Issues in SetTempUrlKey.php (master) - Issues in master - sausin/laravel-ovh - Measure and Improve Code Quality continuously with Scrutinizer

Issues (5)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Commands/SetTempUrlKey.php (1 issue)

Labels

Bug 1

Severity

Critical 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

namespace Sausin\LaravelOvh\Commands;

use Exception;
use Illuminate\Console\Command;
use Illuminate\Support\Facades\Config;
use Illuminate\Support\Facades\Storage;
use InvalidArgumentException;
use League\Flysystem\Cached\CachedAdapter;
use OpenStack\ObjectStore\v1\Models\Container;

class SetTempUrlKey extends Command
{
    /**
     * The name and signature of the console command.
     *
     * @var string
     */
    protected $signature = 'ovh:set-temp-url-key
                            {--disk=ovh : The disk using your OVH container}
                            {--key= : The key you want to set up on your container}
                            {--force : Forcibly set a new key on the container}';

    /**
     * The console command description.
     *
     * @var string
     */
    protected $description = 'Set temp url key on the private container, making the use of Storage::temporaryUrl() possible';

    /**
     * The Object Storage Container.
     *
     * @var Container
     */
    protected $container;

    /** array */
    protected $containerMeta = [];

    /**
     * Execute the console command.
     *
     * If the '--force' flag is provided, a new Temp URL Key will be generated and
     * forcefully set in the Container's metadata, overriding any existing keys.
     *
     * If the command is not forced and there's an existing key, the User will be
     * prompted to override the existing keys.
     *
     * @return void
     */
    public function handle(): void
    {
        try {
            $disk = $this->getDisk();

            $adapter = Storage::disk($disk)->getAdapter();

            if ($adapter instanceof CachedAdapter) {
                $adapter = $adapter->getAdapter();
            }

            $this->container = $adapter->getContainer();
        } catch (InvalidArgumentException $e) {
            $this->error($e->getMessage());

            return;
        }

        $this->containerMeta = $this->container->getMetadata();

        if ($this->option('force') || $this->askIfShouldOverrideExistingKey()) {
            $this->setContainerKey();
        }
    }

    /**
     * If there's no existing Temp URL Key present in the Container, continue.
     *
     * Otherwise, if there's already an existing Temp URL Key present in the
     * Container, the User will be prompted to choose if we should override it
     * or not.
     *
     * @return bool
     */
    protected function askIfShouldOverrideExistingKey(): bool
    {
        if (!array_key_exists('Temp-Url-Key', $this->containerMeta)) {
            return true; // Yeah, override the non-existing key.
        }

        return $this->confirm(
            'A Temp URL Key already exists in your container, would you like to override it?',
            false
        );
    }

    /**
     * Generates a random Temp URL Key.
     *
     * For more details, please refer to:
     *  - https://docs.ovh.com/gb/en/public-cloud/share_an_object_via_a_temporary_url/#generate-the-temporary-address-tempurl
     *
     * @return string
     */
    protected function getRandomKey(): string
    {
        return hash('sha512', time());
    }

    /**
     * Updates the Temp URL Key for the Container.
     *
     * @return void
     */
    protected function setContainerKey(): void
    {
        $key = $this->option('key') ?? $this->getRandomKey();
        $meta = $this->getMeta();

        try {
            $this->container->resetMetadata($meta + ['Temp-Url-Key' => $key]);

            $this->info('Successfully set Temp URL Key to: '.$key);
        } catch (Exception $e) {
            $this->error($e->getMessage());
        }
    }

    /**
     * If other meta keys exist, get them.
     *
     * @return array
     */
    protected function getMeta(): array
    {
        $meta = [];
        $metaKeys = ['Access-Control-Allow-Origin', 'Access-Control-Max-Age'];

        foreach ($metaKeys as $key) {
            if (array_key_exists($key, $this->containerMeta)) {
                $meta += [$key => $this->containerMeta[$key]];
            }
        }

        return $meta;
    }

    /**
     * Check if selected disk is correct. If not, provide options to user.
     *
     * @return string
     */
    public function getDisk(): string
    {
        $available = array_keys(array_filter(Config::get('filesystems.disks'), function ($d) {
            return $d['driver'] === 'ovh';
        }));

        $selected = $this->option('disk');

        if (in_array($selected, $available)) {
            return $selected;
        }

        return $this->choice(
            'Selected disk not correct. Please choose from below options:',
            $available,
        );

