthCodeEntityInterface::class, AuthCode::class);
        $this->app->bind(ClientEntityInterface::class, Client::class);
        $this->app->bind(RefreshTokenEntityInterface::class, RefreshToken::class);
        $this->app->bind(ScopeEntityInterface::class, Scope::class);
        $this->app->bind(UserEntityInterface::class, User::class);

        /*
         * Bind repositories
         */
        $this->app->bind(AccessTokenRepositoryInterface::class, AccessTokenRepository::class);
        $this->app->bind(AuthCodeRepositoryInterface::class, AuthCodeRepository::class);
        $this->app->bind(ClientRepositoryInterface::class, ClientRepository::class);
        $this->app->bind(RefreshTokenRepositoryInterface::class, RefreshTokenRepository::class);
        $this->app->bind(ScopeRepositoryInterface::class, ScopeRepository::class);
        $this->app->bind(UserRepositoryInterface::class, UserRepository::class);

        /*
         * Bind miscellaneous classes
         */
        $this->app->bind(JWTFactoryInterface::class, JWTFactory::class);

        /*
         * OAuth2 Resource server
         */
        $this->app->singleton(ResourceServer::class, function() {
            return new ResourceServer(
                app(AccessTokenRepositoryInterface::class),
                app('oauth2-server.key.public')
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
            );
        });

        /*
         * OAuth2 Authorization server
         */
        $this->app->singleton(AuthorizationServer::class, function() {
            return new AuthorizationServer(
                app(ClientRepositoryInterface::class),
                app(AccessTokenRepositoryInterface::class),
                app(ScopeRepositoryInterface::class),
                app('oauth2-server.key.private'),
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
                app('oauth2-server.key.public')
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
            );
        });

        /*
         * Add active grants to authorization server
         */
        $this->app->resolving(AuthorizationServer::class, function(AuthorizationServer $authorizationServer) {
            foreach(config('oauth2-server.grants') as $grantConfig) {
                if (!(boolean) $grantConfig['enabled']) continue;

                /** @var GrantTypeInterface $grant */
                $grant = app($grantConfig['class']);
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

                // Set refresh token TTL
                if ($grant->getIdentifier() !== 'implicit') {
                    $grant->setRefreshTokenTTL(new DateInterval($grantConfig['refresh_token_ttl']));
                }

                // Enable grant type
                $authorizationServer->enableGrantType(
                    $grant,
                    new DateInterval($grantConfig['access_token_ttl'])
                );
            }
        });

        /*
         * Authorization code grant type
         */
        $this->app->singleton(AuthCodeGrant::class, function() {
            return new AuthCodeGrant(
                app(AuthCodeRepositoryInterface::class),
                app(RefreshTokenRepositoryInterface::class),
                new DateInterval(config('oauth2-server.grants.authorization_code.access_token_ttl'))
            );
        });

        /*
         * Implicit grant type
         */
        $this->app->singleton(ImplicitGrant::class, function() {
            return new ImplicitGrant(
                new DateInterval(config('oauth2-server.grants.implicit.access_token_ttl'))
            );
        });

        /*
         * RSA keypair for JWT signing
         */
        $this->app->singleton('oauth2-server.key.public', function() {
            return new CryptKey(config('oauth2-server.key.public'));
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
        });

        $this->app->singleton('oauth2-server.key.private', function() {
            return new CryptKey(config('oauth2-server.key.private'));
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
        });

        /*
         * Controller classname
         */
        $this->app->bind(
            'oauth2-server.controller',
            config('oauth2-server.controller')
        );
    }

    protected function loadRoutes()
    {
        if (!$this->app->routesAreCached()) {
            require dirname(__DIR__) . '/Http/routes.php';
        }

        return $this;
    }

    protected function loadMigrations()
    {
        $this->publishes([
            dirname(__DIR__) . '/migrations' => database_path('migrations')
        ], 'migrations');

        return $this;
    }

    protected function publishConfig()
    {
        $this->publishes([
            dirname(__DIR__) . '/config/oauth2-server.php' => config_path('oauth2-server.php'),
        ]);

        return $this;
    }

    protected function registerCommands()
    {
        if ($this->app->runningInConsole()) {
            $this->commands([
                CreateScopeCommand::class,
                CreateClientCommand::class,
                CreateUserCommand::class
            ]);
        }

        return $this;
    }

}


Push — master ( 7f1549...5746c2 )

