Issues (7)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/helpers.php (1 issue)

Labels
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 * Copyright (c) Padosoft.com 2020.
5
 */
6
7
//TODO: move some this functions into padosoft/support or padosoft/laravel-support
8
9
if (!function_exists('getFilenameWithoutExtension')) {
10
    function getFileNameWithoutExtension($filePath){
11
        if ($filePath == '' || is_dir($filePath) || \Illuminate\Support\Str::endsWith($filePath,'/')) {
12
            return '';
13
        }
14
15
        $info = pathinfo($filePath, PATHINFO_FILENAME);
16
17
        if ($info == '.' && PATHINFO_FILENAME == PATHINFO_DIRNAME) {
18
            return '';
19
        }
20
        return ($info !== null && $info != '') ? $info : '';
21
    }
22
}
23
if (!function_exists('getUploadedFilenameWithoutExtension')) {
24
25
    /**
26
     * Return the file name of uploaded file (without path and witout extension).
27
     * Ex.: /public/upload/pippo.txt ritorna 'pippo'
28
     * @param UploadedFile $uploadedFile
29
     * @return string
30
     */
31
    function getUploadedFilenameWithoutExtension(\Illuminate\Http\UploadedFile $uploadedFile)
32
    {
33
        return getFilenameWithoutExtension($uploadedFile->getClientOriginalName());
34
    }
35
}
36
if (!function_exists('currentRequestHasFiles')) {
37
    /**
38
     * Check if the current request has at least one file
39
     * @return bool
40
     */
41
    function currentRequestHasFiles(): bool
42
    {
43
        return requestHasFiles(request());
44
    }
45
}
46
47
if (!function_exists('requestHasFiles')) {
48
    /**
49
     * Check if the passed request has at least one file
50
     *
51
     * @param \Illuminate\Http\Request $request
52
     *
53
     * @return bool
54
     */
55
    function requestHasFiles(\Illuminate\Http\Request $request): bool
56
    {
57
        return ($request && $request->allFiles() && count($request->allFiles()) > 0);
58
    }
59
60
}
61
if (!function_exists('hasValidMimeType')) {
62
    /**
63
     * Check if uploaded File has a correct MimeType if specified.
64
     * If $arrMimeType is empty array return true.
65
     *
66
     * @param \Illuminate\Http\UploadedFile $uploadedFile
67
     * @param array $arrMimeType
68
     *
69
     * @return bool
70
     */
71
    function hasValidMimeType(\Illuminate\Http\UploadedFile $uploadedFile, array $arrMimeType): bool
72
    {
73
        return count($arrMimeType) > 0 ? in_array($uploadedFile->getMimeType(), $arrMimeType) : true;
74
    }
75
}
76
if (!function_exists('getCurrentRequestFileSafe')) {
77
    /**
78
     * Return File in Current Request if ok, otherwise return null
79
     *
80
     * @param string $uploadField
81
     *
82
     * @return array|null|\Illuminate\Http\UploadedFile|\Illuminate\Http\UploadedFile[]
83
     */
84
    function getCurrentRequestFileSafe(string $uploadField)
85
    {
86
        return getRequestFileSafe($uploadField, request());
87
    }
88
}
89
if (!function_exists('getRequestFileSafe')) {
90
    /**
91
     * Return File in passed request if ok, otherwise return null
92
     *
93
     * @param string $uploadField
94
     * @param \Illuminate\Http\Request $request
95
     *
96
     * @return array|null|\Illuminate\Http\UploadedFile|\Illuminate\Http\UploadedFile[]
97
     */
98
    function getRequestFileSafe(
99
        string $uploadField,
100
        \Illuminate\Http\Request $request
101
    ) {
102
        if (!$request) {
103
            return null;
104
        }
105
106
        $uploadedFile = $request->file($uploadField);
107
108
        //check type because request file method, may returns UploadedFile, array or null
109
        if (!is_a($uploadedFile, \Illuminate\Http\UploadedFile::class)) {
110
            return null;
111
        }
112
113
        return $uploadedFile;
114
    }
115
}
116
if (!function_exists('isValidUploadFile')) {
117
    /**
118
     * Check if uploaded File is valid and
119
     * has a valid Mime Type (only if $arrMimeType is not empty array).
120
     * Return true is all ok, otherwise return false.
