Security::var_export54() - Code Metrics - Inspection of "Small refactoring" - phpffcms/ffcms-core - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — master ( 03fcb2...4fe6d0 )

by Mihail

created 2015-11-28 10:02 UTC

Security::var_export54() A

↳ Parent: Security

Complexity

Conditions	1
Paths	1

Size

Total Lines	3
Code Lines	2

Duplication

Lines	0
Ratio	0 %

Importance

Changes	2
Bugs	1	Features	0

Metric	Value
c	2
b	1
f	0
dl	0
loc	3
rs	10
cc	1
eloc	2
nc	1
nop	3

<?php

namespace Ffcms\Core\Helper;

use Ffcms\Core\App;
use Ffcms\Core\Helper\Type\Arr;
use Ffcms\Core\Helper\Type\Obj;
use Ffcms\Core\Helper\Type\Str;

class Security
{

    protected $purifier;


    public function __construct()
    {
        $config = \HTMLPurifier_Config::createDefault();
        $config->set('Cache.SerializerPath', root . '/Private/Cache/HTMLPurifier/');
        //$config->set('HTML.Allowed', 'p,b,a[href],i');

        //$config->set('URI.Base', 'http://www.example.com');

        //$config->set('URI.MakeAbsolute', true);

        $config->set('AutoFormat.AutoParagraph', false);

        // allow use target=_blank for links
        $def = $config->getHTMLDefinition(true);
        $def->addAttribute('a', 'target', 'Enum#_blank,_self,_target,_top');

        $this->purifier = new \HTMLPurifier($config);
    }

    /**
     * Get purifier instance
     * @return \HTMLPurifier
     */
    public function getPurifier()
    {
        return $this->purifier;
    }

    /**
     * Secure html code
     * @param string|array $data
     * @return string
     */
    public function secureHtml($data)
    {
        if (Obj::isArray($data)) {
            return $this->purifier->purifyArray($data);
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
        }

        return $this->purifier->purify($data);

    }

    /**
     * String html tags and escape quotes
     * @param string|array $html
     * @param boolean $escapeQuotes
     * @return string
     */
    public function strip_tags($html, $escapeQuotes = true)
    {
        // recursive usage
        if (Obj::isArray($html)) {
            foreach ($html as $key=>$value) {
$collection = json_decode($data, true);
if ( ! is_array($collection)) {
    throw new \RuntimeException('$collection must be an array.');
}

foreach ($collection as $item) { /** ... */ }
                $html[$key] = $this->strip_tags($value, $escapeQuotes);
            }
            return $html;
        }

        $text = strip_tags($html);
        if ($escapeQuotes) {
            $text = $this->escapeQuotes($text);
        }
        return $text;
    }

    /**
     * Strip php tags and notations in string.
     * @param array|string $data
     * @return array|mixed|string
     */
    public function strip_php_tags($data)
    {
        if (is_array($data)) {
            foreach ($data as $key=>$value) {
                $data[$key] = $this->strip_php_tags($value);
            }
            return $data;
        }
        return addslashes(htmlspecialchars(strip_tags($data)));
    }

    /**
     * Alternative var_export function for php >= 5.4 syntax
     * @deprecated
     * @param $var
     * @param null $indent
     * @return mixed|string
     */
    public function var_export54($var, $indent = null, $guessTypes = false) {
        return Arr::var_export54($var, $indent, $guessTypes);
    }

    /**
     * Escape quotes
     * @param string $html
     * @return string
     */
    public function escapeQuotes($html)
    {
        return Str::replace(['"', "'"], '&quot;', $html);
    }

    /**
     * Crypt password secure with Blow fish crypt algo (defined in salt)
     * Blow fish crypt example: crypt('somedata', '$2a$07$usesomesillystringfor$'), where $2a$07$ - definition of algo,
     * usesomesillystringfor - is salt (must be 21 or more chars), $ - end caret. Output: $2a$07$usesomesillystringfor.sUeCOxyFvckc3xgq1Kzqq90gLrrIVjq
     * @param string $password
     * @return string
     */
    public static function password_hash($password)
    {
        return crypt($password, App::$Properties->get('passwordSalt'));
    }

    /**
     * Generate simple hash of 8 chars (32bit) for string. This method is NOT SECURE for crypt reason!
     * @param string $string
     * @return string
     */
    public static function simpleHash($string)
    {
        return dechex(crc32($string));
    }


