Issues in Config.php (master) - Issues in master - overtrue/cuttle - Measure and Improve Code Quality continuously with Scrutinizer

Issues (16)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Config.php (6 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

/*
 * This file is part of the overtrue/cuttle.
 *
 * (c) overtrue <[email protected]>
 *
 * This source file is subject to the MIT license that is bundled
 * with this source code in the file LICENSE.
 */

namespace Overtrue\Cuttle;

use Closure;
use InvalidArgumentException;
use Monolog\Formatter\LineFormatter;
use Monolog\Handler\StreamHandler;

/**
 * Class Config.
 *
 * @author overtrue <[email protected]>
 */
class Config
{
    /**
     * @var array
     */
    protected $formatters = [];

    /**
     * @var array
     */
    protected $handlers = [];

    /**
     * @var array
     */
    protected $processors = [];

    /**
     * @var array
     */
    protected $channels = [];

    /**
     * @var string
     */
    protected $defaultChannel = '';

    /**
     * Config constructor.
     *
     * @param array $config
     */
    public function __construct(array $config)
    {
        $this->parse($config);
    }

    /**
     * @param string $name
     *
     * @return array
     */
    public function getChannel(string $name)
    {
        if (empty($this->channels[$name])) {
            throw new InvalidArgumentException("No channel named '{$name}' found.");
// Instead of
$x = "foo $bar $baz";

// Better use either
$x = "foo " . $bar . " " . $baz;
$x = sprintf("foo %s %s", $bar, $baz);
        }

        $this->channels[$name]['handlers'] = $this->getHandlers($this->channels[$name]['handlers']);
$a = "a";
$ab = "ab";
$abc = "abc";
        $this->channels[$name]['processors'] = $this->getProcessors($this->channels[$name]['processors']);

        return $this->channels[$name];
    }

    /**
     * @return string
     */
    public function getDefaultChannel()
    {
        if (!$this->defaultChannel) {
            throw new \LogicException('No default channel configured.');
        }

        return $this->defaultChannel;
    }

    /**
     * @param array $names
     *
     * @return array
     */
    protected function getFormatters(array $names)
    {
        return array_map(function ($name) {
            return $this->getFormatter($name);
        }, $names);
    }

    /**
     * @param array $names
     *
     * @return array
     */
    protected function getHandlers(array $names)
    {
        return array_map(function ($name) {
            return $this->getHandler($name);
        }, $names);
    }

    /**
     * @param array $names
     *
     * @return array
     */
    protected function getProcessors(array $names)
    {
        return array_map(function ($name) {
            return $this->getProcessor($name);
        }, $names);
    }

    /**
     * @param string $formatterId
     *
     * @return \Monolog\Formatter\FormatterInterface
     */
    protected function getFormatter(string $formatterId)
    {
        if ($this->formatters[$formatterId] instanceof Closure) {
            $this->formatters[$formatterId] = $this->formatters[$formatterId]();
        }

        return $this->formatters[$formatterId];
    }

    /**
     * @param string $handlerId
     *
     * @return \Monolog\Handler\HandlerInterface
     */
    protected function getHandler(string $handlerId)
    {
        if ($this->handlers[$handlerId] instanceof Closure) {
            $this->handlers[$handlerId] = $this->handlers[$handlerId]();
        }

        return $this->handlers[$handlerId];
    }

    /**
     * @param string $processorId
     *
     * @return \Monolog\Handler\HandlerInterface
     */
    protected function getProcessor(string $processorId)
    {
        if ($this->processors[$processorId] instanceof Closure) {
            $this->processors[$processorId] = $this->processors[$processorId]();
        }

        return $this->processors[$processorId];
    }

    /**
     * @param array $config
     */
    protected function parse(array $config)
    {
        $this->formatters = $this->formatFormatters($config['formatters'] ?? []);
$a = "a";
$ab = "ab";
$abc = "abc";
        $this->handlers = $this->formatHandlers($config['handlers'] ?? []);
$a = "a";
$ab = "ab";
$abc = "abc";
        $this->processors = $this->formatProcessors($config['processors'] ?? []);
$a = "a";
$ab = "ab";
$abc = "abc";
        $this->channels = $this->formatChannels($config['channels'] ?? []);
$a = "a";
$ab = "ab";
$abc = "abc";
        $this->defaultChannel = $config['default'];
    }

