Issues in RelativeQueryBuilder.php (master) - Issues in master - phuria/under-query - Measure and Improve Code Quality continuously with Scrutinizer

Issues (19)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Table/RelativeQueryBuilder.php (1 issue)

Labels

Documentation 1

Severity

Minor 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

/**
 * This file is part of UnderQuery package.
 *
 * Copyright (c) 2016 Beniamin Jonatan Šimko
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace Phuria\UnderQuery\Table;

use Phuria\UnderQuery\JoinType;
use Phuria\UnderQuery\Language\Expression\RelativeClause;
use Phuria\UnderQuery\QueryBuilder\Clause as Clause;
use Phuria\UnderQuery\QueryBuilder\BuilderInterface;
use Phuria\UnderQuery\QueryBuilder\Clause\OrderByInterface;
use Phuria\UnderQuery\QueryBuilder\Clause\SetInterface;
use Phuria\UnderQuery\QueryBuilder\Clause\WhereInterface;
use Phuria\UnderQuery\Utils\RecursiveArgs;

/**
 * @author Beniamin Jonatan Šimko <[email protected]>
 */
class RelativeQueryBuilder implements
    Clause\GroupByInterface,
    Clause\HavingInterface,
    Clause\JoinInterface,
    Clause\LimitInterface,
    Clause\OrderByInterface,
    Clause\SelectInterface,
    Clause\SetInterface,
    Clause\WhereInterface
{
    /**
     * @var BuilderInterface
     */
    private $wrappedBuilder;

    /**
     * @var TableInterface
     */
    private $wrappedTable;

    /**
     * @param BuilderInterface $builder
     * @param TableInterface   $table
     */
    public function __construct(BuilderInterface $builder, TableInterface $table)
    {
        $this->wrappedBuilder = $builder;
        $this->wrappedTable = $table;
    }

    /**
     * @inheritdoc
     */
    public function __destruct()
    {
        unset($this->wrappedBuilder, $this->wrappedTable);
    }

    /**
     * @param array $args
     *
     * @return array
     */
    public function replaceSelfReference(array $args)
    {
        return RecursiveArgs::map($args, function ($arg) {
            return $this->createRelativeClause($arg);
        });
    }

    /**
     * @param mixed $clause
     *
     * @return RelativeClause
     */
    private function createRelativeClause($clause)
    {
        return new RelativeClause($this->wrappedTable, $clause, RelativeClause::RELATIVE_DIRECTIVE);
    }

    /**
     * @param callable $callback
     *
     * @return mixed
     */
    private function getQueryBuilder(callable $callback)
    {
        return $callback($this->wrappedBuilder);
    }

    /**
     * @inheritdoc
     */
    public function addSelect($_)
    {
        $args = $this->replaceSelfReference(func_get_args());
        $this->getQueryBuilder(function (Clause\SelectInterface $qb) use ($args) {
            $qb->addSelect($args);
        });

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function getSelectClauses()
    {
        return $this->getQueryBuilder(function (Clause\SelectInterface $qb) {
            return $qb->getSelectClauses();
        });
    }

    /**
     * @inheritdoc
     */
    public function getGroupByClauses()
    {
        return $this->getQueryBuilder(function (Clause\GroupByInterface $qb) {
            return $qb->getGroupByClauses();
        });
    }

    /**
     * @inheritdoc
     */
    public function isGroupByWithRollUp()
    {
        return $this->getQueryBuilder(function (Clause\GroupByInterface $qb) {
            return $qb->isGroupByWithRollUp();
        });
    }

    /**
     * @inheritdoc
     */
    public function addGroupBy($_)
    {
        $args = $this->replaceSelfReference(func_get_args());
        $this->getQueryBuilder(function (Clause\GroupByInterface $qb) use ($args) {
            $qb->addGroupBy($args);
        });

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function setGroupByWithRollUp($groupByWithRollUp)
    {
        $this->getQueryBuilder(function (Clause\GroupByInterface $qb) use ($groupByWithRollUp) {
            $qb->setGroupByWithRollUp($groupByWithRollUp);
        });

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function getHavingClauses()
    {
        return $this->getQueryBuilder(function (Clause\HavingInterface $qb) {
            return $qb->getHavingClauses();
        });
    }

    /**
     * @inheritdoc
     */
    public function andHaving($_)
    {
        $args = $this->replaceSelfReference(func_get_args());
        $this->getQueryBuilder(function (Clause\HavingInterface $qb) use ($args) {
            $qb->andHaving($args);
        });

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function getLimitClause()
    {
        return $this->getQueryBuilder(function (Clause\LimitInterface $qb) {
            return $qb->getLimitClause();
        });
    }