}

1			<?php
2
3			namespace Ffcms\Core\Helper;
4
5			use Ffcms\Core\App;
6			use Ffcms\Core\Helper\Type\Arr;
7			use Ffcms\Core\Helper\Type\Obj;
8			use Ffcms\Core\Helper\Type\Str;
9
10			class Security
11			{
12
13			protected $purifier;
14
15
16			public function __construct()
17			{
18			$config = \HTMLPurifier_Config::createDefault();
19			$config->set('Cache.SerializerPath', root . '/Private/Cache/HTMLPurifier/');
20			//$config->set('HTML.Allowed', 'p,b,a[href],i');
			0 ignored issues – show Unused Code Comprehensibility introduced 2015-11-21 16:41 UTC by Report Bug Copy Issue Report `80%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
21			//$config->set('URI.Base', 'http://www.example.com');
			0 ignored issues – show Unused Code Comprehensibility introduced 2015-11-21 16:41 UTC by Report Bug Copy Issue Report `80%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
22			//$config->set('URI.MakeAbsolute', true);
			0 ignored issues – show Unused Code Comprehensibility introduced 2015-11-21 16:41 UTC by Report Bug Copy Issue Report `80%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
23			$config->set('AutoFormat.AutoParagraph', false);
24
25			// allow use target=_blank for links
26			$def = $config->getHTMLDefinition(true);
27			$def->addAttribute('a', 'target', 'Enum#_blank,_self,_target,_top');
28
29			$this->purifier = new \HTMLPurifier($config);
30			}
31
32			/**
33			* Get purifier instance
34			* @return \HTMLPurifier
35			*/
36			public function getPurifier()
37			{
38			return $this->purifier;
39			}
40
41			/**
42			* Secure html code
43			* @param string\|array $data
44			* @return string
45			*/
46			public function secureHtml($data)
47			{
48			if (Obj::isArray($data)) {
49			return $this->purifier->purifyArray($data);
			0 ignored issues – show Documentation introduced 2015-11-21 16:41 UTC by Report Bug Copy Issue Report `$data` is of type `string\|array`, but the function expects a `array<integer,string>`. It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { } $x = '123'; // string "123" // Instead of acceptsInteger($x); // we recommend to use acceptsInteger((integer) $x); Loading history...
50			}
51
52			return $this->purifier->purify($data);
			0 ignored issues – show Bug introduced 2015-11-28 10:04 UTC by Report Bug Copy Issue Report It seems like `$data` defined by parameter `$data` on line 46 can also be of type `array`; however, `HTMLPurifier::purify()` does only seem to accept `string`, maybe add an additional type check? This check looks at variables that have been passed in as parameters and are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. Loading history...
53			}
54
55			/**
56			* String html tags and escape quotes
57			* @param string\|array $html
58			* @param boolean $escapeQuotes
59			* @return string
60			*/
61			public function strip_tags($html, $escapeQuotes = true)
62			{
63			// recursive usage
64			if (Obj::isArray($html)) {
65			foreach ($html as $key=>$value) {
			0 ignored issues – show Bug introduced 2015-11-21 16:41 UTC by Report Bug Copy Issue Report The expression `$html` of type `string\|array` is not guaranteed to be traversable. How about adding an additional type check? There are different options of fixing this problem. If you want to be on the safe side, you can add an additional type-check: $collection = json_decode($data, true); if ( ! is_array($collection)) { throw new \RuntimeException('$collection must be an array.'); } foreach ($collection as $item) { /** ... / } If you are sure that the expression is traversable, you might want to add a doc comment cast* to improve IDE auto-completion and static analysis: /** @var array $collection / $collection = json_decode($data, true); foreach ($collection as $item) { /* .. / } Mark the issue as a false-positive*: Just hover the remove button, in the top-right corner of this issue for more options. Loading history...
66			$html[$key] = $this->strip_tags($value, $escapeQuotes);
67			}
68			return $html;
69			}
70
71			$text = strip_tags($html);
72			if ($escapeQuotes) {
73			$text = $this->escapeQuotes($text);
74			}
75			return $text;
76			}
77
78			/**
79			* Strip php tags and notations in string.
80			* @param array\|string $data
81			* @return array\|mixed\|string
82			*/
83			public function strip_php_tags($data)
84			{
85			if (is_array($data)) {
86			foreach ($data as $key=>$value) {
87			$data[$key] = $this->strip_php_tags($value);
88			}
89			return $data;
90			}
91			return addslashes(htmlspecialchars(strip_tags($data)));
92			}
93
94			/**
95			* Alternative var_export function for php >= 5.4 syntax
96			* @deprecated
97			* @param $var
98			* @param null $indent
99			* @return mixed\|string
100			*/
101			public function var_export54($var, $indent = null, $guessTypes = false) {
102			return Arr::var_export54($var, $indent, $guessTypes);
103			}
104
105			/**
106			* Escape quotes
107			* @param string $html
108			* @return string
109			*/
110			public function escapeQuotes($html)
111			{
112			return Str::replace(['"', "'"], '"', $html);
113			}
114
115			/**
116			* Crypt password secure with Blow fish crypt algo (defined in salt)
117			* Blow fish crypt example: crypt('somedata', '$2a$07$usesomesillystringfor$'), where $2a$07$ - definition of algo,
118			* usesomesillystringfor - is salt (must be 21 or more chars), $ - end caret. Output: $2a$07$usesomesillystringfor.sUeCOxyFvckc3xgq1Kzqq90gLrrIVjq
119			* @param string $password
120			* @return string
121			*/
122			public static function password_hash($password)
123			{
124			return crypt($password, App::$Properties->get('passwordSalt'));
125			}
126
127			/**
128			* Generate simple hash of 8 chars (32bit) for string. This method is NOT SECURE for crypt reason!
129			* @param string $string
130			* @return string
131			*/
132			public static function simpleHash($string)
133			{
134			return dechex(crc32($string));
135			}
136
137
138			}

phpffcms / ffcms-core

Push — master ( 03fcb2...4fe6d0 )

Security::var_export54() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like