Issues (129)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Foundation/Application.php (1 issue)

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace YEntWeChat\Foundation;
4
5
use Doctrine\Common\Cache\Cache as CacheInterface;
6
use Doctrine\Common\Cache\FilesystemCache;
7
use YEntWeChat\Core\AccessToken;
8
use YEntWeChat\Core\Exceptions\InvalidConfigException;
9
use YEntWeChat\Core\Http;
10
use YEntWeChat\Support\Log;
11
use Monolog\Handler\HandlerInterface;
12
use Monolog\Handler\NullHandler;
13
use Monolog\Handler\StreamHandler;
14
use Monolog\Logger;
15
use Pimple\Container;
16
use Symfony\Component\HttpFoundation\Request;
17
18
/**
19
 * Class Application.
20
 *
21
 * @property \EntWeChat\Core\AccessToken                $access_token
22
 * @property \EntWeChat\Server\Guard                    $server
23
 * @property \EntWeChat\User\User                       $user
24
 * @property \EntWeChat\User\Tag                        $user_tag
25
 * @property \EntWeChat\User\Department                 $user_department
26
 * @property \EntWeChat\User\Batch                      $user_batch
27
 * @property \EntWeChat\Js\Js                           $js
28
 * @property \EntWeChat\Js\Contact                      $js_contact
29
 * @property \EntWeChat\Menu\Menu                       $menu
30
 * @property \EntWeChat\Broadcast\Broadcast             $broadcast
31
 * @property \EntWeChat\Material\Material               $material
32
 * @property \EntWeChat\Material\Temporary              $material_temporary
33
 * @property \EntWeChat\Card\Card                       $card
34
 * @property \EntWeChat\Agent\Agent                     $agent
35
 * @property \EntWeChat\Chat\Chat                       $chat
36
 * @property \EntWeChat\ShakeAround\ShakeAround         $shakearound
37
 * @property \EntWeChat\Soter\Soter                     $soter
38
 * @property \EntWeChat\Payment\Merchant                $merchant
39
 * @property \EntWeChat\Payment\Payment                 $payment
40
 * @property \EntWeChat\Payment\LuckyMoney\LuckyMoney   $lucky_money
41
 * @property \EntWeChat\Payment\MerchantPay\MerchantPay $merchant_pay
42
 * @property \EntWeChat\Payment\CashCoupon\CashCoupon   $cash_coupon
43
 * @property \EntWeChat\Auth\App                        $oauth
44
 * @property \EntWeChat\Auth\Web                        $auth
45
 * @property \EntWeChat\Staff\Staff                     $staff
46
 * @property \EntWeChat\Suite\Suite                     $suite
47
 * @property \EntWeChat\OA\API                          $oa
48
 *
49
 * @method \EntWeChat\Support\Collection getCallbackIp()
50
 */
51
class Application extends Container
52
{
53
    /**
54
     * Service Providers.
55
     *
56
     * @var array
57
     */
58
    protected $providers = [
59
        ServiceProviders\ServerServiceProvider::class,
60
        ServiceProviders\UserServiceProvider::class,
61
        ServiceProviders\JsServiceProvider::class,
62
        ServiceProviders\MenuServiceProvider::class,
63
        ServiceProviders\BroadcastServiceProvider::class,
64
        ServiceProviders\CardServiceProvider::class,
65
        ServiceProviders\MaterialServiceProvider::class,
66
        ServiceProviders\AgentServiceProvider::class,
67
        ServiceProviders\ChatServiceProvider::class,
68
        ServiceProviders\SoterServiceProvider::class,
69
        ServiceProviders\OAuthServiceProvider::class,
70
        ServiceProviders\PaymentServiceProvider::class,
71
        ServiceProviders\ShakeAroundServiceProvider::class,
72
        ServiceProviders\StaffServiceProvider::class,
73
        ServiceProviders\SuiteServiceProvider::class,
74
        ServiceProviders\FundamentalServiceProvider::class,
75
        ServiceProviders\OAServiceProvider::class,
76
    ];
77
78
    /**
79
     * Application constructor.
80
     *
81
     * @param array $config
82
     */
83
    public function __construct($config)
84
    {
85
        parent::__construct();
86
87
        $this['config'] = function () use ($config) {
88
            return new Config($config);
89
        };
90
91
        if ($this['config']['debug']) {
92
            error_reporting(E_ALL);
93
        }
94
95
        $this->registerProviders();
96
        $this->registerBase();
0 ignored issues
show
The call to the method YEntWeChat\Foundation\Application::registerBase() seems un-needed as the method has no side-effects.

PHP Analyzer performs a side-effects analysis of your code. A side-effect is basically anything that might be visible after the scope of the method is left.