    /**
     * @inheritdoc
     */
    public function setLimit($limitClause)
    {
        $this->getQueryBuilder(function (Clause\LimitInterface $qb) use ($limitClause) {
            $qb->setLimit($limitClause);
        });

        return $this;
    }

    /**
     * @inheritdoc
     */
    public function getOrderByClauses()
    {
        return $this->getQueryBuilder(function (Clause\OrderByInterface $qb) {
            return $qb->getOrderByClauses();
        });
    }

    /**
     * @inheritDoc
     */
    public function addOrderBy($_)
    {
        $args = $this->replaceSelfReference(func_get_args());
        $this->getQueryBuilder(function (Clause\OrderByInterface $qb) use ($args) {
            $qb->addOrderBy($args);
        });

        return $this;
    }

    /**
     * @inheritDoc
     */
    public function getSetClauses()
    {
        return $this->getQueryBuilder(function (Clause\SetInterface $qb) {
            return $qb->getSetClauses();
        });
    }

    /**
     * @inheritDoc
     */
    public function addSet($_)
    {
        $args = $this->replaceSelfReference(func_get_args());
        $this->getQueryBuilder(function (Clause\SetInterface $qb) use ($args) {
            $qb->addSet($args);
        });

        return $this;
    }

    /**
     * @inheritDoc
     */
    public function getWhereClauses()
    {
        return $this->getQueryBuilder(function (Clause\WhereInterface $qb) {
            return $qb->getWhereClauses();
        });
    }

    /**
     * @inheritDoc
     */
    public function andWhere($_)
    {
        $args = $this->replaceSelfReference(func_get_args());
        $this->getQueryBuilder(function (Clause\WhereInterface $qb) use ($args) {
            $qb->andWhere($args);
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
        });

        return $this;
    }

    /**
     * @inheritDoc
     */
    public function getJoinTables()
    {
        return $this->getQueryBuilder(function (Clause\JoinInterface $qb) {
            return $qb->getJoinTables();
        });
    }

    /**
     * @inheritDoc
     */
    public function doJoin($joinType, $table, $alias = null, $joinOn = null)
    {
        return $this->getQueryBuilder(function (Clause\JoinInterface $qb) use ($joinType, $table, $alias, $joinOn) {
            $relativeJoin = $this->createRelativeClause($joinOn);
            return $qb->doJoin($joinType, $table, $alias, $relativeJoin);
        });
    }

    /**
     * @inheritDoc
     */
    public function join($table, $alias = null, $joinOn = null)
    {
        return $this->doJoin(JoinType::JOIN, $table, $alias, $joinOn);
    }

    /**
     * @inheritDoc
     */
    public function straightJoin($table, $alias = null, $joinOn = null)
    {
        return $this->doJoin(JoinType::STRAIGHT_JOIN, $table, $alias, $joinOn);
    }

    /**
     * @inheritDoc
     */
    public function crossJoin($table, $alias = null, $joinOn = null)
    {
        return $this->doJoin(JoinType::CROSS_JOIN, $table, $alias, $joinOn);
    }

    /**
     * @inheritDoc
     */
    public function leftJoin($table, $alias = null, $joinOn = null)
    {
        return $this->doJoin(JoinType::LEFT_JOIN, $table, $alias, $joinOn);
    }

    /**
     * @inheritDoc
     */
    public function rightJoin($table, $alias = null, $joinOn = null)
    {
        return $this->doJoin(JoinType::RIGHT_JOIN, $table, $alias, $joinOn);
    }

    /**
     * @inheritDoc
     */
    public function innerJoin($table, $alias = null, $joinOn = null)
    {
        return $this->doJoin(JoinType::INNER_JOIN, $table, $alias, $joinOn);
    }
}