Oauth2ServerServiceProvider::boot() A

Complexity

Size

Duplication

Code Coverage

Importance

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in code-execution context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1		<?php
2
3
4		namespace Mvdstam\Oauth2ServerLaravel\Providers;
5
6
7		use DateInterval;
8		use Illuminate\Support\ServiceProvider;
9		use League\OAuth2\Server\AuthorizationServer;
10		use League\OAuth2\Server\CryptKey;
11		use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
12		use League\OAuth2\Server\Entities\AuthCodeEntityInterface;
13		use League\OAuth2\Server\Entities\ClientEntityInterface;
14		use League\OAuth2\Server\Entities\RefreshTokenEntityInterface;
15		use League\OAuth2\Server\Entities\ScopeEntityInterface;
16		use League\OAuth2\Server\Entities\UserEntityInterface;
17		use League\OAuth2\Server\Grant\AuthCodeGrant;
18		use League\OAuth2\Server\Grant\GrantTypeInterface;
19		use League\OAuth2\Server\Grant\ImplicitGrant;
20		use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
21		use League\OAuth2\Server\Repositories\AuthCodeRepositoryInterface;
22		use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
23		use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
24		use League\OAuth2\Server\Repositories\ScopeRepositoryInterface;
25		use League\OAuth2\Server\Repositories\UserRepositoryInterface;
26		use League\OAuth2\Server\ResourceServer;
27		use Mvdstam\Oauth2ServerLaravel\Commands\CreateClientCommand;
28		use Mvdstam\Oauth2ServerLaravel\Commands\CreateScopeCommand;
29		use Mvdstam\Oauth2ServerLaravel\Commands\CreateUserCommand;
30		use Mvdstam\Oauth2ServerLaravel\Contracts\JWTFactoryInterface;
31		use Mvdstam\Oauth2ServerLaravel\Entities\AccessToken;
32		use Mvdstam\Oauth2ServerLaravel\Entities\AuthCode;
33		use Mvdstam\Oauth2ServerLaravel\Entities\Client;
34		use Mvdstam\Oauth2ServerLaravel\Entities\RefreshToken;
35		use Mvdstam\Oauth2ServerLaravel\Entities\Scope;
36		use Mvdstam\Oauth2ServerLaravel\Entities\User;
37		use Mvdstam\Oauth2ServerLaravel\Factories\JWTFactory;
38		use Mvdstam\Oauth2ServerLaravel\Repositories\AccessTokenRepository;
39		use Mvdstam\Oauth2ServerLaravel\Repositories\AuthCodeRepository;
40		use Mvdstam\Oauth2ServerLaravel\Repositories\ClientRepository;
41		use Mvdstam\Oauth2ServerLaravel\Repositories\RefreshTokenRepository;
42		use Mvdstam\Oauth2ServerLaravel\Repositories\ScopeRepository;
43		use Mvdstam\Oauth2ServerLaravel\Repositories\UserRepository;
44
45		class Oauth2ServerServiceProvider extends ServiceProvider
46		{
47
48	55	public function boot()
49		{
50		$this
51	55	->loadRoutes()
52	55	->loadMigrations()
53	55	->publishConfig()
54	55	->registerCommands();
55	55	}
56
57	55	public function register()
58		{
59		// Merge config
60	55	$this->mergeConfigFrom(
61	55	dirname(__DIR__).'/config/oauth2-server.php', 'oauth2-server'
62		);
63
64		/*
65		* Bind entities
66		*/
67	55	$this->app->bind(AccessTokenEntityInterface::class, AccessToken::class);
68	55	$this->app->bind(AuthCodeEntityInterface::class, AuthCode::class);
69	55	$this->app->bind(ClientEntityInterface::class, Client::class);
70	55	$this->app->bind(RefreshTokenEntityInterface::class, RefreshToken::class);
71	55	$this->app->bind(ScopeEntityInterface::class, Scope::class);
72	55	$this->app->bind(UserEntityInterface::class, User::class);
73
74		/*
75		* Bind repositories
76		*/
77	55	$this->app->bind(AccessTokenRepositoryInterface::class, AccessTokenRepository::class);
78	55	$this->app->bind(AuthCodeRepositoryInterface::class, AuthCodeRepository::class);
79	55	$this->app->bind(ClientRepositoryInterface::class, ClientRepository::class);
80	55	$this->app->bind(RefreshTokenRepositoryInterface::class, RefreshTokenRepository::class);
81	55	$this->app->bind(ScopeRepositoryInterface::class, ScopeRepository::class);
82	55	$this->app->bind(UserRepositoryInterface::class, UserRepository::class);