121
     *
122
     * @param \Illuminate\Http\UploadedFile $uploadedFile
123
     * @param array $arrMimeType
124
     *
125
     * @return bool
126
     */
127
    function isValidUploadFile(\Illuminate\Http\UploadedFile $uploadedFile, array $arrMimeType = array()): bool
128
    {
129
        if (empty($uploadedFile) || !$uploadedFile->isValid()) {
130
            return false;
131
        }
132
133
        return hasValidMimeType($uploadedFile, $arrMimeType);
134
    }
135
}
136
if (!function_exists('hasValidUploadFile')) {
137
    /**
138
     * Check if uploaded File is valid and has a valid Mime Type.
139
     * Return true is all ok, otherwise return false.
140
     *
141
     * @param string $uploadField
142
     * @param array $arrMimeType
143
     * @param \Illuminate\Http\Request $request
144
     *
145
     * @return bool
146
     */
147
    function hasValidUploadFile(
148
        string $uploadField,
149
        \Illuminate\Http\Request $request,
150
        array $arrMimeType = array()
151
    ): bool {
152
        $uploadedFile = getRequestFileSafe($uploadField, $request);
153
154
        if (!is_a($uploadedFile, \Illuminate\Http\UploadedFile::class)) {
155
            return false;
156
        }
157
158
        return isValidUploadFile($uploadedFile, $arrMimeType);
0 ignored issues
show
It seems like $uploadedFile defined by getRequestFileSafe($uploadField, $request) on line 152 can also be of type array or null; however, isValidUploadFile() does only seem to accept object<Illuminate\Http\UploadedFile>, maybe add an additional type check?

If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check:

/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue.

Loading history...
159
    }
160
}
161
if (!function_exists('isValidCurrentRequestUploadFile')) {
162
    /**
163
     * Check if uploaded File in current request is valid and has a valid Mime Type.
164
     * Return true is all ok, otherwise return false.
165
     *
166
     * @param string $uploadField
167
     * @param array $arrMimeType
168
     *
169
     * @return bool
170
     */
171
    function isValidCurrentRequestUploadFile(string $uploadField, array $arrMimeType = array()): bool
172
    {
173
        return hasValidUploadFile($uploadField, request(), $arrMimeType);
174
    }
175
}
176
if (!function_exists('addFinalSlash')) {
177
    /**
178
     * If dir passed, check if finishes with '/' otherwise append a slash to path.
179
     * If wrong or empty string passed, return '/'.
180
     *
181
     * @param string $path
182
     *
183
     * @return string
184
     */
185
    function addFinalSlash(string $path): string
186
    {
187
        if ($path === null || $path == '') {
188
            return '/';
189
        }
190
191
        $quoted = preg_quote('/', '/');
192
        $path = preg_replace('/(?:' . $quoted . ')+$/', '', $path) . '/';
193
194
        return $path;
195
    }
196
}
197
if (!function_exists('removeStartSlash')) {
198
    /**
199
     * Remove start slash ('/') char in dir if starts with slash.
200
     *
201
     * @param string $directory
202
     *
203
     * @return string
204
     */
205
    function removeStartSlash($directory): string
206
    {
207
        if (\Illuminate\Support\Str::startsWith($directory, '/')) {
208
            $directory = substr($directory, 1);
209
        }
210
211
        return $directory;
212
    }
213
}
214
if (!function_exists('removeFinalSlash')) {
215
    /**
216
     * Remove final slash ('/') char in dir if ends with slash.
217
     *
218
     * @param $directory
219
     *
220
     * @return string
221
     */
222
    function removeFinalSlash($directory): string
223
    {
224
        if (\Illuminate\Support\Str::endsWith($directory, '/')) {
225
            $directory = substr($directory, 0, -1);
226
        }
227
228
        return $directory;
229
    }
230
}
231
if (!function_exists('njoin')) {
232
    /**
233
     * Joins a split file system path.