1		<?php
2
3		/**
4		* This file is part of UnderQuery package.
5		*
6		* Copyright (c) 2016 Beniamin Jonatan Šimko
7		*
8		* For the full copyright and license information, please view the LICENSE
9		* file that was distributed with this source code.
10		*/
11
12		namespace Phuria\UnderQuery\Table;
13
14		use Phuria\UnderQuery\JoinType;
15		use Phuria\UnderQuery\Language\Expression\RelativeClause;
16		use Phuria\UnderQuery\QueryBuilder\Clause as Clause;
17		use Phuria\UnderQuery\QueryBuilder\BuilderInterface;
18		use Phuria\UnderQuery\QueryBuilder\Clause\OrderByInterface;
19		use Phuria\UnderQuery\QueryBuilder\Clause\SetInterface;
20		use Phuria\UnderQuery\QueryBuilder\Clause\WhereInterface;
21		use Phuria\UnderQuery\Utils\RecursiveArgs;
22
23		/**
24		* @author Beniamin Jonatan Šimko <[email protected]>
25		*/
26		class RelativeQueryBuilder implements
27		Clause\GroupByInterface,
28		Clause\HavingInterface,
29		Clause\JoinInterface,
30		Clause\LimitInterface,
31		Clause\OrderByInterface,
32		Clause\SelectInterface,
33		Clause\SetInterface,
34		Clause\WhereInterface
35		{
36		/**
37		* @var BuilderInterface
38		*/
39		private $wrappedBuilder;
40
41		/**
42		* @var TableInterface
43		*/
44		private $wrappedTable;
45
46		/**
47		* @param BuilderInterface $builder
48		* @param TableInterface $table
49		*/
50	1	public function __construct(BuilderInterface $builder, TableInterface $table)
51		{
52	1	$this->wrappedBuilder = $builder;
53	1	$this->wrappedTable = $table;
54	1	}
55
56		/**
57		* @inheritdoc
58		*/
59	1	public function __destruct()
60		{
61	1	unset($this->wrappedBuilder, $this->wrappedTable);
62	1	}
63
64		/**
65		* @param array $args
66		*
67		* @return array
68		*/
69	1	public function replaceSelfReference(array $args)
70		{
71		return RecursiveArgs::map($args, function ($arg) {
72	1	return $this->createRelativeClause($arg);
73	1	});
74		}
75
76		/**
77		* @param mixed $clause
78		*
79		* @return RelativeClause
80		*/
81	1	private function createRelativeClause($clause)
82		{
83	1	return new RelativeClause($this->wrappedTable, $clause, RelativeClause::RELATIVE_DIRECTIVE);
84		}
85
86		/**
87		* @param callable $callback
88		*
89		* @return mixed
90		*/
91	1	private function getQueryBuilder(callable $callback)
92		{
93	1	return $callback($this->wrappedBuilder);
94		}
95
96		/**
97		* @inheritdoc
98		*/
99	1	public function addSelect($_)
100		{
101	1	$args = $this->replaceSelfReference(func_get_args());
102		$this->getQueryBuilder(function (Clause\SelectInterface $qb) use ($args) {
103	1	$qb->addSelect($args);
104	1	});
105
106	1	return $this;
107		}
108
109		/**
110		* @inheritdoc
111		*/
112	1	public function getSelectClauses()
113		{
114		return $this->getQueryBuilder(function (Clause\SelectInterface $qb) {
115	1	return $qb->getSelectClauses();
116	1	});
117		}
118
119		/**
120		* @inheritdoc
121		*/
122		public function getGroupByClauses()
123		{
124		return $this->getQueryBuilder(function (Clause\GroupByInterface $qb) {
125		return $qb->getGroupByClauses();
126		});
127		}
128
129		/**
130		* @inheritdoc
131		*/
132		public function isGroupByWithRollUp()
133		{
134		return $this->getQueryBuilder(function (Clause\GroupByInterface $qb) {
135		return $qb->isGroupByWithRollUp();
136		});
137		}
138
139		/**
140		* @inheritdoc
141		*/
142		public function addGroupBy($_)
143		{
144		$args = $this->replaceSelfReference(func_get_args());
145		$this->getQueryBuilder(function (Clause\GroupByInterface $qb) use ($args) {
146		$qb->addGroupBy($args);
147		});
148
149		return $this;
150		}
151
152		/**
153		* @inheritdoc
154		*/
155		public function setGroupByWithRollUp($groupByWithRollUp)
156		{
157		$this->getQueryBuilder(function (Clause\GroupByInterface $qb) use ($groupByWithRollUp) {
158		$qb->setGroupByWithRollUp($groupByWithRollUp);
159		});
160
161		return $this;
162		}
163
164		/**
165		* @inheritdoc
166		*/
167		public function getHavingClauses()
168		{
169		return $this->getQueryBuilder(function (Clause\HavingInterface $qb) {
170		return $qb->getHavingClauses();
171		});
172		}
173
174		/**
175		* @inheritdoc
176		*/
177		public function andHaving($_)
178		{
179		$args = $this->replaceSelfReference(func_get_args());
180		$this->getQueryBuilder(function (Clause\HavingInterface $qb) use ($args) {
181		$qb->andHaving($args);
