This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * File copied from Waavi/Sanitizer https://github.com/waavi/sanitizer |
||
4 | * Sanitization functionality to be customized within this project before a 1.0 release. |
||
5 | */ |
||
6 | |||
7 | namespace PerfectOblivion\Valid\Sanitizer; |
||
8 | |||
9 | use Closure; |
||
10 | use Illuminate\Support\Arr; |
||
11 | use InvalidArgumentException; |
||
12 | use Illuminate\Validation\ValidationRuleParser; |
||
13 | |||
14 | class Sanitizer |
||
15 | { |
||
16 | /** @var array */ |
||
17 | protected $data; |
||
18 | |||
19 | /** @var array */ |
||
20 | protected $rules; |
||
21 | |||
22 | /** @var array */ |
||
23 | protected $filters = [ |
||
24 | 'capitalize' => Filters\Capitalize::class, |
||
25 | 'cast' => Filters\Cast::class, |
||
26 | 'escape' => Filters\EscapeHTML::class, |
||
27 | 'format_date' => Filters\FormatDate::class, |
||
28 | 'lowercase' => Filters\Lowercase::class, |
||
29 | 'uppercase' => Filters\Uppercase::class, |
||
30 | 'trim' => Filters\Trim::class, |
||
31 | 'strip_tags' => Filters\StripTags::class, |
||
32 | 'digit' => Filters\Digit::class, |
||
33 | ]; |
||
34 | |||
35 | /** |
||
36 | * Create a new sanitizer instance. |
||
37 | * |
||
38 | * @param array $data |
||
39 | * @param array $rules Rules to be applied to each data attribute |
||
40 | * @param array $filters Available filters for this sanitizer |
||
0 ignored issues
–
show
|
|||
41 | */ |
||
42 | public function __construct(array $data, array $rules, array $customFilters = []) |
||
43 | { |
||
44 | $this->data = $data; |
||
45 | $this->rules = $this->parseRulesArray($rules); |
||
46 | $this->filters = array_merge($this->filters, $customFilters); |
||
47 | } |
||
48 | |||
49 | /** |
||
50 | * Parse a rules array. |
||
51 | * |
||
52 | * @param array $rules |
||
53 | * |
||
54 | * @return array |
||
55 | */ |
||
56 | protected function parseRulesArray(array $rules) |
||
57 | { |
||
58 | $parsedRules = []; |
||
59 | $rawRules = (new ValidationRuleParser($this->data))->explode($rules); |
||
60 | |||
61 | foreach ($rawRules->rules as $attribute => $attributeRules) { |
||
62 | foreach ($attributeRules as $attributeRule) { |
||
63 | $parsedRule = $this->parseRuleString($attributeRule); |
||
64 | if ($parsedRule) { |
||
0 ignored issues
–
show
The expression
$parsedRule of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using ![]() |
|||
65 | $parsedRules[$attribute][] = $parsedRule; |
||
66 | } |
||
67 | } |
||
68 | } |
||
69 | |||
70 | return $parsedRules; |
||
71 | } |
||
72 | |||
73 | /** |
||
74 | * Parse a rule string formatted as filterName:option1, option2 into an array formatted as [name => filterName, options => [option1, option2]]. |
||
75 | * |
||
76 | * @param string $rule Formatted as 'filterName:option1, option2' or just 'filterName' |
||
77 | * |
||
78 | * @return array |
||
79 | */ |
||
80 | protected function parseRuleString($rule) |
||
81 | { |
||
82 | if (strpos($rule, ':') !== false) { |
||
83 | [$name, $options] = explode(':', $rule, 2); |
||
0 ignored issues
–
show
The variable
$name seems only to be defined at a later point. Did you maybe move this code here without moving the variable definition?
This error can happen if you refactor code and forget to move the variable initialization. Let’s take a look at a simple example: function someFunction() {
$x = 5;
echo $x;
}
The above code is perfectly fine. Now imagine that we re-order the statements: function someFunction() {
echo $x;
$x = 5;
}
In that case, ![]() The variable
$options seems only to be defined at a later point. Did you maybe move this code here without moving the variable definition?
