1 | <?php |
||
22 | class SimpleFilesystemFileProcessor implements FileProcessorInterface { |
||
23 | |||
24 | /** |
||
25 | * Holds the base path where all files will be stored into subfolders. |
||
26 | */ |
||
27 | protected $basePath; |
||
28 | |||
29 | /** |
||
30 | * Constructs a file system path for the given parameters for storing the |
||
31 | * file of the file field. |
||
32 | * |
||
33 | * @param string $entityName |
||
34 | * the entity name |
||
35 | * @param Entity $entity |
||
36 | * the entity |
||
37 | * @param string $field |
||
38 | * the file field in the entity |
||
39 | * |
||
40 | * @return string |
||
41 | * the constructed path for storing the file of the file field |
||
42 | */ |
||
43 | 4 | protected function getPath($entityName, Entity $entity, $field) { |
|
46 | |||
47 | /** |
||
48 | * Constructor. |
||
49 | * |
||
50 | * @param string $basePath |
||
51 | * the base path where all files will be stored into subfolders |
||
52 | */ |
||
53 | 5 | public function __construct($basePath = '') { |
|
56 | |||
57 | /** |
||
58 | * {@inheritdoc} |
||
59 | */ |
||
60 | 4 | public function createFile(Request $request, Entity $entity, $entityName, $field) { |
|
70 | |||
71 | /** |
||
72 | * {@inheritdoc} |
||
73 | * For now, this implementation is defensive and doesn't delete ever. |
||
74 | */ |
||
75 | 1 | public function updateFile(Request $request, Entity $entity, $entityName, $field) { |
|
79 | |||
80 | /** |
||
81 | * {@inheritdoc} |
||
82 | * For now, this implementation is defensive and doesn't delete ever. |
||
83 | */ |
||
84 | 1 | public function deleteFile(Entity $entity, $entityName, $field) { |
|
87 | |||
88 | /** |
||
89 | * {@inheritdoc} |
||
90 | */ |
||
91 | 1 | public function renderFile(Entity $entity, $entityName, $field) { |
|
110 | |||
111 | |||
112 | /** |
||
113 | * {@inheritdoc} |
||
114 | */ |
||
115 | public function getFile(Entity $entity, $entityName, $field) { |
||
122 | } |
||
123 |
$targetPath
can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.8 paths for user data to reach this point
$_FILES,
and$_FILES
is passed to Request::createRequestFromFactory() in Request.php on line 317$_FILES,
and$_FILES
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 317
$files
is passed to Request::__construct()in vendor/Request.php on line 2018
$files
is passed to Request::initialize()in vendor/Request.php on line 258
$files
is passed to FileBag::__construct()in vendor/Request.php on line 280
$parameters
is passed to FileBag::replace()in vendor/FileBag.php on line 33
$files
is passed to FileBag::add()in vendor/FileBag.php on line 42
$file
is assignedin vendor/FileBag.php on line 62
$file
is passed to FileBag::set()in vendor/FileBag.php on line 63
$value
is passed to FileBag::convertFileInformation()in vendor/FileBag.php on line 54
$file
is assignedin vendor/FileBag.php on line 80
$file['name']
is passed to UploadedFile::__construct()in vendor/FileBag.php on line 89
in vendor/File/File.php on line 130
in vendor/File/UploadedFile.php on line 90
in vendor/File/UploadedFile.php on line 109
$file->getClientOriginalName()
is passed to Entity::set()in src/CRUDlex/Entity.php on line 146
in src/CRUDlex/Entity.php on line 77
$value
is assignedin src/CRUDlex/Entity.php on line 119
in src/CRUDlex/SimpleFilesystemFileProcessor.php on line 44
$targetPath
is assignedin src/CRUDlex/SimpleFilesystemFileProcessor.php on line 63
$this->parameters['HTTP_AUTHORIZATION']
seems to return tainted data, and$authorizationHeader
is assigned in ServerBag.php on line 62$this->parameters['HTTP_AUTHORIZATION']
seems to return tainted data, and$authorizationHeader
is assignedin vendor/ServerBag.php on line 62
in vendor/ServerBag.php on line 77
in vendor/ParameterBag.php on line 88
$result
is assignedin vendor/Request.php on line 798
$array
is assignedin src/CRUDlex/Entity.php on line 155