Let’s take a look at an example:

class User
{
    private $email;

    public function getEmail()
    {
        return $this->email;
    }

    public function setEmail($email)
    {
        $this->email = $email;
    }
}

If we look at the getEmail() method, we can see that it has no side-effect. Whether you call this method or not, no future calls to other methods are affected by this. As such code as the following is useless:

$user = new User();
$user->getEmail(); // This line could safely be removed as it has no effect.

On the hand, if we look at the setEmail(), this method _has_ side-effects. In the following case, we could not remove the method call:

$user = new User();
$user->setEmail('email@domain'); // This line has a side-effect (it changes an
                                 // instance variable).
Loading history...
97
        $this->initializeLogger();
98
99
        Http::setDefaultOptions($this['config']->get('guzzle', ['timeout' => 5.0]));
100
101
        $this->logConfiguration($config);
102
    }
103
104
    /**
105
     * Load account.
106
     *
107
     * @param string $account
108
     *
109
     * @throws InvalidConfigException
110
     *
111
     * @return Application
112
     */
113
    public function account($account)
114
    {
115
        if (!isset($this['config']['account'][$account])) {
116
            throw new InvalidConfigException('This account not exist');
117
        }
118
119
        $this['config']->merge($this['config']['account'][$account]);
120
121
        return $this;
122
    }
123
124
    /**
125
     * Log configuration.
126
     *
127
     * @param array $config
128
     */
129
    public function logConfiguration($config)
130
    {
131
        $config = new Config($config);
132
133
        if ($config->has('account')) {
134
            $config->forget('account');
135
        }
136
137
        $keys = ['corp_id', 'secret', 'suite.suite_id', 'suite.secret'];
138
        foreach ($keys as $key) {
139
            !$config->has($key) || $config[$key] = '***'.substr($config[$key], -5);
140
        }
141
142
        Log::debug('Current config:', $config->toArray());
143
    }
144
145
    /**
146
     * Add a provider.
147
     *
148
     * @param string $provider
149
     *
150
     * @return Application
151
     */
152
    public function addProvider($provider)
153
    {
154
        array_push($this->providers, $provider);
155
156
        return $this;
157
    }
158
159
    /**
160
     * Set providers.
161
     *
162
     * @param array $providers
163
     */
164
    public function setProviders(array $providers)
165
    {
166
        $this->providers = [];
167
168
        foreach ($providers as $provider) {
169
            $this->addProvider($provider);
170
        }
171
    }
172
173
    /**
174
     * Return all providers.
175
     *
176
     * @return array
177
     */
178
    public function getProviders()
179
    {
180
        return $this->providers;
181
    }
182
183
    /**
184
     * Magic get access.
185
     *
186
     * @param string $id
187
     *
188
     * @return mixed
189
     */
190
    public function __get($id)
191
    {
192
        return $this->offsetGet($id);
193
    }
194
195
    /**
196
     * Magic set access.
197
     *
198
     * @param string $id
199
     * @param mixed  $value
200
     */
201
    public function __set($id, $value)
202
    {
203
        $this->offsetSet($id, $value);
204
    }
205
206
    /**
207
     * Register providers.
208
     */
209
    private function registerProviders()
210
    {
211
        foreach ($this->providers as $provider) {
212
            $this->register(new $provider());
213
        }
214
    }
215
216
    /**
217
     * Register basic providers.
218
     */
219
    private function registerBase()
220
    {
221
        $this['request'] = function () {
222
            return Request::createFromGlobals();
223
        };
224
225
        if (!empty($this['config']['cache']) && $this['config']['cache'] instanceof CacheInterface) {
226
            $this['cache'] = $this['config']['cache'];
227
        } else {
228
            $this['cache'] = function () {
229
                return new FilesystemCache(sys_get_temp_dir());
230
            };
231
        }
232
233
        $this['access_token'] = function () {
234
            return new AccessToken(
235
                $this['config']['corp_id'],
236
                $this['config']['secret'],
237
                $this['cache']
238
            );
239
        };
240
    }
241
242
    /**
243
     * Initialize logger.
244
     */
245
    private function initializeLogger()
246
    {
247
        if (Log::hasLogger()) {
248
            return;
249
        }
250
251
        $logger = new Logger('yentwechat');
252
253
        if (!$this['config']['debug'] || defined('PHPUNIT_RUNNING')) {
254
            $logger->pushHandler(new NullHandler());
255
        } elseif ($this['config']['log.handler'] instanceof HandlerInterface) {
256
            $logger->pushHandler($this['config']['log.handler']);
257
        } elseif ($logFile = $this['config']['log.file']) {
258
            $logger->pushHandler(new StreamHandler(
259
                $logFile,
260
                $this['config']->get('log.level', Logger::WARNING),
261
                true,
262
                $this['config']->get('log.permission', null)
263
            ));
264
        }
265
266
        Log::setLogger($logger);
267
    }
268
}
269