83
84		/*
85		* Bind miscellaneous classes
86		*/
87	55	$this->app->bind(JWTFactoryInterface::class, JWTFactory::class);
88
89		/*
90		* OAuth2 Resource server
91		*/
92		$this->app->singleton(ResourceServer::class, function() {
93	6	return new ResourceServer(
94	6	app(AccessTokenRepositoryInterface::class),
95	6	app('oauth2-server.key.public')
		1 ignored issue – show Security File Manipulation introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `app('oauth2-server.key.public')` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in src/Providers/Oauth2ServerServiceProvider.php on line 95 Used in path-write context ResourceServer::__construct() uses CryptKey::__construct() ($keyPath) in vendor/src/ResourceServer.php on line 50 CryptKey::__construct() uses CryptKey::saveKeyToFile() ($key) in vendor/src/CryptKey.php on line 36 CryptKey::saveKeyToFile() uses touch() ($filename) in vendor/src/CryptKey.php on line 62 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
96		);
97	55	});
98
99		/*
100		* OAuth2 Authorization server
101		*/
102		$this->app->singleton(AuthorizationServer::class, function() {
103	12	return new AuthorizationServer(
104	12	app(ClientRepositoryInterface::class),
105	12	app(AccessTokenRepositoryInterface::class),
106	12	app(ScopeRepositoryInterface::class),
107	12	app('oauth2-server.key.private'),
		1 ignored issue – show Security File Manipulation introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `app('oauth2-server.key.private')` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in src/Providers/Oauth2ServerServiceProvider.php on line 107 Used in path-write context AuthorizationServer::__construct() uses CryptKey::__construct() ($keyPath) in vendor/src/AuthorizationServer.php on line 92 CryptKey::__construct() uses CryptKey::saveKeyToFile() ($key) in vendor/src/CryptKey.php on line 36 CryptKey::saveKeyToFile() uses touch() ($filename) in vendor/src/CryptKey.php on line 62 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
108	12	app('oauth2-server.key.public')
		1 ignored issue – show Security File Manipulation introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `app('oauth2-server.key.public')` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in src/Providers/Oauth2ServerServiceProvider.php on line 108 Used in path-write context AuthorizationServer::__construct() uses CryptKey::__construct() ($keyPath) in vendor/src/AuthorizationServer.php on line 97 CryptKey::__construct() uses CryptKey::saveKeyToFile() ($key) in vendor/src/CryptKey.php on line 36 CryptKey::saveKeyToFile() uses touch() ($filename) in vendor/src/CryptKey.php on line 62 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
109		);
110	55	});
111
112		/*
113		* Add active grants to authorization server
114		*/
115		$this->app->resolving(AuthorizationServer::class, function(AuthorizationServer $authorizationServer) {
116	12	foreach(config('oauth2-server.grants') as $grantConfig) {
117	12	if (!(boolean) $grantConfig['enabled']) continue;
118
119		/** @var GrantTypeInterface $grant */
120	11	$grant = app($grantConfig['class']);
		0 ignored issues – show Security Code Execution introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `$grantConfig['class']` can contain request data and is used in code execution context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 257 config() returns tainted data, and `$grantConfig` is assigned in src/Providers/Oauth2ServerServiceProvider.php on line 116 Used in code-execution context app() uses Container::make() ($abstract) in vendor/src/Illuminate/Foundation/helpers.php on line 106 Container::make() uses Container::build() ($concrete) in vendor/src/Illuminate/Container/Container.php on line 644 Container::build() uses dynamic function name in vendor/src/Illuminate/Container/Container.php on line 746 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
