Issues (21)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

lib/ValidationUtils.php (4 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Ridibooks\Platform\Common;
4
5
use Ridibooks\Exception\MsgException;
6
7
class ValidationUtils
8
{
9
	/**
10
	 * 입력된 필드가 null이거나 비어있을(empty) 경우 exception
11
	 * @param string $field
12
	 * @param string $msg
13
	 * @throws \Ridibooks\Exception\MsgException
14
	 */
15
	public static function checkNullField($field, $msg)
16
	{
17
		if (StringUtils::isEmpty($field)) {
18
			throw new MsgException($msg);
19
		}
20
	}
21
22
	/**
23
	 * 입력된 필드가 숫자가 아닐 경우 exception
24
	 * @param $field
25
	 * @param string $msg
26
	 * @throws \Ridibooks\Exception\MsgException
27
	 */
28
	public static function checkNumberField($field, $msg)
29
	{
30
		if ((StringUtils::isEmpty($field) === false) && !is_numeric($field)) {
31
			throw new MsgException($msg);
32
		}
33
	}
34
35
	/**
36
	 * 입력된 필드의 최소 길이보다 작을 경우 exception
37
	 * @param object $field
38
	 * @param int $minLength
39
	 * @param string $msg
40
	 * @throws \Ridibooks\Exception\MsgException
41
	 */
42
	public static function checkMinLength($field, $minLength, $msg)
43
	{
44 View Code Duplication
		if ((StringUtils::isEmpty($field) === false) && mb_strlen($field) < $minLength) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
45
			throw new MsgException($msg);
46
		}
47
	}
48
49
	/**
50
	 * 입력된 필드의 길이가 정해진 길이와 다를 경우 exception
51
	 * @param object $field
52
	 * @param int $length
53
	 * @param string $msg
54
	 * @throws \Ridibooks\Exception\MsgException
55
	 */
56
	public static function checkLength($field, $length, $msg)
57
	{
58 View Code Duplication
		if ((StringUtils::isEmpty($field) === false) && mb_strlen($field) != $length) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
59
			throw new MsgException($msg);
60
		}
61
	}
62
63
	/**
64
	 * 입력된 필드의 값이 적합한 datetime 형식이 아닐 경우 exception
65
	 * @param string $field
66
	 * @param string $format
67
	 * @param string $msg
68
	 * @throws MsgException
69
	 */
70
	public static function checkDatetimeFormat($field, $format, $msg)
71
	{
72
		$date = date($format, strtotime($field));
73
		if ($field !== $date) {
74
			throw new MsgException($msg);
75
		}
76
	}
77
78
	/**
79
	 * @param string $start
80
	 * @param string $end
81
	 * @param string $message
82
	 * @throws MsgException
83
	 */
84
	public static function checkDatetimePeriod($start, $end, $message)
85
	{
86
		$timestamp_start = strtotime($start);
87
		$timestamp_end = strtotime($end);
88
		if ($timestamp_end < $timestamp_start) {
89
			throw new MsgException($message);
90
		}
91
	}
92
93
	/**
94
	 * ISBN10 값 유효성 체크한다.
95
	 * https://en.wikipedia.org/wiki/International_Standard_Book_Number#ISBN-10_check_digit_calculation
96
	 * @param $isbn
97
	 * @throws MsgException
98
	 */
99 View Code Duplication
	public static function checkIsbn10Number($isbn)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
100
	{
101
		$isbn = trim($isbn);
102
		if (mb_strlen($isbn) !== 10 || preg_match('/0{10}/', $isbn)) {
103
			throw new MsgException("ISBN10 형식에 맞지 않습니다.");
104
		}
105
106
		$total = 0;
107
		for ($i = 0; $i < 9; $i++) {
108
			$digit = intval(substr($isbn, $i, 1));
109
			$total += ((10 - $i) * $digit);
110
		}
111
112
		$check_sum = (11 - ($total % 11)) % 11;
113
		if ($check_sum === 10) {
114
			$check_sum = 'X';
115
		}
116
117
		if ($check_sum != substr($isbn, 9)) {
118
			throw new MsgException("ISBN10 형식에 맞지 않습니다.");
119
		}
120
	}
121
122
	/**
123
	 * ISBN13 값 유효성 체크한다.