182		});
183
184		return $this;
185		}
186
187		/**
188		* @inheritdoc
189		*/
190		public function getLimitClause()
191		{
192		return $this->getQueryBuilder(function (Clause\LimitInterface $qb) {
193		return $qb->getLimitClause();
194		});
195		}
196
197		/**
198		* @inheritdoc
199		*/
200		public function setLimit($limitClause)
201		{
202		$this->getQueryBuilder(function (Clause\LimitInterface $qb) use ($limitClause) {
203		$qb->setLimit($limitClause);
204		});
205
206		return $this;
207		}
208
209		/**
210		* @inheritdoc
211		*/
212		public function getOrderByClauses()
213		{
214		return $this->getQueryBuilder(function (Clause\OrderByInterface $qb) {
215		return $qb->getOrderByClauses();
216		});
217		}
218
219		/**
220		* @inheritDoc
221		*/
222		public function addOrderBy($_)
223		{
224		$args = $this->replaceSelfReference(func_get_args());
225		$this->getQueryBuilder(function (Clause\OrderByInterface $qb) use ($args) {
226		$qb->addOrderBy($args);
227		});
228
229		return $this;
230		}
231
232		/**
233		* @inheritDoc
234		*/
235		public function getSetClauses()
236		{
237		return $this->getQueryBuilder(function (Clause\SetInterface $qb) {
238		return $qb->getSetClauses();
239		});
240		}
241
242		/**
243		* @inheritDoc
244		*/
245		public function addSet($_)
246		{
247		$args = $this->replaceSelfReference(func_get_args());
248		$this->getQueryBuilder(function (Clause\SetInterface $qb) use ($args) {
249		$qb->addSet($args);
250		});
251
252		return $this;
253		}
254
255		/**
256		* @inheritDoc
257		*/
258		public function getWhereClauses()
259		{
260		return $this->getQueryBuilder(function (Clause\WhereInterface $qb) {
261		return $qb->getWhereClauses();
262		});
263		}
264
265		/**
266		* @inheritDoc
267		*/
268		public function andWhere($_)
269		{
270		$args = $this->replaceSelfReference(func_get_args());
271		$this->getQueryBuilder(function (Clause\WhereInterface $qb) use ($args) {
272		$qb->andWhere($args);
		0 ignored issues – show Documentation introduced 2016-11-20 05:18 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$args` is of type `array`, but the function expects a `string`. It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { } $x = '123'; // string "123" // Instead of acceptsInteger($x); // we recommend to use acceptsInteger((integer) $x); Loading history...
273		});
274
275		return $this;
276		}
277
278		/**
279		* @inheritDoc
280		*/
281		public function getJoinTables()
282		{
283		return $this->getQueryBuilder(function (Clause\JoinInterface $qb) {
284		return $qb->getJoinTables();
285		});
286		}
287
288		/**
289		* @inheritDoc
290		*/
291		public function doJoin($joinType, $table, $alias = null, $joinOn = null)
292		{
293		return $this->getQueryBuilder(function (Clause\JoinInterface $qb) use ($joinType, $table, $alias, $joinOn) {
294		$relativeJoin = $this->createRelativeClause($joinOn);
295		return $qb->doJoin($joinType, $table, $alias, $relativeJoin);
296		});
297		}
298
299		/**
300		* @inheritDoc
301		*/
302		public function join($table, $alias = null, $joinOn = null)
303		{
304		return $this->doJoin(JoinType::JOIN, $table, $alias, $joinOn);
305		}
306
307		/**
308		* @inheritDoc
309		*/
310		public function straightJoin($table, $alias = null, $joinOn = null)
311		{
312		return $this->doJoin(JoinType::STRAIGHT_JOIN, $table, $alias, $joinOn);
313		}
314
315		/**
316		* @inheritDoc
317		*/
318		public function crossJoin($table, $alias = null, $joinOn = null)
319		{
320		return $this->doJoin(JoinType::CROSS_JOIN, $table, $alias, $joinOn);
321		}
322
323		/**
324		* @inheritDoc
325		*/
326		public function leftJoin($table, $alias = null, $joinOn = null)
327		{
328		return $this->doJoin(JoinType::LEFT_JOIN, $table, $alias, $joinOn);
329		}
330
331		/**
332		* @inheritDoc
333		*/
334		public function rightJoin($table, $alias = null, $joinOn = null)
335		{
336		return $this->doJoin(JoinType::RIGHT_JOIN, $table, $alias, $joinOn);
337		}
338
339		/**
340		* @inheritDoc
341		*/
342		public function innerJoin($table, $alias = null, $joinOn = null)
343		{
344		return $this->doJoin(JoinType::INNER_JOIN, $table, $alias, $joinOn);
345		}
346		}

phuria / under-query

Issues (19)

Security Analysis no request data

src/Table/RelativeQueryBuilder.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like