This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace Samrap\Acf\Fluent; |
||
4 | |||
5 | use Samrap\Acf\Behaviors\BehaviorInterface; |
||
6 | use Samrap\Acf\Exceptions\RunnerException; |
||
7 | |||
8 | class Runner |
||
9 | { |
||
10 | /** |
||
11 | * The behavior to use for ACF function calls. |
||
12 | * |
||
13 | * @var \Samrap\Acf\Behaviors\BehaviorInterface |
||
14 | */ |
||
15 | protected $behavior; |
||
16 | |||
17 | /** |
||
18 | * The \Samrap\Acf\Fluent\Builder components to run. |
||
19 | * |
||
20 | * The components will be executed in the order defined in this array. Only |
||
21 | * the components defined on the \Samrap\Acf\Fluent\Builder will be run. |
||
22 | * |
||
23 | * @var array |
||
24 | */ |
||
25 | protected $components = [ |
||
26 | 'expect', |
||
27 | 'matches', |
||
28 | 'default', |
||
29 | 'shortcodes', |
||
30 | 'escape', |
||
31 | ]; |
||
32 | |||
33 | /** |
||
34 | * Create a new Runner instance. |
||
35 | * |
||
36 | * @param \Samrap\Acf\Behaviors\BehaviorInterface $behavior |
||
37 | */ |
||
38 | public function __construct(BehaviorInterface $behavior) |
||
39 | { |
||
40 | $this->behavior = $behavior; |
||
41 | } |
||
42 | |||
43 | /** |
||
44 | * Get the behavior instance. |
||
45 | * |
||
46 | * @return \Samrap\Acf\Behaviors\BehaviorInterface |
||
47 | */ |
||
48 | public function getBehavior() |
||
49 | { |
||
50 | return $this->behavior; |
||
51 | } |
||
52 | |||
53 | /** |
||
54 | * Set the behavior. |
||
55 | * |
||
56 | * @param \Samrap\Acf\Behaviors\BehaviorInterface $behavior |
||
57 | * @return void |
||
58 | */ |
||
59 | public function setBehavior(BehaviorInterface $behavior) |
||
60 | { |
||
61 | $this->behavior = $behavior; |
||
62 | } |
||
63 | |||
64 | /** |
||
65 | * Run the ACF 'get' behavior from the given builder. |
||
66 | * |
||
67 | * @param \Samrap\Acf\Fluent\Builder $builder |
||
68 | * @return mixed |
||
69 | */ |
||
70 | public function get(Builder $builder) |
||
71 | { |
||
72 | // First, we will retrieve the field's value using our composed behavior. |
||
73 | $value = $this->behavior->get( |
||
74 | $builder->field, |
||
75 | $builder->id, |
||
76 | ! $builder->raw |
||
0 ignored issues
–
show
|
|||
77 | ); |
||
78 | |||
79 | // Next, we will iterate over the defined components and pass our value |
||
80 | // through each component's method if it was defined on the builder. |
||
81 | foreach ($this->components as $component) { |
||
82 | if (! is_null($builder->$component)) { |
||
83 | $method = 'run'.ucfirst($component); |
||
84 | |||
85 | $value = $this->$method($builder->$component, $value); |
||
86 | } |
||
87 | } |
||
88 | |||
89 | return $value; |
||
90 | } |
||
91 | |||
92 | /** |
||
93 | * Run the ACF 'update' behavior from the given builder. |
||
94 | * |
||
95 | * @param \Samrap\Acf\Fluent\Builder $builder |
||
96 | * @param mixed $value |
||
97 | * @return void |
||
98 | */ |
||
99 | public function update(Builder $builder, $value) |
||
100 | { |
||
101 | $this->behavior->update($builder->field, $value, $builder->id); |
||
102 | } |
||
103 | |||
104 | /** |
||
105 | * Ensure that the value is of the expected type. |
||
106 | * |
||
107 | * @param string $expected |
||
108 | * @param mixed $value |
||
109 | * @return mixed |
||
110 | */ |
||
111 | protected function runExpect($expected, $value) |
||
112 | { |
||
113 | return (gettype($value) === $expected) ? $value : null; |
||
114 | } |
||
115 | |||
116 | /** |
||
117 | * Check that the value matches the given pattern. |
||
118 | * |
||
119 | * @param string $pattern |
||
120 | * @param string $value |
||
121 | * @return mixed |
||
122 | */ |
||
123 | protected function runMatches($pattern, $value) |
||
124 | { |
||
125 | return preg_match($pattern, $value) ? $value : null; |
||
126 | } |
||
127 | |||
128 | /** |
||
129 | * Return the default value if the given value is empty or null. |
||
130 | * |
||
131 | * @param mixed $default |
||
132 | * @param mixed $value |
||
133 | * @return mixed |
||
134 | */ |
||
135 | protected function runDefault($default, $value) |
||
136 | { |
||
137 | if (is_string($value) && strlen($value) === 0) { |
||
138 | return $default; |
||
139 | } elseif (is_array($value) && empty($value)) { |
||
140 | return $default; |
||
141 | } |
||
142 | |||
143 | return $value ?? $default; |
||
144 | } |
||
145 | |||
146 | /** |
||
147 | * Escape the value with the given function. |
||
148 | * |
||
149 | * @param callable $func |
||
150 | * @param string $value |
||
151 | * @return string |
||
152 | */ |
||
153 | protected function runEscape($func, $value) |
||
154 | { |
||
155 | if (! is_string($value)) { |
||
156 | throw new RunnerException('Cannot escape value of type '.gettype($value)); |
||
157 | } |
||
158 | |||
159 | $whitelist = [ |
||
160 | 'esc_attr', |
||
161 | 'esc_html', |
||
162 | 'esc_js', |
||
163 | 'esc_textarea', |
||
164 | 'esc_url', |
||
165 | 'htmlspecialchars', |
||
166 | 'urlencode', |
||
167 | ]; |
||
168 | |||
169 | return (in_array($func, $whitelist)) |
||
170 | ? call_user_func($func, $value) |
||
171 | : $value; |
||
172 | } |
||
173 | |||
174 | /** |
||
175 | * Do shortcodes on the given value. |
||
176 | * |
||
177 | * @param bool $_ |
||
178 | * @param mixed $value |
||
179 | * @return mixed |
||
180 | */ |
||
181 | protected function runShortcodes($_, $value) |
||
0 ignored issues
–
show
|
|||
182 | { |
||
183 | if (! is_string($value)) { |
||
184 | throw new RunnerException( |
||
185 | 'Cannot do shortcode on value of type '.gettype($value) |
||
186 | ); |
||
187 | } |
||
188 | |||
189 | return do_shortcode($value); |
||
190 | } |
||
191 | } |
||
192 |
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.
If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.
In this case you can add the
@ignore
PhpDoc annotation to the duplicate definition and it will be ignored.