124
	 * http://en.wikipedia.org/wiki/International_Standard_Book_Number#ISBN-13_check_digit_calculation
125
	 * @param string $isbn
126
	 * @throws MsgException
127
	 */
128
	public static function checkIsbn13Number($isbn)
129
	{
130
		$isbn = trim($isbn);
131
		if (mb_strlen($isbn) !== 13 || preg_match('/0{13}/', $isbn)) {
132
			throw new MsgException("ISBN13 형식에 맞지 않습니다.");
133
		}
134
135
		if (!is_numeric($isbn)) {
136
			throw new MsgException('ISBN13 형식에 맞지 않습니다.');
137
		}
138
139
		$total = 0;
140
141
		for ($i = 0; $i < 12; $i++) {
142
			$digit = intval(substr($isbn, $i, 1));
143
			$total += ($i % 2 === 0) ? $digit : $digit * 3;
144
		}
145
146
		$check_sum = 10 - ($total % 10);
147
		if ($check_sum === 10) {
148
			$check_sum = 0;
149
		}
150
151
		if ($check_sum !== intval(substr($isbn, -1))) {
152
			throw new MsgException("ISBN13 형식에 맞지 않습니다.");
153
		}
154
	}
155
156
	/**
157
	 * ECN 값 유효성 체크한다.
158
	 *
159
	 * ex) ecn sample
160
	 * ECN-0102-2008-000-123456789
161
	 * I410-ECN-0199-2009-657-010848674
162
	 * @param $ecn
163
	 * @throws MsgException
164
	 */
165
	public static function checkEcn($ecn)
166
	{
167
		$ecn = trim(StringUtils::removeHyphen($ecn));
168
		/*
169
		 * ECN을 더이상 사용하지 않고, 그 대안으로 UCI를 사용하도록 하였다.
170
		 * 기존에 ECN을 발급받은 도서들의 경우
171
		 * UCI를 발급받지 않고,
172
		 * ECN 번호 앞에 I410을 붙여 UCI 번호로 하기로 하였다.
173
		 */
174
		$ecn = str_replace('I410', '', $ecn);
175
176
		if (mb_strlen($ecn) !== 23 || preg_match('/0{23}/', $ecn)) {
177
			throw new MsgException('ECN 형식에 맞지 않습니다.');
178
		}
179
	}
180
181
	/**
182
	 * ISSN 값 유효성 체크한다.
183
	 * https://en.wikipedia.org/wiki/International_Standard_Serial_Number#Code_format
184
	 * @param $issn
185
	 * @throws MsgException
186
	 */
187 View Code Duplication
	public static function checkIssn($issn)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
188
	{
189
		$issn = trim(StringUtils::removeHyphen($issn));
190
191
		if (mb_strlen($issn) !== 8 || preg_match('/0{8}/', $issn)) {
192
			throw new MsgException('ISSN 형식에 맞지 않습니다.');
193
		}
194
195
		$total = 0;
196
197
		for ($i = 0; $i < 7; $i++) {
198
			$digit = intval(substr($issn, $i, 1));
199
			$total += ((8 - $i) * $digit);
200
		}
201
202
		$check_sum = 11 - ($total % 11);
203
		if ($check_sum === 10) {
204
			$check_sum = 'X';
205
		}
206
207
		if ($check_sum != substr($issn, -1)) {
208
			throw new MsgException("ISSN 형식에 맞지 않습니다.");
209
		}
210
	}
211
212
	public static function checkHtml($html, $msg)
213
	{
214
		if (HtmlUtils::isValidHtmlTag($html, HtmlUtils::$cms_allowable_tags) === false) {
215
			throw new MsgException($msg);
216
		}
217
	}
218
219
	public static function checkPhoneNumber(string $phone, string $msg)
220
	{
221
		$expression = '/^(0[0-9]{1,2}-?)([0-9]{3,4}-?)([0-9]{4})$/';
222
		if (!preg_match($expression, $phone)) {
223
			throw new MsgException($msg);
224
		}
225
	}
226
227
	public static function checkMailAddress(string $mail, string $msg)
228
	{
229
		$expression = '/(^[\w\.\+\-]+)@([-A-Za-z0-9]+\.){1,4}([A-Za-z]{2,4})$/';
230
		if (!preg_match($expression, $mail)) {
231
			throw new MsgException($msg);
232
		}
233
	}
234
}
235