    /**
     * @param array $formatters
     *
     * @return array
     */
    protected function formatFormatters(array $formatters = [])
    {
        foreach ($formatters as $id => $option) {
            $class = $option['formatter'] ?? LineFormatter::class;
            unset($option['formatter']);

            $formatters[$id] = function () use ($class, $option) {
                return (new ClassResolver($class))->resolve($option);
            };
        }

        return $formatters;
    }

    /**
     * @param array $handlers
     *
     * @return array
     */
    protected function formatHandlers(array $handlers = [])
    {
        foreach ($handlers as $id => $option) {
            if (isset($option['formatter']) && !isset($this->formatters[$option['formatter']])) {
                throw new InvalidArgumentException(sprintf('Formatter %s not configured.', $option['formatter']));
            }

            foreach ($option['processors'] ?? [] as $processorId) {
                if (!isset($this->processors[$processorId])) {
                    throw new InvalidArgumentException(sprintf('Processor %s not configured.', $processorId));
                }
            }

            $class = $option['handler'] ?? StreamHandler::class;
            unset($option['handler']);

            $handlers[$id] = function () use ($class, $option) {
                $handler = (new ClassResolver($class))->resolve($option);

                if (!empty($option['formatter'])) {
                    $handler->setFormatter($this->getFormatter($option['formatter']));
                }

                if (!empty($option['processors'])) {
                    $handler->pushProcessor($this->getProcessors($option['processors']));
                }

                return $handler;
            };
        }

        return $handlers;
    }

    /**
     * @param array $processors
     *
     * @return array
     */
    protected function formatProcessors(array $processors = [])
    {
        foreach ($processors as $id => $option) {
            if (empty($option['processor'])) {
                continue;
            }

            $class = $option['processor'];
            unset($option['processor']);

            $processors[$id] = function () use ($class, $option) {
                return (new ClassResolver($class))->resolve($option);
            };
        }

        return $processors;
    }

    /**
     * @param array $channels
     *
     * @return array
     */
    protected function formatChannels(array $channels = [])
    {
        foreach ($channels as $id => $option) {
            foreach ($option['processors'] ?? [] as $processorId) {
                if (!isset($this->processors[$processorId])) {
                    throw new InvalidArgumentException(sprintf('Processor %s not configured.', $processorId));
                }
            }

            foreach ($option['handlers'] ?? [] as $handlerId) {
                if (!isset($this->handlers[$handlerId])) {
                    throw new InvalidArgumentException(sprintf('Handler %s not configured.', $handlerId));
                }
            }
            $channels[$id] = array_merge(['handlers' => [], 'processors' => []], $option);
        }