234
     *
235
     * @param array|string
236
     *
237
     * @return string
238
     * @see https://github.com/laradic/support/blob/master/src/Path.php
239
     */
240
    function joinPath(): string
241
    {
242
        $paths = func_get_args();
243
        if (func_num_args() === 1 && is_array($paths[0])) {
244
            $paths = $paths[0];
245
        }
246
        foreach ($paths as $key => &$argument) {
247
            if (is_array($argument)) {
248
                $argument = join($argument);
249
            }
250
            $argument = removeFinalSlash($argument);
251
            if ($key > 0) {
252
                $argument = removeStartSlash($argument);
253
            }
254
        }
255
256
        return implode(DIRECTORY_SEPARATOR, $paths);
257
    }
258
}
259
if (!function_exists('njoin')) {
260
    /**
261
     * Similar to the joinPath() method, but also normalize()'s the result
262
     *
263
     * @param string|array
264
     *
265
     * @return string
266
     * @see https://github.com/laradic/support/blob/master/src/Path.php
267
     */
268
    function njoin(): string
269
    {
270
        return canonicalize(joinPath(func_get_args()));
271
    }
272
}
273
if (!function_exists('collapseDotFolder')) {
274
    /**
275
     * Collapse dot folder '.', '..', if possible
276
     *
277
     * @param string $root
278
     * @param $part
279
     * @param $canonicalParts
280
     */
281
    function collapseDotFolder($root, $part, &$canonicalParts): void
282
    {
283
        if ('.' === $part) {
284
            return;
285
        }
286
        // Collapse ".." with the previous part, if one exists
287
        // Don't collapse ".." if the previous part is also ".."
288
        if ('..' === $part && count($canonicalParts) > 0
289
            && '..' !== $canonicalParts[count($canonicalParts) - 1]
290
        ) {
291
            array_pop($canonicalParts);
292
293
            return;
294
        }
295
        // Only add ".." prefixes for relative paths
296
        if ('..' !== $part || '' === $root) {
297
            $canonicalParts[] = $part;
298
        }
299
    }
300
}
301
if (!function_exists('splitDir')) {
302
    /**
303
     * Splits a part into its root directory and the remainder.
304
     *
305
     * If the path has no root directory, an empty root directory will be
306
     * returned.
307
     *
308
     * If the root directory is a Windows style partition, the resulting root
309
     * will always contain a trailing slash.
310
     *
311
     * list ($root, $path) = DirHelpersplit("C:/webmozart")
312
     * // => array("C:/", "webmozart")
313
     *
314
     * list ($root, $path) = DirHelpersplit("C:")
315
     * // => array("C:/", "")
316
     *
317
     * @param string $path The canonical path to split
318
     *
319
     * @return string[] An array with the root directory and the remaining relative
320
     *               path
321
     * @see https://github.com/laradic/support/blob/master/src/Path.php
322
     */
323
    function splitDir($path)
324
    {
325
        if ('' === $path) {
326
            return ['', ''];
327
        }
328
        $root = '';
329
        $length = strlen($path);
330
        // Remove and remember root directory
331
        if ('/' === $path[0]) {
332
            $root = '/';
333
            $path = $length > 1 ? substr($path, 1) : '';
334
        } elseif ($length > 1 && ctype_alpha($path[0]) && ':' === $path[1]) {
335
            if (2 === $length) {
336
                // Windows special case: "C:"
337
                $root = $path . '/';
338
                $path = '';
339
            } elseif ('/' === $path[2]) {
340
                // Windows normal case: "C:/"..
341
                $root = substr($path, 0, 3);
342
                $path = $length > 3 ? substr($path, 3) : '';
343
            }
344
        }
345
        return [$root, $path];
346
    }
347
}
348
if (!function_exists('canonicalize')) {
349
    /**
350
     * Canonicalizes the given path.
351
     *
352
     * During normalization, all slashes are replaced by forward slashes ("/").
353
     * Furthermore, all "." and ".." segments are removed as far as possible.
354
     * ".." segments at the beginning of relative paths are not removed.
355
     *
356
     * ```php
357
     * echo DirHelper::canonicalize("\webmozart\puli\..\css\style.css");
358
     * // => /webmozart/style.css
359
     *
360
     * echo DirHelper::canonicalize("../css/./style.css");
361
     * // => ../css/style.css
362
     * ```
363
     *
364
     * This method is able to deal with both UNIX and Windows paths.
365
     *
366
     * @param string $path A path string
367
     *
368
     * @return string The canonical path
369
     * @see https://github.com/laradic/support/blob/master/src/Path.php
370
     */
371
    function canonicalize($path): string
372
    {
373
        $path = (string)$path;
374
        if ('' === $path) {
375
            return '';
376
        }
377
        $path = str_replace('\\', '/', $path);
378
        list ($root, $path) = splitDir($path);
379
        $parts = array_filter(explode('/', $path), 'strlen');
380
        $canonicalParts = [];
381
        // Collapse dot folder ., .., i f possible
382
        foreach ($parts as $part) {
383
            collapseDotFolder($root, $part, $canonicalParts);
384
        }
385
386
        // Add the root directory again
387
        return $root . implode('/', $canonicalParts);
388
    }
389
}
390