Issues (42)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

app/Satis/ConfigManager.php (9 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace App\Satis;
4
5
use App\Satis\Collections\PackageCollection;
6
use App\Satis\Context\PrivateRepository;
7
use App\Satis\Context\PublicRepository;
8
use App\Satis\Exceptions\PackageNotFoundException;
9
use App\Satis\Model\Package;
10
use BadMethodCallException;
11
use App\Satis\Collections\RepositoryCollection;
12
use App\Satis\Exceptions\RepositoryNotFoundException;
13
use App\Satis\Model\Repository;
14
use Illuminate\Support\Collection;
15
use JMS\Serializer\Serializer;
16
use Monolog\Formatter\LineFormatter;
17
use Monolog\Handler\StreamHandler;
18
use Monolog\Logger;
19
20
/**
21
 * @method string addOrUpdateRepository($repositoryId, Collection $repositoryData);
22
 * @method string addOrUpdatePackage($packageId, Collection $packageData);
23
 * @method void deleteRepository($repositoryId);
24
 * @method void deletePackage($packageId);
25
 * @property \App\Satis\Model\Config $satis;
26
 *
27
 * @author Lukas Homza <[email protected]>
28
 */
29
class ConfigManager {
30
    const BUILD_PRIVATE = 1;
31
    const BUILD_PUBLIC = 2;
32
33
    /** @var \App\Satis\ConfigPersister $configPersister */
34
    protected $configPersister;
35
    /** @var \App\Satis\ConfigBuilder $configBuilder */
36
    protected $configBuilder;
37
    /** @var \JMS\Serializer\Serializer $serializer */
38
    protected $serializer;
39
    /** @var \App\Satis\Model\Config $_satis */
40
    protected $_satis;
41
42
    /** @var bool $disableBuild */
43
    protected $disableBuild = false;
44
45
    /** @var string  */
46
    protected $hiddenEntityPrefix = '_';
47
48
    /** @var array  */
49
    protected $lazyLoadedProperties = [
50
        '_satis' => 'loadSatisConfig'
51
    ];
52
53
    /**
54
     * @return \App\Satis\Model\Config
55
     * @throws \Illuminate\Contracts\Filesystem\FileNotFoundException
56
     */
57
    protected function loadSatisConfig() {
58
        return $this->serializer->deserialize(
0 ignored issues
show
Bug Best Practice introduced by
The return type of return $this->serializer...odel\\Config', 'json'); (object|array|integer|double|string|boolean) is incompatible with the return type documented by App\Satis\ConfigManager::loadSatisConfig of type App\Satis\Model\Config.

If you return a value from a function or method, it should be a sub-type of the type that is given by the parent type f.e. an interface, or abstract method. This is more formally defined by the Lizkov substitution principle, and guarantees that classes that depend on the parent type can use any instance of a child type interchangably. This principle also belongs to the SOLID principles for object oriented design.

Let’s take a look at an example:

class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}

Our function my_function expects a Post object, and outputs the author of the post. The base class Post returns a simple string and outputting a simple string will work just fine. However, the child class BlogPost which is a sub-type of Post instead decided to return an object, and is therefore violating the SOLID principles. If a BlogPost were passed to my_function, PHP would not complain, but ultimately fail when executing the strtoupper call in its body.