        return $channels;
    }
}


1		<?php
2
3		/*
4		* This file is part of the overtrue/cuttle.
5		*
6		* (c) overtrue <[email protected]>
7		*
8		* This source file is subject to the MIT license that is bundled
9		* with this source code in the file LICENSE.
10		*/
11
12		namespace Overtrue\Cuttle;
13
14		use Closure;
15		use InvalidArgumentException;
16		use Monolog\Formatter\LineFormatter;
17		use Monolog\Handler\StreamHandler;
18
19		/**
20		* Class Config.
21		*
22		* @author overtrue <[email protected]>
23		*/
24		class Config
25		{
26		/**
27		* @var array
28		*/
29		protected $formatters = [];
30
31		/**
32		* @var array
33		*/
34		protected $handlers = [];
35
36		/**
37		* @var array
38		*/
39		protected $processors = [];
40
41		/**
42		* @var array
43		*/
44		protected $channels = [];
45
46		/**
47		* @var string
48		*/
49		protected $defaultChannel = '';
50
51		/**
52		* Config constructor.
53		*
54		* @param array $config
55		*/
56		public function __construct(array $config)
57		{
58		$this->parse($config);
59		}
60
61		/**
62		* @param string $name
63		*
64		* @return array
65		*/
66		public function getChannel(string $name)
67		{
68		if (empty($this->channels[$name])) {
69		throw new InvalidArgumentException("No channel named '{$name}' found.");
		0 ignored issues – show Coding Style Best Practice introduced 2019-04-05 23:32 UTC by Report Bug Copy Issue Report Show Similar Issues like this As per coding-style, please use concatenation or `sprintf` for the variable `$name` instead of interpolation. It is generally a best practice as it is often more readable to use concatenation instead of interpolation for variables inside strings. // Instead of $x = "foo $bar $baz"; // Better use either $x = "foo " . $bar . " " . $baz; $x = sprintf("foo %s %s", $bar, $baz); Loading history...
70		}
71
72		$this->channels[$name]['handlers'] = $this->getHandlers($this->channels[$name]['handlers']);
		0 ignored issues – show Coding Style introduced 2019-04-05 23:32 UTC by Report Bug Copy Issue Report Show Similar Issues like this Equals sign not aligned with surrounding assignments; expected 3 spaces but found 1 space This check looks for multiple assignments in successive lines of code. It will report an issue if the operators are not in a straight line. To visualize $a = "a"; $ab = "ab"; $abc = "abc"; will produce issues in the first and second line, while this second example $a = "a"; $ab = "ab"; $abc = "abc"; will produce no issues. Loading history...
73		$this->channels[$name]['processors'] = $this->getProcessors($this->channels[$name]['processors']);
74
75		return $this->channels[$name];
76		}
77
78		/**
79		* @return string
80		*/
81		public function getDefaultChannel()
82		{
83		if (!$this->defaultChannel) {
84		throw new \LogicException('No default channel configured.');
85		}
86
87		return $this->defaultChannel;
88		}
89
90		/**
91		* @param array $names
92		*
93		* @return array
94		*/
95		protected function getFormatters(array $names)
96		{
97		return array_map(function ($name) {
98		return $this->getFormatter($name);
99		}, $names);
100		}
101
102		/**
103		* @param array $names
104		*
105		* @return array
106		*/
107		protected function getHandlers(array $names)
108		{
109		return array_map(function ($name) {
110		return $this->getHandler($name);
111		}, $names);
112		}
113
114		/**
115		* @param array $names
116		*
117		* @return array
118		*/
119		protected function getProcessors(array $names)
120		{
121		return array_map(function ($name) {
122		return $this->getProcessor($name);
123		}, $names);
124		}
125
126		/**
127		* @param string $formatterId
128		*
129		* @return \Monolog\Formatter\FormatterInterface
130		*/
131		protected function getFormatter(string $formatterId)
132		{
133		if ($this->formatters[$formatterId] instanceof Closure) {
134		$this->formatters[$formatterId] = $this->formatters[$formatterId]();
135		}
136
137		return $this->formatters[$formatterId];
138		}
139
140		/**
141		* @param string $handlerId
142		*
143		* @return \Monolog\Handler\HandlerInterface
144		*/
145		protected function getHandler(string $handlerId)
146		{
147		if ($this->handlers[$handlerId] instanceof Closure) {
148		$this->handlers[$handlerId] = $this->handlers[$handlerId]();
149		}
150
151		return $this->handlers[$handlerId];
152		}
153
154		/**
155		* @param string $processorId
156		*
157		* @return \Monolog\Handler\HandlerInterface
158		*/
159		protected function getProcessor(string $processorId)
160		{
161		if ($this->processors[$processorId] instanceof Closure) {
162		$this->processors[$processorId] = $this->processors[$processorId]();
163		}
164
165		return $this->processors[$processorId];
166		}
167
168		/**
169		* @param array $config
170		*/
171		protected function parse(array $config)
172		{
173		$this->formatters = $this->formatFormatters($config['formatters'] ?? []);
		0 ignored issues – show Coding Style introduced 2019-04-05 23:32 UTC by Report Bug Copy Issue Report Show Similar Issues like this Equals sign not aligned with surrounding assignments; expected 5 spaces but found 1 space This check looks for multiple assignments in successive lines of code. It will report an issue if the operators are not in a straight line. To visualize $a = "a"; $ab = "ab"; $abc = "abc"; will produce issues in the first and second line, while this second example $a = "a"; $ab = "ab"; $abc = "abc"; will produce no issues. Loading history...
