Oauth2ServerServiceProvider::boot() - Code Metrics - Inspection of "First commit" - mvdstam/oauth2-server-laravel - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( 9f72d7...ceb215 )

by Max van der

created 2017-03-23 14:26 UTC

Oauth2ServerServiceProvider::boot() B

↳ Parent: Oauth2ServerServiceProvider

Complexity

Conditions	2
Paths	2

Size

Total Lines	29
Code Lines	9

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	9
CRAP Score	2

Importance

Changes

Metric	Value
dl	0
loc	29
ccs	9
cts	9
cp	1
rs	8.8571
c	0
b	0
f	0
cc	2
eloc	9
nc	2
nop	0
crap	2

<?php


namespace Mvdstam\Oauth2ServerLaravel\Providers;


use DateInterval;
use Illuminate\Support\ServiceProvider;
use League\OAuth2\Server\AuthorizationServer;
use League\OAuth2\Server\CryptKey;
use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
use League\OAuth2\Server\Entities\AuthCodeEntityInterface;
use League\OAuth2\Server\Entities\ClientEntityInterface;
use League\OAuth2\Server\Entities\RefreshTokenEntityInterface;
use League\OAuth2\Server\Entities\ScopeEntityInterface;
use League\OAuth2\Server\Entities\UserEntityInterface;
use League\OAuth2\Server\Grant\AuthCodeGrant;
use League\OAuth2\Server\Grant\GrantTypeInterface;
use League\OAuth2\Server\Grant\ImplicitGrant;
use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
use League\OAuth2\Server\Repositories\AuthCodeRepositoryInterface;
use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
use League\OAuth2\Server\Repositories\ScopeRepositoryInterface;
use League\OAuth2\Server\Repositories\UserRepositoryInterface;
use League\OAuth2\Server\ResourceServer;
use Mvdstam\Oauth2ServerLaravel\Commands\CreateClientCommand;
use Mvdstam\Oauth2ServerLaravel\Commands\CreateScopeCommand;
use Mvdstam\Oauth2ServerLaravel\Contracts\JWTFactoryInterface;
use Mvdstam\Oauth2ServerLaravel\Entities\AccessToken;
use Mvdstam\Oauth2ServerLaravel\Entities\AuthCode;
use Mvdstam\Oauth2ServerLaravel\Entities\Client;
use Mvdstam\Oauth2ServerLaravel\Entities\RefreshToken;
use Mvdstam\Oauth2ServerLaravel\Entities\Scope;
use Mvdstam\Oauth2ServerLaravel\Entities\User;
use Mvdstam\Oauth2ServerLaravel\Factories\JWTFactory;
use Mvdstam\Oauth2ServerLaravel\Repositories\AccessTokenRepository;
use Mvdstam\Oauth2ServerLaravel\Repositories\AuthCodeRepository;
use Mvdstam\Oauth2ServerLaravel\Repositories\ClientRepository;
use Mvdstam\Oauth2ServerLaravel\Repositories\RefreshTokenRepository;
use Mvdstam\Oauth2ServerLaravel\Repositories\ScopeRepository;
use Mvdstam\Oauth2ServerLaravel\Repositories\UserRepository;

class Oauth2ServerServiceProvider extends ServiceProvider
{

    public function boot()
    {
        /*
         * Load routes
         */
        $this->loadRoutesFrom(dirname(__DIR__).'/Http/routes.php');

        /*
         * Load migrations
         */
        $this->loadMigrationsFrom(dirname(__DIR__).'/migrations');

        /*
         * Publish config
         */
        $this->publishes([
            dirname(__DIR__).'/config/oauth2-server.php' => config_path('oauth2-server.php'),
        ]);

        /*
         * Register commands
         */
        if ($this->app->runningInConsole()) {
            $this->commands([
                CreateScopeCommand::class,
                CreateClientCommand::class
            ]);
        }
    }

    public function register()
    {
        // Merge config
        $this->mergeConfigFrom(
            dirname(__DIR__).'/config/oauth2-server.php', 'oauth2-server'
        );

        /*
         * Bind entities
         */
        $this->app->bind(AccessTokenEntityInterface::class, AccessToken::class);
        $this->app->bind(AuthCodeEntityInterface::class, AuthCode::class);
        $this->app->bind(ClientEntityInterface::class, Client::class);
        $this->app->bind(RefreshTokenEntityInterface::class, RefreshToken::class);
        $this->app->bind(ScopeEntityInterface::class, Scope::class);
        $this->app->bind(UserEntityInterface::class, User::class);

        /*
         * Bind repositories
         */
        $this->app->bind(AccessTokenRepositoryInterface::class, AccessTokenRepository::class);
        $this->app->bind(AuthCodeRepositoryInterface::class, AuthCodeRepository::class);
        $this->app->bind(ClientRepositoryInterface::class, ClientRepository::class);
        $this->app->bind(RefreshTokenRepositoryInterface::class, RefreshTokenRepository::class);
        $this->app->bind(ScopeRepositoryInterface::class, ScopeRepository::class);
        $this->app->bind(UserRepositoryInterface::class, UserRepository::class);

