Issues (50)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Agent/AgentTrait.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * For the full copyright and license information, please view the LICENSE.md
4
 * file that was distributed with this source code.
5
 */
6
7
namespace Notamedia\ConsoleJedi\Agent;
8
9
use Bitrix\Main\Type\DateTime;
10
11
/**
12
 * Trait helps make an agent from any class.
13
 *
14
 * Algorithm of agent execution:
15
 * 1. Bitrix launches static method `ClassName::agent()->%method%()`. Your agents should be registered through
16
 * `\Notamedia\ConsoleJedi\Agent\AgentTask` in the same format: `\Vendor\Package\ClassName::agent()->%method%();`.
17
 * All arguments from this method will be duplicated to the object constructor:
18
 * `agent($arg1, …, $arg2)` → `__construct($arg1, …, $arg2)`.
19
 * 2. Create an object of agent class.
20
 * 3. Call execution method in agent class.
21
 *
22
 * @author Nik Samokhvalov <[email protected]>
23
 */
24
trait AgentTrait
25
{
26
    /**
27
     * @var array Arguments for `__constructor`.
28
     */
29
    protected static $constructorArgs;
30
    /**
31
     * @var bool
32
     */
33
    protected static $agentMode = false;
34
35
    /**
36
     * Agent constructor.
37
     *
38
     * All arguments from `agent()` method should be duplicated in the constructor, for example:
39
     * ```
40
     * agent($arg1, …, $arg2)` → `__construct($arg1, …, $arg2)
41
     * ```
42
     */
43
    public function __construct()
44
    {
45
    }
46
47
    /**
48
     * Factory method for create object of agent class.
49
     *
50
     * Bitrix calls this method to run agent. Your agents should be registered through
51
     * `\Notamedia\ConsoleJedi\Agent\AgentTask`. All arguments from this method should
52
     * be duplicated in the object constructor:
53
     *
54
     * `agent($arg1, …, $arg2)` → `__construct($arg1, …, $arg2)`.
55
     *
56
     * @return static
57
     *
58
     * @see AgentTask
59
     */
60
    public static function agent()
61
    {
62
        static::$constructorArgs = func_get_args();
63
        static::$agentMode = true;
64
65
        $reflection = new \ReflectionClass(get_called_class());
66
67
        return $reflection->newInstanceArgs(static::$constructorArgs);
68
    }
69
70
    /**
71
     * Ping from the agent to inform that it still works correctly. Use this method if your agent
72
     * works more 10 minutes, otherwise Bitrix will be consider your agent as non-working.
73
     *
74
     * Usage:
75
     * ```php
76
     * public function executeAgent($param1, $param2)
77
     * {
78
     *      // start a heavy (big) cycle
79
     *
80
     *          $this->pingAgent(20, ['executeAgent' => [$param1, $param2]]);
81
     *
82
     *      // end of cycle
83
     * }
84
     * ```
85
     *
86
     * @param int $interval The time in minutes after which the agent will be considered non-working.
87
     * @param array $callChain Array with the call any methods from Agent class.
88
     */
89
    protected function pingAgent($interval, array $callChain)
90
    {
91
        if (!$this->isAgentMode()) {
92
            return;
93
        }
94
95
        $name = $this->getAgentName($callChain);
96
        $model = new \CAgent();
97
98
        $rsAgent = $model->GetList([], ['NAME' => $name]);
99
100
        if ($agent = $rsAgent->Fetch()) {
101
            $dateCheck = DateTime::createFromTimestamp(time() + $interval * 60);
102
103
            $pingResult = $model->Update($agent['ID'], ['DATE_CHECK' => $dateCheck->toString()]);
104
105
            if (!$pingResult) {
0 ignored issues
show
This if statement is empty and can be removed.

This check looks for the bodies of if statements that have no statements or where all statements have been commented out. This may be the result of changes for debugging or the code may simply be obsolete.

These if bodies can be removed. If you have an empty if but statements in the else branch, consider inverting the condition.

if (rand(1, 6) > 3) {
//print "Check failed";
} else {
    print "Check succeeded";
}

could be turned into

if (rand(1, 6) <= 3) {
    print "Check succeeded";
}

This is much more concise to read.

Loading history...
106
                // @todo warning
107
            }
108
        } else {
0 ignored issues
show
This else statement is empty and can be removed.

This check looks for the else branches of if statements that have no statements or where all statements have been commented out. This may be the result of changes for debugging or the code may simply be obsolete.

These else branches can be removed.

if (rand(1, 6) > 3) {
print "Check failed";
} else {
    //print "Check succeeded";
}

could be turned into

if (rand(1, 6) > 3) {
    print "Check failed";
}

This is much more concise to read.

Loading history...
109
            // @todo warning
110
        }
111
    }
112
113
    /**
114
     * Gets agent name. Use to return this name from the executed method of agent.
115
     *
116
     * Usage:
117
     * ```php
118
     * public function executeAgent($param1, $param2)
119
     * {
120
     *      // main logic
121
     *
122
     *      return $this->getAgentName(['executeAgent' => [$param1, $param2]]);
123
     * }
124
     * ```
125
     *
126
     * @param array $callChain Array with the call any methods from Agent class.
127
     *
128
     * @return string
129
     */
130
    public function getAgentName(array $callChain)
131
    {
132
        return AgentHelper::createName(get_called_class(), static::$constructorArgs, $callChain);
133
    }
134
135
    /**
136
     * Checks that object running as agent. Object is considered an agent
137
     * if it is created using the static method `agent()`.
138
     *
139
     * @return bool
140
     */
141
    public function isAgentMode()
142
    {
143
        return static::$agentMode;
144
    }
145
}
146