This error can happen if you refactor code and forget to move the variable initialization. Let’s take a look at a simple example: function someFunction() {
$x = 5;
echo $x;
}
The above code is perfectly fine. Now imagine that we re-order the statements: function someFunction() {
echo $x;
$x = 5;
}
In that case, ![]() |
|||
84 | $options = array_map('trim', explode(',', $options)); |
||
0 ignored issues
–
show
The variable
$options seems only to be defined at a later point. Did you maybe move this code here without moving the variable definition?
This error can happen if you refactor code and forget to move the variable initialization. Let’s take a look at a simple example: function someFunction() {
$x = 5;
echo $x;
}
The above code is perfectly fine. Now imagine that we re-order the statements: function someFunction() {
echo $x;
$x = 5;
}
In that case, ![]() |
|||
85 | } else { |
||
86 | $name = $rule; |
||
87 | $options = []; |
||
88 | } |
||
89 | |||
90 | if (! $name) { |
||
0 ignored issues
–
show
The variable
$name does not seem to be defined for all execution paths leading up to this point.
If you define a variable conditionally, it can happen that it is not defined for all execution paths. Let’s take a look at an example: function myFunction($a) {
switch ($a) {
case 'foo':
$x = 1;
break;
case 'bar':
$x = 2;
break;
}
// $x is potentially undefined here.
echo $x;
}
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined. Available Fixes
![]() |
|||
91 | return []; |
||
92 | } |
||
93 | |||
94 | return compact('name', 'options'); |
||
95 | } |
||
96 | |||
97 | /** |
||
98 | * Apply the given filter by its name. |
||
99 | * |
||
100 | * @param mixed $name |
||
101 | * |
||
102 | * @return Filter |
||
103 | */ |
||
104 | protected function applyFilter($name, $value, $options = []) |
||
105 | { |
||
106 | // If the filter does not exist, throw an Exception: |
||
107 | if (! isset($this->filters[$name])) { |
||
108 | throw new InvalidArgumentException("No filter found by the name of $name"); |
||
109 | } |
||
110 | |||
111 | $filter = $this->filters[$name]; |
||
112 | |||
113 | if ($filter instanceof Closure) { |
||
114 | return call_user_func_array($filter, [$value, $options]); |
||
115 | } else { |
||
116 | $filter = new $filter; |
||
117 | |||
118 | return $filter->apply($value, $options); |
||
119 | } |
||
120 | } |
||
121 | |||
122 | /** |
||
123 | * Sanitize the given data. |
||
124 | * |
||
125 | * @return array |
||
126 | */ |
||
127 | public function sanitize() |
||
128 | { |
||
129 | $sanitized = $this->data; |
||
130 | |||
131 | foreach ($this->rules as $attr => $rules) { |
||
132 | if (Arr::has($this->data, $attr)) { |
||
133 | $value = Arr::get($this->data, $attr); |
||
134 | foreach ($rules as $rule) { |
||
135 | $value = $this->applyFilter($rule['name'], $value, $rule['options']); |
||
136 | } |
||
137 | Arr::set($sanitized, $attr, $value); |
||
138 | } |
||
139 | } |
||
140 | |||
141 | return $sanitized; |
||
142 | } |
||
143 | |||
144 | /** |
||
145 | * Sanitize the given attribute. |
||
146 | * |
||
147 | * @param string $attribute Attribute name |
||
148 | * @param mixed $value Attribute value |
||
149 | * |
||
150 | * @return mixed Sanitized value |
||
151 | */ |
||
152 | protected function sanitizeAttribute($attribute, $value) |
||
153 | { |
||
154 | if (isset($this->rules[$attribute])) { |
||
155 | foreach ($this->rules[$attribute] as $rule) { |
||
156 | $value = $this->applyFilter($rule['name'], $value, $rule['options']); |
||
157 | } |
||
158 | } |
||
159 | |||
160 | return $value; |
||
161 | } |
||
162 | } |
||
163 |
This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function. It has, however, found a similar but not annotated parameter which might be a good fit.
Consider the following example. The parameter
$ireland
is not defined by the methodfinale(...)
.The most likely cause is that the parameter was changed, but the annotation was not.