Loading history...
59
            $this->configPersister->load(),
60
            'App\Satis\Model\Config',
61
            'json'
62
        );
63
    }
64
65
    /**
66
     * @return \Monolog\Logger
67
     */
68
    protected function getLogger() {
69
        $handler = new StreamHandler(storage_path('logs/api_request.log'), Logger::DEBUG);
70
        $handler->setFormatter(new LineFormatter(null, null, true, true));
71
72
        $logger = new Logger('ApiRequestLog');
73
        $logger->pushHandler($handler);
74
75
        return $logger;
76
    }
77
78
    /**
79
     * @param \App\Satis\Collections\RepositoryCollection $repositoryCollection
80
     * @param string $repositoryId
81
     * @param \Illuminate\Support\Collection $input
82
     * @return \App\Satis\Collections\RepositoryCollection
83
     * @throws \App\Satis\Exceptions\RepositoryNotFoundException
84
     */
85
    protected function _addOrUpdateRepository(RepositoryCollection $repositoryCollection, $repositoryId,
86
        Collection $input
87
    ) {
88
        $repository = new Repository();
89
        $repository->setUrl($input->get('url'));
90
        $repository->setType($input->get('type', config('satis.default_repository_type')));
91
92
        if($input->has('async_mode')) {
93
            $this->configBuilder->setAsyncMode(filter_var($input->get('async_mode'), FILTER_VALIDATE_BOOLEAN));
94
        }
95
96
        if($input->has('disable_build')) {
97
            $this->setDisableBuild(filter_var($input->get('disable_build'), FILTER_VALIDATE_BOOLEAN));
98
        }
99
100
        if($repositoryId !== null) {
101
            if($repositoryCollection->has($repositoryId)) {
102
                $repositoryCollection->put($repositoryId, $repository);
103
            } else {
104
                throw new RepositoryNotFoundException('Repository with ID "' . $repositoryId . '" does not exist.');
105
            }
106
        } else {
107
            $repositoryId = static::nameToId($repository->getUrl());
108
109
            $repositoryCollection->put($repositoryId, $repository);
110
        }
111
112
        $buildContext = new PrivateRepository();
113
        $buildContext->setItemId($repositoryId)->setItemName($repository->getUrl());
114
115
        $this->configBuilder->setBuildContext($buildContext);
116
117
        return $repositoryCollection;
118
    }
119
120
    /**
121
     * @param \App\Satis\Collections\PackageCollection $packageCollection
122
     * @param string $packageId
123
     * @param \Illuminate\Support\Collection $input
124
     * @return \App\Satis\Collections\RepositoryCollection
125
     * @throws \App\Satis\Exceptions\PackageNotFoundException
126
     */
127
    protected function _addOrUpdatePackage(PackageCollection $packageCollection, $packageId,
128
        Collection $input
129
    ) {
130
        $package = new Package();
131
        $package->setName($input->get('name'));
132
133
        if($input->has('async_mode')) {
134
            $this->configBuilder->setAsyncMode(filter_var($input->get('async_mode'), FILTER_VALIDATE_BOOLEAN));
135
        }
136
137
        if($input->has('disable_build')) {
138
            $this->setDisableBuild(filter_var($input->get('disable_build'), FILTER_VALIDATE_BOOLEAN));
139
        }
140
141
        if($packageId !== null) {
142
            if($packageCollection->has($packageId)) {
143
                $packageCollection->put($packageId, $package);
144
            } else {
145
                throw new PackageNotFoundException('Package with ID "' . $packageId . '" does not exist.');
146
            }
147
        } else {
148
            $packageId = static::nameToId($package->getName());
149
150
            $packageCollection->put($packageId, $package);
151
        }
152
153
        $buildContext = new PublicRepository();
154
        $buildContext->setItemId($packageId)->setItemName($package->getName());
155
156
        $this->configBuilder->setBuildContext($buildContext);
157
158
        return $packageCollection;
159
    }
160
161
    /**
162
     * @param \App\Satis\Collections\RepositoryCollection $repositoryCollection
163
     * @param string $repositoryId
164
     * @return \App\Satis\Collections\RepositoryCollection
165
     * @throws \App\Satis\Exceptions\RepositoryNotFoundException
166
     */
167
    protected function _deleteRepository(RepositoryCollection $repositoryCollection, $repositoryId) {
168
        if($repositoryCollection->has($repositoryId)) {
169
            $repositoryCollection->forget($repositoryId);
170
        } else {
171
            throw new RepositoryNotFoundException('Repository with ID "' . $repositoryId . '" does not exist.');
172
        }
173
174
        $this->setDisableBuild(true);
175
176
        return $repositoryCollection;
177
    }
178
179
    /**
180
     * @param \App\Satis\Collections\PackageCollection $packageCollection
181
     * @param string $packageId
182
     * @return \App\Satis\Collections\RepositoryCollection
183
     * @throws \App\Satis\Exceptions\RepositoryNotFoundException
184
     */
185
    protected function _deletePackage(PackageCollection $packageCollection, $packageId) {
186
        if($packageCollection->has($packageId)) {
187
            $packageCollection->forget($packageId);
188
        } else {
189
            throw new RepositoryNotFoundException('Package with ID "' . $packageId . '" does not exist.');
190
        }
191
192
        $this->setDisableBuild(true);
193
194
        return $packageCollection;
195
    }
196
197
    /**
198
     * @param string $repositoryUrl
199
     * @return string
200
     */
201
    public static function nameToId($repositoryUrl) {
202
        return md5($repositoryUrl);
203
    }
204
205
    /**
206
     * @param \App\Satis\ConfigPersister $configPersister
207
     * @param ConfigBuilder $configBuilder
208
     * @param \JMS\Serializer\Serializer $serializer
209
     */
210
    public function __construct(ConfigPersister $configPersister, ConfigBuilder $configBuilder,
211
                                Serializer $serializer
212
    ) {
213
        $this->configPersister = $configPersister;
214
        $this->configBuilder = $configBuilder;
215
        $this->serializer = $serializer;
216
    }
217
218
    /**
219
     * @param string $method
220
     * @param array $arguments
221
     *
222
     * @return mixed
223
     *
224
     * @throws \Exception
225
     */
226
    public function __call($method, array $arguments) {
227
        $method = $this->hiddenEntityPrefix . $method;
228
229
        if(method_exists($this, $method)) {
230
            $logger = $this->getLogger();
231
232
            $logger->info(str_repeat('=', 30));
233
            $logger->info('Request => ' . \Request::method() . ' (' . $method .') => '. json_encode($arguments));
234
235
            $type = str_plural(last(explode('_', snake_case($method))), 2);
236
237
            array_unshift($arguments, $this->satis->{'get' . ucfirst($type)}());
0 ignored issues
show
The property satis does not seem to exist. Did you mean _satis?