$array
is passed through array_map()in src/CRUDlex/Entity.php on line 159
$many
is assignedin src/CRUDlex/Entity.php on line 157
$many
is passed to Entity::set()in src/CRUDlex/Entity.php on line 160
in src/CRUDlex/Entity.php on line 77
$value
is assignedin src/CRUDlex/Entity.php on line 119
in src/CRUDlex/SimpleFilesystemFileProcessor.php on line 44
$targetPath
is assignedin src/CRUDlex/SimpleFilesystemFileProcessor.php on line 63
$_SERVER,
and$server
is assigned in Request.php on line 307$_SERVER,
and$server
is assignedin vendor/Request.php on line 307
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 317
$server
is passed to Request::__construct()in vendor/Request.php on line 2018
$server
is passed to Request::initialize()in vendor/Request.php on line 258
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 281
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 88
$result
is assignedin vendor/Request.php on line 798
$array
is assignedin src/CRUDlex/Entity.php on line 155
$array
is passed through array_map()in src/CRUDlex/Entity.php on line 159
$many
is assignedin src/CRUDlex/Entity.php on line 157
$many
is passed to Entity::set()in src/CRUDlex/Entity.php on line 160
in src/CRUDlex/Entity.php on line 77
$value
is assignedin src/CRUDlex/Entity.php on line 119
in src/CRUDlex/SimpleFilesystemFileProcessor.php on line 44
$targetPath
is assignedin src/CRUDlex/SimpleFilesystemFileProcessor.php on line 63
HTTP_CONTENT_LENGTH
from$_SERVER,
and$server
is assigned in Request.php on line 310HTTP_CONTENT_LENGTH
from$_SERVER,
and$server
is assignedin vendor/Request.php on line 310
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 317
$server
is passed to Request::__construct()in vendor/Request.php on line 2018
$server
is passed to Request::initialize()in vendor/Request.php on line 258
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 281
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 88
$result
is assignedin vendor/Request.php on line 798
$array
is assignedin src/CRUDlex/Entity.php on line 155
$array
is passed through array_map()in src/CRUDlex/Entity.php on line 159
$many
is assignedin src/CRUDlex/Entity.php on line 157
$many
is passed to Entity::set()in src/CRUDlex/Entity.php on line 160
in src/CRUDlex/Entity.php on line 77
$value
is assignedin src/CRUDlex/Entity.php on line 119
in src/CRUDlex/SimpleFilesystemFileProcessor.php on line 44
$targetPath
is assignedin src/CRUDlex/SimpleFilesystemFileProcessor.php on line 63
HTTP_CONTENT_TYPE
from$_SERVER,
and$server
is assigned in Request.php on line 313HTTP_CONTENT_TYPE
from$_SERVER,
and$server
is assignedin vendor/Request.php on line 313
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 317
$server
is passed to Request::__construct()in vendor/Request.php on line 2018
$server
is passed to Request::initialize()in vendor/Request.php on line 258
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 281
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 88
$result
is assignedin vendor/Request.php on line 798
$array
is assignedin src/CRUDlex/Entity.php on line 155
$array
is passed through array_map()in src/CRUDlex/Entity.php on line 159
$many
is assignedin src/CRUDlex/Entity.php on line 157
$many
is passed to Entity::set()in src/CRUDlex/Entity.php on line 160
in src/CRUDlex/Entity.php on line 77
$value
is assignedin src/CRUDlex/Entity.php on line 119
in src/CRUDlex/SimpleFilesystemFileProcessor.php on line 44
$targetPath
is assignedin src/CRUDlex/SimpleFilesystemFileProcessor.php on line 63
$server['HTTP_HOST']
seems to return tainted data, and$server
is assigned in Request.php on line 383$server['HTTP_HOST']
seems to return tainted data, and$server
is assignedin vendor/Request.php on line 383
$server
is assignedin vendor/Request.php on line 431
$server
is assignedin vendor/Request.php on line 432