174		$this->handlers = $this->formatHandlers($config['handlers'] ?? []);
		0 ignored issues – show Coding Style introduced 2019-04-05 23:32 UTC by Report Bug Copy Issue Report Show Similar Issues like this Equals sign not aligned with surrounding assignments; expected 7 spaces but found 1 space This check looks for multiple assignments in successive lines of code. It will report an issue if the operators are not in a straight line. To visualize $a = "a"; $ab = "ab"; $abc = "abc"; will produce issues in the first and second line, while this second example $a = "a"; $ab = "ab"; $abc = "abc"; will produce no issues. Loading history...
175		$this->processors = $this->formatProcessors($config['processors'] ?? []);
		0 ignored issues – show Coding Style introduced 2019-04-05 23:32 UTC by Report Bug Copy Issue Report Show Similar Issues like this Equals sign not aligned with surrounding assignments; expected 5 spaces but found 1 space This check looks for multiple assignments in successive lines of code. It will report an issue if the operators are not in a straight line. To visualize $a = "a"; $ab = "ab"; $abc = "abc"; will produce issues in the first and second line, while this second example $a = "a"; $ab = "ab"; $abc = "abc"; will produce no issues. Loading history...
176		$this->channels = $this->formatChannels($config['channels'] ?? []);
		0 ignored issues – show Coding Style introduced 2019-04-05 23:32 UTC by Report Bug Copy Issue Report Show Similar Issues like this Equals sign not aligned with surrounding assignments; expected 7 spaces but found 1 space This check looks for multiple assignments in successive lines of code. It will report an issue if the operators are not in a straight line. To visualize $a = "a"; $ab = "ab"; $abc = "abc"; will produce issues in the first and second line, while this second example $a = "a"; $ab = "ab"; $abc = "abc"; will produce no issues. Loading history...
177		$this->defaultChannel = $config['default'];
178		}
179
180		/**
181		* @param array $formatters
182		*
183		* @return array
184		*/
185	View Code Duplication	protected function formatFormatters(array $formatters = [])
186		{
187		foreach ($formatters as $id => $option) {
188		$class = $option['formatter'] ?? LineFormatter::class;
189		unset($option['formatter']);
190
191		$formatters[$id] = function () use ($class, $option) {
192		return (new ClassResolver($class))->resolve($option);
193		};
194		}
195
196		return $formatters;
197		}
198
199		/**
200		* @param array $handlers
201		*
202		* @return array
203		*/
204		protected function formatHandlers(array $handlers = [])
205		{
206		foreach ($handlers as $id => $option) {
207		if (isset($option['formatter']) && !isset($this->formatters[$option['formatter']])) {
208		throw new InvalidArgumentException(sprintf('Formatter %s not configured.', $option['formatter']));
209		}
210
211	View Code Duplication	foreach ($option['processors'] ?? [] as $processorId) {
212		if (!isset($this->processors[$processorId])) {
213		throw new InvalidArgumentException(sprintf('Processor %s not configured.', $processorId));
214		}
215		}
216
217		$class = $option['handler'] ?? StreamHandler::class;
218		unset($option['handler']);
219
220		$handlers[$id] = function () use ($class, $option) {
221		$handler = (new ClassResolver($class))->resolve($option);
222
223		if (!empty($option['formatter'])) {
224		$handler->setFormatter($this->getFormatter($option['formatter']));
225		}
226
227		if (!empty($option['processors'])) {
228		$handler->pushProcessor($this->getProcessors($option['processors']));
229		}
230
231		return $handler;
232		};
233		}
234
235		return $handlers;
236		}
237
238		/**
239		* @param array $processors
240		*
241		* @return array
242		*/
243	View Code Duplication	protected function formatProcessors(array $processors = [])
244		{
245		foreach ($processors as $id => $option) {
246		if (empty($option['processor'])) {
247		continue;
248		}
249
250		$class = $option['processor'];
251		unset($option['processor']);
252
253		$processors[$id] = function () use ($class, $option) {
254		return (new ClassResolver($class))->resolve($option);
255		};
256		}
257
258		return $processors;
259		}
260
261		/**
262		* @param array $channels
263		*
264		* @return array
265		*/
266		protected function formatChannels(array $channels = [])
267		{
268		foreach ($channels as $id => $option) {
269	View Code Duplication	foreach ($option['processors'] ?? [] as $processorId) {
270		if (!isset($this->processors[$processorId])) {
271		throw new InvalidArgumentException(sprintf('Processor %s not configured.', $processorId));
272		}
273		}
274
275	View Code Duplication	foreach ($option['handlers'] ?? [] as $handlerId) {
276		if (!isset($this->handlers[$handlerId])) {
277		throw new InvalidArgumentException(sprintf('Handler %s not configured.', $handlerId));
278		}
279		}
280		$channels[$id] = array_merge(['handlers' => [], 'processors' => []], $option);
281		}
282
283		return $channels;
284		}
285		}
286

overtrue / cuttle

Issues (16)

Security Analysis no request data

src/Config.php (6 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like