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
238
239
            try {
240
                $items = call_user_func_array([$this, $method], $arguments);
241
            } catch(\Exception $e) {
242
                $logger->info('Response => ' . $e->getMessage());
243
                $logger->info(str_repeat('=', 30));
244
245
                throw $e;
246
            }
247
248
            $this->satis->{'set' . $type}($items);
0 ignored issues
show
The property satis does not seem to exist. Did you mean _satis?

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
249
250
            return $this->save();
251
        } else {
252
            throw new BadMethodCallException('Called method "' . $method . '" does not exist.');
253
        }
254
    }
255
256
    /**
257
     * @param string $property
258
     * @return mixed
259
     */
260
    public function __get($property) {
261
        $property = $this->hiddenEntityPrefix.$property;
262
263
        if(isset($this->lazyLoadedProperties[$property])) {
264
            $this->{$property} = $this->{$this->lazyLoadedProperties[$property]}();
265
            
266
            unset($this->lazyLoadedProperties[$property]);
267
        }
268
269
        return $this->{$property};
270
    }
271
272
    /**
273
     * @param boolean $disableBuild
274
     * @return ConfigManager
275
     */
276
    public function setDisableBuild($disableBuild) {
277
        $this->disableBuild = $disableBuild;
278
279
        return $this;
280
    }
281
282
    /**
283
     * @param string|null $repositoryId
284
     * @return string
285
     * @throws \App\Satis\Exceptions\RepositoryNotFoundException
286
     */
287 View Code Duplication
    public function getRepositories($repositoryId = null) {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
288
        $repositoryCollection = $this->satis->getRepositories();
0 ignored issues
show
The property satis does not seem to exist. Did you mean _satis?

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
289
290
        if($repositoryId !== null) {
291
            if(!$repositoryCollection->has($repositoryId)) {
292
                throw new RepositoryNotFoundException('Repository with ID "' . $repositoryId . '" does not exist.');
293
            }
294
295
            $output = $repositoryCollection->get($repositoryId);
296
        } else {
297
            $output = $repositoryCollection;
298
        }
299
300
        return $this->serializer->serialize($output, 'json');
301
    }
302
303
	/**
304
     * @param string|null $packageId
305
     * @return string
306
     * @throws \App\Satis\Exceptions\PackageNotFoundException
307
     */
308 View Code Duplication
    public function getPackages($packageId = null) {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
309
        $packageCollection = $this->satis->getPackages();
0 ignored issues
show
The property satis does not seem to exist. Did you mean _satis?

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
310
311
        if($packageId !== null) {
312
            if(!$packageCollection->has($packageId)) {
313
                throw new PackageNotFoundException('Package with ID "' . $packageId . '" does not exist.');
314
            }
315
316
            $output = $packageCollection->get($packageId);
317
        } else {
318
            $output = $packageCollection;
319
        }
320
321
        return $this->serializer->serialize($output, 'json');
322
    }
323
324
	/**
325
     * @param \App\Satis\BuildContext $buildContext
326
     */
327
    public function forceBuild(BuildContext $buildContext) {
328
        if($buildContext->getItemName() !== null) {
329
            $buildContext->setItemId(self::nameToId($buildContext->getItemName()));
330
        }
331
332
        $this->configBuilder
333
            ->setBuildContext($buildContext)
334
            ->build();
335
    }
336
337
    /**
338
     * @return bool
339
     */
340
    public function isBuilding() {
341
        return $this->configPersister->isLocked();
342
    }
343
344
    /**
345
     * @return \App\Satis\Model\Config
346
     */
347
    public function getDefinition() {
348
        return $this->satis;
0 ignored issues
show
The property satis does not seem to exist. Did you mean _satis?

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
349
    }
350
351
    /**
352
     * @return string
353
     */
354
    public function save() {
355
        $satisConfig = $this->serializer->serialize($this->satis, 'json');
0 ignored issues
show
The property satis does not seem to exist. Did you mean _satis?

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
356
357
        $this->configPersister->updateWith($satisConfig);
358
359
        if($this->disableBuild === false) {
360
            return $this->configBuilder->build();
361
        }
362
363
        return true;
364
    }
365
}
366