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 434
$server
is passed to Request::__construct()in vendor/Request.php on line 2018
$server
is passed to Request::initialize()in vendor/Request.php on line 258
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 281
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 88
$result
is assignedin vendor/Request.php on line 798
$array
is assignedin src/CRUDlex/Entity.php on line 155
$array
is passed through array_map()in src/CRUDlex/Entity.php on line 159
$many
is assignedin src/CRUDlex/Entity.php on line 157
$many
is passed to Entity::set()in src/CRUDlex/Entity.php on line 160
in src/CRUDlex/Entity.php on line 77
$value
is assignedin src/CRUDlex/Entity.php on line 119
in src/CRUDlex/SimpleFilesystemFileProcessor.php on line 44
$targetPath
is assignedin src/CRUDlex/SimpleFilesystemFileProcessor.php on line 63
$this->parameters['PHP_AUTH_USER']
seems to return tainted data, and$headers
is assigned in ServerBag.php on line 43$this->parameters['PHP_AUTH_USER']
seems to return tainted data, and$headers
is assignedin vendor/ServerBag.php on line 43
$headers
is assignedin vendor/ServerBag.php on line 44
$this->server->getHeaders()
is passed to HeaderBag::__construct()in vendor/Request.php on line 282
$values
is assignedin vendor/HeaderBag.php on line 31
$values
is passed to HeaderBag::set()in vendor/HeaderBag.php on line 32
(array) $values
is passed through array_values(), and$values
is assignedin vendor/HeaderBag.php on line 143
in vendor/HeaderBag.php on line 146
in vendor/HeaderBag.php on line 67
$headers
is assignedin vendor/HeaderBag.php on line 115
$requestUri
is assignedin vendor/Request.php on line 1788
$requestUri
is passed to ParameterBag::set()in vendor/Request.php on line 1819
in vendor/ParameterBag.php on line 99
in vendor/ParameterBag.php on line 88
$result
is assignedin vendor/Request.php on line 798
$array
is assignedin src/CRUDlex/Entity.php on line 155
$array
is passed through array_map()in src/CRUDlex/Entity.php on line 159
$many
is assignedin src/CRUDlex/Entity.php on line 157
$many
is passed to Entity::set()in src/CRUDlex/Entity.php on line 160
in src/CRUDlex/Entity.php on line 77
$value
is assignedin src/CRUDlex/Entity.php on line 119
in src/CRUDlex/SimpleFilesystemFileProcessor.php on line 44
$targetPath
is assignedin src/CRUDlex/SimpleFilesystemFileProcessor.php on line 63
$this->parameters['PHP_AUTH_PW']
seems to return tainted data, and$headers
is assigned in ServerBag.php on line 44$this->parameters['PHP_AUTH_PW']
seems to return tainted data, and$headers
is assignedin vendor/ServerBag.php on line 44
$this->server->getHeaders()
is passed to HeaderBag::__construct()in vendor/Request.php on line 282
$values
is assignedin vendor/HeaderBag.php on line 31
$values
is passed to HeaderBag::set()in vendor/HeaderBag.php on line 32
(array) $values
is passed through array_values(), and$values
is assignedin vendor/HeaderBag.php on line 143
in vendor/HeaderBag.php on line 146
in vendor/HeaderBag.php on line 67
$headers
is assignedin vendor/HeaderBag.php on line 115
$requestUri
is assignedin vendor/Request.php on line 1788
$requestUri
is passed to ParameterBag::set()in vendor/Request.php on line 1819
in vendor/ParameterBag.php on line 99
in vendor/ParameterBag.php on line 88
$result
is assignedin vendor/Request.php on line 798
$array
is assignedin src/CRUDlex/Entity.php on line 155
$array
is passed through array_map()in src/CRUDlex/Entity.php on line 159
$many
is assignedin src/CRUDlex/Entity.php on line 157
$many
is passed to Entity::set()in src/CRUDlex/Entity.php on line 160
in src/CRUDlex/Entity.php on line 77
$value
is assignedin src/CRUDlex/Entity.php on line 119
in src/CRUDlex/SimpleFilesystemFileProcessor.php on line 44
$targetPath
is assignedin src/CRUDlex/SimpleFilesystemFileProcessor.php on line 63
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: