This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||
2 | |||||
3 | /** |
||||
4 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
||||
5 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
||||
6 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
||||
7 | * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
||||
8 | * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
||||
9 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
||||
10 | * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
||||
11 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
||||
12 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
||||
13 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
||||
14 | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
||||
15 | * |
||||
16 | * This software consists of voluntary contributions made by many individuals |
||||
17 | * and is licensed under the LGPL. For more information please see |
||||
18 | * <http://phing.info>. |
||||
19 | */ |
||||
20 | |||||
21 | namespace Phing\Parser; |
||||
22 | |||||
23 | use Exception; |
||||
24 | use Phing\Io\IOException; |
||||
25 | use Phing\Io\Reader; |
||||
26 | use SplFileObject; |
||||
27 | |||||
28 | /** |
||||
29 | * This class is a wrapper for the PHP's internal expat parser. |
||||
30 | * |
||||
31 | * It takes an XML file represented by a abstract path name, and starts |
||||
32 | * parsing the file and calling the different "trap" methods inherited from |
||||
33 | * the AbstractParser class. |
||||
34 | * |
||||
35 | * Those methods then invoke the represenatative methods in the registered |
||||
36 | * handler classes. |
||||
37 | * |
||||
38 | * @author Andreas Aderhold <[email protected]> |
||||
39 | * @copyright 2001,2002 THYRELL. All rights reserved |
||||
40 | */ |
||||
41 | class ExpatParser extends AbstractSAXParser |
||||
42 | { |
||||
43 | /** |
||||
44 | * @var resource |
||||
45 | */ |
||||
46 | private $parser; |
||||
47 | |||||
48 | /** |
||||
49 | * @var Reader |
||||
50 | */ |
||||
51 | private $reader; |
||||
52 | |||||
53 | /** |
||||
54 | * @var SplFileObject |
||||
55 | */ |
||||
56 | private $file; |
||||
57 | |||||
58 | private $buffer = 4096; |
||||
0 ignored issues
–
show
introduced
by
![]() |
|||||
59 | |||||
60 | /** |
||||
61 | * @var Location current cursor pos in XML file |
||||
62 | */ |
||||
63 | private $location; |
||||
64 | |||||
65 | /** |
||||
66 | * Constructs a new ExpatParser object. |
||||
67 | * |
||||
68 | * The constructor accepts a PhingFile object that represents the filename |
||||
69 | * for the file to be parsed. It sets up php's internal expat parser |
||||
70 | * and options. |
||||
71 | * |
||||
72 | * @param Reader $reader the Reader Object that is to be read from |
||||
73 | * @param string $filename filename to read |
||||
74 | * |
||||
75 | * @throws Exception if the given argument is not a PhingFile object |
||||
76 | */ |
||||
77 | 906 | public function __construct(Reader $reader, $filename = null) |
|||
78 | { |
||||
79 | 906 | $this->reader = $reader; |
|||
80 | 906 | if (null !== $filename) { |
|||
81 | $this->file = new SplFileObject($filename); |
||||
82 | } |
||||
83 | 906 | $this->parser = xml_parser_create(); |
|||
0 ignored issues
–
show
It seems like
xml_parser_create() can also be of type XmlParser . However, the property $parser is declared as type resource . Maybe add an additional type check?
Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly. For example, imagine you have a variable Either this assignment is in error or a type check should be added for that assignment. class Id
{
public $id;
public function __construct($id)
{
$this->id = $id;
}
}
class Account
{
/** @var Id $id */
public $id;
}
$account_id = false;
if (starsAreRight()) {
$account_id = new Id(42);
}
$account = new Account();
if ($account instanceof Id)
{
$account->id = $account_id;
}
![]() |
|||||
84 | 906 | $this->location = new Location(); |
|||
85 | 906 | xml_set_element_handler($this->parser, [$this, 'startElement'], [$this, 'endElement']); |
|||
86 | 906 | xml_set_character_data_handler($this->parser, [$this, 'characters']); |
|||
87 | } |
||||
88 | |||||
89 | /** |
||||
90 | * Override PHP's parser default settings, created in the constructor. |
||||
91 | * |
||||
92 | * @param $opt |
||||
93 | * @param $val |
||||
94 | * |
||||
95 | * @return bool true if the option could be set, otherwise false |
||||
96 | * |
||||
97 | * @internal param the $string option to set |
||||
98 | */ |
||||
99 | 906 | public function parserSetOption($opt, $val) |
|||
100 | { |
||||
101 | 906 | return xml_parser_set_option($this->parser, $opt, $val); |
|||
102 | } |
||||
103 | |||||
104 | /** |
||||
105 | * Returns the location object of the current parsed element. It describes |
||||
106 | * the location of the element within the XML file (line, char). |
||||
107 | * |
||||
108 | * @return Location the location of the current parser |
||||
109 | */ |
||||
110 | 906 | public function getLocation() |
|||
111 | { |
||||
112 | 906 | if (null !== $this->file) { |
|||
113 | $path = false !== $this->file->getRealPath() ? $this->file->getRealPath() : null; |
||||
114 | } else { |
||||
115 | 906 | $path = $this->reader->getResource(); |
|||
116 | } |
||||
117 | 906 | $this->location = new Location( |
|||
118 | 906 | $path, |
|||
119 | 906 | xml_get_current_line_number($this->parser), |
|||
120 | 906 | xml_get_current_column_number( |
|||
121 | 906 | $this->parser |
|||
122 | 906 | ) |
|||
123 | 906 | ); |
|||
124 | |||||
125 | 906 | return $this->location; |
|||
126 | } |
||||
127 | |||||
128 | /** |
||||
129 | * Starts the parsing process. |
||||
130 | * |
||||
131 | * @throws ExpatParseException if something gone wrong during parsing |
||||
132 | * @throws IOException if XML file can not be accessed |
||||
133 | * |
||||
134 | * @return int 1 if the parsing succeeded |
||||
135 | */ |
||||
136 | 906 | public function parse() |
|||
137 | { |
||||
138 | 906 | while (($data = $this->reader->read()) !== -1) { |
|||
139 | 906 | if (!xml_parse($this->parser, $data, $this->reader->eof())) { |
|||
0 ignored issues
–
show
The method
eof() does not exist on Phing\Io\Reader . It seems like you code against a sub-type of said class. However, the method does not exist in Phing\Io\FilterReader or Phing\Io\StringReader . Are you sure you never get one of those?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
140 | $error = xml_error_string(xml_get_error_code($this->parser)); |
||||
141 | $e = new ExpatParseException($error, $this->getLocation()); |
||||
142 | xml_parser_free($this->parser); |
||||
143 | |||||
144 | throw $e; |
||||
145 | } |
||||
146 | } |
||||
147 | 906 | xml_parser_free($this->parser); |
|||
148 | |||||
149 | 906 | return 1; |
|||
150 | } |
||||
151 | } |
||||
152 |