121
122		// Set refresh token TTL
123	11	if ($grant->getIdentifier() !== 'implicit') {
124	10	$grant->setRefreshTokenTTL(new DateInterval($grantConfig['refresh_token_ttl']));
125		}
126
127		// Enable grant type
128	11	$authorizationServer->enableGrantType(
129		$grant,
130	11	new DateInterval($grantConfig['access_token_ttl'])
131		);
132		}
133	55	});
134
135		/*
136		* Authorization code grant type
137		*/
138		$this->app->singleton(AuthCodeGrant::class, function() {
139	1	return new AuthCodeGrant(
140	1	app(AuthCodeRepositoryInterface::class),
141	1	app(RefreshTokenRepositoryInterface::class),
142	1	new DateInterval(config('oauth2-server.grants.authorization_code.access_token_ttl'))
143		);
144	55	});
145
146		/*
147		* Implicit grant type
148		*/
149		$this->app->singleton(ImplicitGrant::class, function() {
150	1	return new ImplicitGrant(
151	1	new DateInterval(config('oauth2-server.grants.implicit.access_token_ttl'))
152		);
153	55	});
154
155		/*
156		* RSA keypair for JWT signing
157		*/
158		$this->app->singleton('oauth2-server.key.public', function() {
159	14	return new CryptKey(config('oauth2-server.key.public'));
		0 ignored issues – show Security File Manipulation introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `config('oauth2-server.key.public')` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 257 config() returns tainted data in src/Providers/Oauth2ServerServiceProvider.php on line 159 Used in path-write context CryptKey::__construct() uses CryptKey::saveKeyToFile() ($key) in vendor/src/CryptKey.php on line 36 CryptKey::saveKeyToFile() uses touch() ($filename) in vendor/src/CryptKey.php on line 62 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
160	55	});
161
162	55	$this->app->singleton('oauth2-server.key.private', function() {
163	12	return new CryptKey(config('oauth2-server.key.private'));
		0 ignored issues – show Security File Manipulation introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `config('oauth2-server.key.private')` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 257 config() returns tainted data in src/Providers/Oauth2ServerServiceProvider.php on line 163 Used in path-write context CryptKey::__construct() uses CryptKey::saveKeyToFile() ($key) in vendor/src/CryptKey.php on line 36 CryptKey::saveKeyToFile() uses touch() ($filename) in vendor/src/CryptKey.php on line 62 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
164	55	});
165
166		/*
167		* Controller classname
168		*/
169	55	$this->app->bind(
170	55	'oauth2-server.controller',
171	55	config('oauth2-server.controller')
172		);
173	55	}
174
175	55	protected function loadRoutes()
176		{
177	55	if (!$this->app->routesAreCached()) {
178	55	require dirname(__DIR__) . '/Http/routes.php';
179		}
180
181	55	return $this;
182		}
183
184	55	protected function loadMigrations()
185		{
186	55	$this->publishes([
187	55	dirname(__DIR__) . '/migrations' => database_path('migrations')
188	55	], 'migrations');
189
190	55	return $this;
191		}
192
193	55	protected function publishConfig()
194		{
195	55	$this->publishes([
196	55	dirname(__DIR__) . '/config/oauth2-server.php' => config_path('oauth2-server.php'),
197		]);
198
199	55	return $this;
200		}
201
202	55	protected function registerCommands()
203		{
204	55	if ($this->app->runningInConsole()) {
205	55	$this->commands([
206	55	CreateScopeCommand::class,
207		CreateClientCommand::class,
208		CreateUserCommand::class
209		]);
210		}
211
212	55	return $this;
213		}
214
215		}
216

mvdstam / oauth2-server-laravel

Push — master ( 7f1549...5746c2 )

Oauth2ServerServiceProvider::boot() A

Complexity

Size

Duplication

Code Coverage

Importance

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in code-execution context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

Duplication Side-by-Side

Filter issues like