    }
}


1			<?php
2
3			namespace Sausin\LaravelOvh\Commands;
4
5			use Exception;
6			use Illuminate\Console\Command;
7			use Illuminate\Support\Facades\Config;
8			use Illuminate\Support\Facades\Storage;
9			use InvalidArgumentException;
10			use League\Flysystem\Cached\CachedAdapter;
11			use OpenStack\ObjectStore\v1\Models\Container;
12
13			class SetTempUrlKey extends Command
14			{
15			/**
16			* The name and signature of the console command.
17			*
18			* @var string
19			*/
20			protected $signature = 'ovh:set-temp-url-key
21			{--disk=ovh : The disk using your OVH container}
22			{--key= : The key you want to set up on your container}
23			{--force : Forcibly set a new key on the container}';
24
25			/**
26			* The console command description.
27			*
28			* @var string
29			*/
30			protected $description = 'Set temp url key on the private container, making the use of Storage::temporaryUrl() possible';
31
32			/**
33			* The Object Storage Container.
34			*
35			* @var Container
36			*/
37			protected $container;
38
39			/** array */
40			protected $containerMeta = [];
41
42			/**
43			* Execute the console command.
44			*
45			* If the '--force' flag is provided, a new Temp URL Key will be generated and
46			* forcefully set in the Container's metadata, overriding any existing keys.
47			*
48			* If the command is not forced and there's an existing key, the User will be
49			* prompted to override the existing keys.
50			*
51			* @return void
52			*/
53			public function handle(): void
54			{
55			try {
56			$disk = $this->getDisk();
57
58			$adapter = Storage::disk($disk)->getAdapter();
59
60			if ($adapter instanceof CachedAdapter) {
61			$adapter = $adapter->getAdapter();
62			}
63
64			$this->container = $adapter->getContainer();
65			} catch (InvalidArgumentException $e) {
66			$this->error($e->getMessage());
67
68			return;
69			}
70
71			$this->containerMeta = $this->container->getMetadata();
72
73			if ($this->option('force') \|\| $this->askIfShouldOverrideExistingKey()) {
74			$this->setContainerKey();
75			}
76			}
77
78			/**
79			* If there's no existing Temp URL Key present in the Container, continue.
80			*
81			* Otherwise, if there's already an existing Temp URL Key present in the
82			* Container, the User will be prompted to choose if we should override it
83			* or not.
84			*
85			* @return bool
86			*/
87			protected function askIfShouldOverrideExistingKey(): bool
88			{
89			if (!array_key_exists('Temp-Url-Key', $this->containerMeta)) {
90			return true; // Yeah, override the non-existing key.
91			}
92
93			return $this->confirm(
94			'A Temp URL Key already exists in your container, would you like to override it?',
95			false
96			);
97			}
98
99			/**
100			* Generates a random Temp URL Key.
101			*
102			* For more details, please refer to:
103			* - https://docs.ovh.com/gb/en/public-cloud/share_an_object_via_a_temporary_url/#generate-the-temporary-address-tempurl
104			*
105			* @return string
106			*/
107			protected function getRandomKey(): string
108			{
109			return hash('sha512', time());
110			}
111
112			/**
113			* Updates the Temp URL Key for the Container.
114			*
115			* @return void
116			*/
117			protected function setContainerKey(): void
118			{
119			$key = $this->option('key') ?? $this->getRandomKey();
120			$meta = $this->getMeta();
121
122			try {
123			$this->container->resetMetadata($meta + ['Temp-Url-Key' => $key]);
124
125			$this->info('Successfully set Temp URL Key to: '.$key);
126			} catch (Exception $e) {
127			$this->error($e->getMessage());
128			}
129			}
130
131			/**
132			* If other meta keys exist, get them.
133			*
134			* @return array
135			*/
136			protected function getMeta(): array
137			{
138			$meta = [];
139			$metaKeys = ['Access-Control-Allow-Origin', 'Access-Control-Max-Age'];
140
141			foreach ($metaKeys as $key) {
142			if (array_key_exists($key, $this->containerMeta)) {
143			$meta += [$key => $this->containerMeta[$key]];
144			}
145			}
146
147			return $meta;
148			}
149
150			/**
151			* Check if selected disk is correct. If not, provide options to user.
152			*
153			* @return string
154			*/
155			public function getDisk(): string
156			{
157			$available = array_keys(array_filter(Config::get('filesystems.disks'), function ($d) {
158			return $d['driver'] === 'ovh';
159			}));
160
161			$selected = $this->option('disk');
162
163			if (in_array($selected, $available)) {
164			return $selected;
165			}
166
167			return $this->choice(
168			'Selected disk not correct. Please choose from below options:',
169			$available,
170			);
			0 ignored issues – show Bug introduced 2020-06-12 04:51 UTC by Report Bug Copy Issue Report Show Similar Issues like this This code did not parse for me. Apparently, there is an error somewhere around this line: Syntax error, unexpected ')' Loading history...
171			}
172			}
173

sausin / laravel-ovh

Issues (5)

Security Analysis no request data

src/Commands/SetTempUrlKey.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like