        /*
         * Bind miscellaneous classes
         */
        $this->app->bind(JWTFactoryInterface::class, JWTFactory::class);

        /*
         * OAuth2 Resource server
         */
        $this->app->singleton(ResourceServer::class, function() {
            return new ResourceServer(
                app(AccessTokenRepositoryInterface::class),
                app('oauth2-server.key.public')
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
            );
        });

        /*
         * OAuth2 Authorization server
         */
        $this->app->singleton(AuthorizationServer::class, function() {
            return new AuthorizationServer(
                app(ClientRepositoryInterface::class),
                app(AccessTokenRepositoryInterface::class),
                app(ScopeRepositoryInterface::class),
                app('oauth2-server.key.private'),
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
                app('oauth2-server.key.public')
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
            );
        });

        /*
         * Add active grants to authorization server
         */
        $this->app->resolving(AuthorizationServer::class, function(AuthorizationServer $authorizationServer) {
            foreach(config('oauth2-server.grants') as $grantConfig) {
                if (!(boolean) $grantConfig['enabled']) continue;

                /** @var GrantTypeInterface $grant */
                $grant = app($grantConfig['class']);
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

                // Set refresh token TTL
                if ($grant->getIdentifier() !== 'implicit') {
                    $grant->setRefreshTokenTTL(new DateInterval($grantConfig['refresh_token_ttl']));
                }

                // Enable grant type
                $authorizationServer->enableGrantType(
                    $grant,
                    new DateInterval($grantConfig['access_token_ttl'])
                );
            }
        });

        /*
         * Authorization code grant type
         */
        $this->app->singleton(AuthCodeGrant::class, function() {
            return new AuthCodeGrant(
                app(AuthCodeRepositoryInterface::class),
                app(RefreshTokenRepositoryInterface::class),
                new DateInterval(config('oauth2-server.grants.authorization_code.access_token_ttl'))
            );
        });

        /*
         * Implicit grant type
         */
        $this->app->singleton(ImplicitGrant::class, function() {
            return new ImplicitGrant(
                new DateInterval(config('oauth2-server.grants.implicit.access_token_ttl'))
            );
        });

        /*
         * RSA keypair for JWT signing
         */
        $this->app->singleton('oauth2-server.key.public', function() {
            return new CryptKey(config('oauth2-server.key.public'));
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
        });

        $this->app->singleton('oauth2-server.key.private', function() {
            return new CryptKey(config('oauth2-server.key.private'));
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
        });
    }

}


1		<?php
2
3
4		namespace Mvdstam\Oauth2ServerLaravel\Providers;
5
6
7		use DateInterval;
8		use Illuminate\Support\ServiceProvider;
9		use League\OAuth2\Server\AuthorizationServer;
10		use League\OAuth2\Server\CryptKey;
11		use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
12		use League\OAuth2\Server\Entities\AuthCodeEntityInterface;
13		use League\OAuth2\Server\Entities\ClientEntityInterface;
14		use League\OAuth2\Server\Entities\RefreshTokenEntityInterface;
15		use League\OAuth2\Server\Entities\ScopeEntityInterface;
16		use League\OAuth2\Server\Entities\UserEntityInterface;
17		use League\OAuth2\Server\Grant\AuthCodeGrant;
18		use League\OAuth2\Server\Grant\GrantTypeInterface;
19		use League\OAuth2\Server\Grant\ImplicitGrant;
20		use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface;
21		use League\OAuth2\Server\Repositories\AuthCodeRepositoryInterface;
22		use League\OAuth2\Server\Repositories\ClientRepositoryInterface;
23		use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
24		use League\OAuth2\Server\Repositories\ScopeRepositoryInterface;
25		use League\OAuth2\Server\Repositories\UserRepositoryInterface;
26		use League\OAuth2\Server\ResourceServer;
27		use Mvdstam\Oauth2ServerLaravel\Commands\CreateClientCommand;
28		use Mvdstam\Oauth2ServerLaravel\Commands\CreateScopeCommand;
29		use Mvdstam\Oauth2ServerLaravel\Contracts\JWTFactoryInterface;
30		use Mvdstam\Oauth2ServerLaravel\Entities\AccessToken;
31		use Mvdstam\Oauth2ServerLaravel\Entities\AuthCode;
32		use Mvdstam\Oauth2ServerLaravel\Entities\Client;
33		use Mvdstam\Oauth2ServerLaravel\Entities\RefreshToken;
34		use Mvdstam\Oauth2ServerLaravel\Entities\Scope;
35		use Mvdstam\Oauth2ServerLaravel\Entities\User;
36		use Mvdstam\Oauth2ServerLaravel\Factories\JWTFactory;
37		use Mvdstam\Oauth2ServerLaravel\Repositories\AccessTokenRepository;
38		use Mvdstam\Oauth2ServerLaravel\Repositories\AuthCodeRepository;
39		use Mvdstam\Oauth2ServerLaravel\Repositories\ClientRepository;
40		use Mvdstam\Oauth2ServerLaravel\Repositories\RefreshTokenRepository;
41		use Mvdstam\Oauth2ServerLaravel\Repositories\ScopeRepository;
42		use Mvdstam\Oauth2ServerLaravel\Repositories\UserRepository;
43
44		class Oauth2ServerServiceProvider extends ServiceProvider
45		{
46
47	55	public function boot()
48		{
49		/*
50		* Load routes
51		*/
52	55	$this->loadRoutesFrom(dirname(__DIR__).'/Http/routes.php');
53
54		/*
55		* Load migrations
56		*/
57	55	$this->loadMigrationsFrom(dirname(__DIR__).'/migrations');
58
59		/*
60		* Publish config
61		*/
62	55	$this->publishes([
63	55	dirname(__DIR__).'/config/oauth2-server.php' => config_path('oauth2-server.php'),
64		]);
65
66		/*
67		* Register commands
68		*/
69	55	if ($this->app->runningInConsole()) {
70	55	$this->commands([
71	55	CreateScopeCommand::class,
72		CreateClientCommand::class
73		]);
74		}
75	55	}
76
77	55	public function register()
78		{
79		// Merge config
80	55	$this->mergeConfigFrom(
81	55	dirname(__DIR__).'/config/oauth2-server.php', 'oauth2-server'
82		);
83
84		/*
85		* Bind entities
86		*/
87	55	$this->app->bind(AccessTokenEntityInterface::class, AccessToken::class);
88	55	$this->app->bind(AuthCodeEntityInterface::class, AuthCode::class);
89	55	$this->app->bind(ClientEntityInterface::class, Client::class);
90	55	$this->app->bind(RefreshTokenEntityInterface::class, RefreshToken::class);
91	55	$this->app->bind(ScopeEntityInterface::class, Scope::class);
92	55	$this->app->bind(UserEntityInterface::class, User::class);
93
94		/*
95		* Bind repositories
96		*/
97	55	$this->app->bind(AccessTokenRepositoryInterface::class, AccessTokenRepository::class);
98	55	$this->app->bind(AuthCodeRepositoryInterface::class, AuthCodeRepository::class);
99	55	$this->app->bind(ClientRepositoryInterface::class, ClientRepository::class);
100	55	$this->app->bind(RefreshTokenRepositoryInterface::class, RefreshTokenRepository::class);
101	55	$this->app->bind(ScopeRepositoryInterface::class, ScopeRepository::class);
102	55	$this->app->bind(UserRepositoryInterface::class, UserRepository::class);
103
104		/*
105		* Bind miscellaneous classes
106		*/
107	55	$this->app->bind(JWTFactoryInterface::class, JWTFactory::class);
108
109		/*
110		* OAuth2 Resource server
111		*/
112		$this->app->singleton(ResourceServer::class, function() {
113	6	return new ResourceServer(
114	6	app(AccessTokenRepositoryInterface::class),
115	6	app('oauth2-server.key.public')
		1 ignored issue – show Security File Manipulation introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `app('oauth2-server.key.public')` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in src/Providers/Oauth2ServerServiceProvider.php on line 115 Used in path-write context ResourceServer::__construct() uses CryptKey::__construct() ($keyPath) in vendor/src/ResourceServer.php on line 50 CryptKey::__construct() uses CryptKey::saveKeyToFile() ($key) in vendor/src/CryptKey.php on line 36 CryptKey::saveKeyToFile() uses touch() ($filename) in vendor/src/CryptKey.php on line 62 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
116		);
117	55	});
118
119		/*
120		* OAuth2 Authorization server
121		*/
122		$this->app->singleton(AuthorizationServer::class, function() {
123	12	return new AuthorizationServer(
124	12	app(ClientRepositoryInterface::class),
125	12	app(AccessTokenRepositoryInterface::class),
126	12	app(ScopeRepositoryInterface::class),
127	12	app('oauth2-server.key.private'),
		1 ignored issue – show Security File Manipulation introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `app('oauth2-server.key.private')` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in src/Providers/Oauth2ServerServiceProvider.php on line 127 Used in path-write context AuthorizationServer::__construct() uses CryptKey::__construct() ($keyPath) in vendor/src/AuthorizationServer.php on line 92 CryptKey::__construct() uses CryptKey::saveKeyToFile() ($key) in vendor/src/CryptKey.php on line 36 CryptKey::saveKeyToFile() uses touch() ($filename) in vendor/src/CryptKey.php on line 62 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
128	12	app('oauth2-server.key.public')
		1 ignored issue – show Security File Manipulation introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `app('oauth2-server.key.public')` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in src/Providers/Oauth2ServerServiceProvider.php on line 128 Used in path-write context AuthorizationServer::__construct() uses CryptKey::__construct() ($keyPath) in vendor/src/AuthorizationServer.php on line 97 CryptKey::__construct() uses CryptKey::saveKeyToFile() ($key) in vendor/src/CryptKey.php on line 36 CryptKey::saveKeyToFile() uses touch() ($filename) in vendor/src/CryptKey.php on line 62 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
129		);
130	55	});
131
132		/*
133		* Add active grants to authorization server
134		*/
135		$this->app->resolving(AuthorizationServer::class, function(AuthorizationServer $authorizationServer) {
136	12	foreach(config('oauth2-server.grants') as $grantConfig) {
137	12	if (!(boolean) $grantConfig['enabled']) continue;
138
139		/** @var GrantTypeInterface $grant */
140	11	$grant = app($grantConfig['class']);
		0 ignored issues – show Security Code Execution introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `$grantConfig['class']` can contain request data and is used in code execution context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 257 config() returns tainted data, and `$grantConfig` is assigned in src/Providers/Oauth2ServerServiceProvider.php on line 136 Used in code-execution context app() uses Container::make() ($abstract) in vendor/src/Illuminate/Foundation/helpers.php on line 106 Container::make() uses Container::build() ($concrete) in vendor/src/Illuminate/Container/Container.php on line 644 Container::build() uses dynamic function name in vendor/src/Illuminate/Container/Container.php on line 746 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
141
142		// Set refresh token TTL
143	11	if ($grant->getIdentifier() !== 'implicit') {
144	10	$grant->setRefreshTokenTTL(new DateInterval($grantConfig['refresh_token_ttl']));
145		}
146
147		// Enable grant type
148	11	$authorizationServer->enableGrantType(
149		$grant,
150	11	new DateInterval($grantConfig['access_token_ttl'])
151		);
152		}
153	55	});
154
155		/*
156		* Authorization code grant type
157		*/
158		$this->app->singleton(AuthCodeGrant::class, function() {
159	1	return new AuthCodeGrant(
160	1	app(AuthCodeRepositoryInterface::class),
161	1	app(RefreshTokenRepositoryInterface::class),
162	1	new DateInterval(config('oauth2-server.grants.authorization_code.access_token_ttl'))
163		);
164	55	});
165
166		/*
167		* Implicit grant type
168		*/
169		$this->app->singleton(ImplicitGrant::class, function() {
170	1	return new ImplicitGrant(
171	1	new DateInterval(config('oauth2-server.grants.implicit.access_token_ttl'))
172		);
173	55	});
174
175		/*
176		* RSA keypair for JWT signing
177		*/
178		$this->app->singleton('oauth2-server.key.public', function() {
179	14	return new CryptKey(config('oauth2-server.key.public'));
		0 ignored issues – show Security File Manipulation introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `config('oauth2-server.key.public')` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 257 config() returns tainted data in src/Providers/Oauth2ServerServiceProvider.php on line 179 Used in path-write context CryptKey::__construct() uses CryptKey::saveKeyToFile() ($key) in vendor/src/CryptKey.php on line 36 CryptKey::saveKeyToFile() uses touch() ($filename) in vendor/src/CryptKey.php on line 62 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
180	55	});
181
182	55	$this->app->singleton('oauth2-server.key.private', function() {
183	12	return new CryptKey(config('oauth2-server.key.private'));
		0 ignored issues – show Security File Manipulation introduced 2017-03-23 14:33 UTC by Report Bug Copy Issue Report `config('oauth2-server.key.private')` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 1 path for user data to reach this point Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1936 `\Illuminate\Http\Request::create($url, 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 20 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 346 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 635 Container::make() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 106 app() returns tainted data in vendor/src/Illuminate/Foundation/helpers.php on line 257 config() returns tainted data in src/Providers/Oauth2ServerServiceProvider.php on line 183 Used in path-write context CryptKey::__construct() uses CryptKey::saveKeyToFile() ($key) in vendor/src/CryptKey.php on line 36 CryptKey::saveKeyToFile() uses touch() ($filename) in vendor/src/CryptKey.php on line 62 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
184	55	});
185	55	}
186
187		}
188

mvdstam / oauth2-server-laravel

Push — master ( 9f72d7...ceb215 )

Oauth2ServerServiceProvider::boot() B

Complexity

Size

Duplication

Code Coverage

Importance

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in code-execution context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

1 path for user data to reach this point

Used in path-write context

General Strategies to prevent injection

Duplication Side-by-Side

Filter issues like