1 | <?php |
||
11 | class EnvironmentController extends Controller |
||
12 | { |
||
13 | /** |
||
14 | * @var EnvironmentManager |
||
15 | */ |
||
16 | protected $EnvironmentManager; |
||
17 | protected $envPath; |
||
18 | protected $envSetup = [ |
||
19 | 'APP_ENV' => FILTER_SANITIZE_ENCODED, |
||
20 | 'APP_DEBUG' => FILTER_SANITIZE_ENCODED, |
||
21 | 'APP_KEY' => FILTER_DEFAULT, |
||
22 | 'APP_URL' => FILTER_VALIDATE_URL, |
||
23 | 'DB_CONNECTION' => FILTER_SANITIZE_ENCODED, |
||
24 | 'DB_HOST' => FILTER_SANITIZE_ENCODED, |
||
25 | 'DB_DATABASE' => FILTER_SANITIZE_ENCODED, |
||
26 | 'DB_USERNAME' => FILTER_SANITIZE_ENCODED, |
||
27 | 'DB_PASSWORD' => FILTER_DEFAULT, |
||
28 | 'MAIL_DRIVER' => FILTER_SANITIZE_ENCODED, |
||
29 | 'MAIL_HOST' => FILTER_SANITIZE_ENCODED, |
||
30 | 'MAIL_PORT' => FILTER_VALIDATE_INT, |
||
31 | 'MAIL_USERNAME' => FILTER_SANITIZE_ENCODED, |
||
32 | 'MAIL_PASSWORD' => FILTER_DEFAULT, |
||
33 | 'MAIL_ENCRYPTION' => FILTER_SANITIZE_ENCODED, |
||
34 | 'MAIL_FROM_ADDRESS' => FILTER_VALIDATE_EMAIL, |
||
35 | 'MAIL_FROM_NAME' => FILTER_DEFAULT, |
||
36 | ]; |
||
37 | |||
38 | /** |
||
39 | * @param EnvironmentManager $environmentManager |
||
40 | */ |
||
41 | public function __construct(EnvironmentManager $environmentManager) |
||
46 | |||
47 | /** |
||
48 | * Display the Environment page. |
||
49 | * |
||
50 | * @return \Illuminate\View\View |
||
51 | */ |
||
52 | public function index() |
||
59 | |||
60 | /** |
||
61 | * Processes the newly saved environment configuration and redirects back. |
||
62 | * |
||
63 | * @param Request $input |
||
64 | * |
||
65 | * @return \Illuminate\Http\RedirectResponse |
||
66 | */ |
||
67 | public function store(Request $input) |
||
77 | |||
78 | /** |
||
79 | * Key should be before the first = symbol and value should be after. |
||
80 | * Each new line (\r\n) should be a new array entry. |
||
81 | * |
||
82 | * @param $string |
||
83 | * |
||
84 | * @return array |
||
85 | */ |
||
86 | private function breakApartEnv($string) |
||
95 | |||
96 | private function flattenRequest(Request $input) |
||
109 | |||
110 | /** |
||
111 | * Save the edited content to the file. |
||
112 | * |
||
113 | * @param $string |
||
114 | * |
||
115 | * @return string |
||
116 | */ |
||
117 | public function saveFile($string) |
||
129 | |||
130 | private function removeQuotes($string) |
||
136 | |||
137 | private function scrubInput($array) |
||
147 | } |
||
148 |
$string
can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.8 paths for user data to reach this point
$this->parameters['HTTP_AUTHORIZATION']
seems to return tainted data, and$authorizationHeader
is assigned in ServerBag.php on line 62$this->parameters['HTTP_AUTHORIZATION']
seems to return tainted data, and$authorizationHeader
is assignedin vendor/ServerBag.php on line 62
in vendor/ServerBag.php on line 77
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge()in app/Http/Controllers/Installation/EnvironmentController.php on line 99
in vendor/app/Http/Controllers/Installation/EnvironmentController.php on line 139
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 99
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 100
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 103
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 104
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 69
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 70
$_POST,
and$_POST
is passed to Request::createRequestFromFactory() in Request.php on line 281$_POST,
and$_POST
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 281
$request
is passed to Request::__construct()in vendor/Request.php on line 1939
$request
is passed to Request::initialize()in vendor/Request.php on line 222
$request
is passed to ParameterBag::__construct()in vendor/Request.php on line 240
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge()in app/Http/Controllers/Installation/EnvironmentController.php on line 99
in vendor/app/Http/Controllers/Installation/EnvironmentController.php on line 139
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 99
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 100
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 103
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 104
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 69
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 70
$_SERVER,
and$server
is assigned in Request.php on line 271$_SERVER,
and$server
is assignedin vendor/Request.php on line 271
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 281
$server
is passed to Request::__construct()in vendor/Request.php on line 1939
$server
is passed to Request::initialize()in vendor/Request.php on line 222
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 245
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge()in app/Http/Controllers/Installation/EnvironmentController.php on line 99
in vendor/app/Http/Controllers/Installation/EnvironmentController.php on line 139
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 99
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 100
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 103
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 104
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 69
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 70
HTTP_CONTENT_LENGTH
from$_SERVER,
and$server
is assigned in Request.php on line 274HTTP_CONTENT_LENGTH
from$_SERVER,
and$server
is assignedin vendor/Request.php on line 274
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 281
$server
is passed to Request::__construct()in vendor/Request.php on line 1939
$server
is passed to Request::initialize()in vendor/Request.php on line 222
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 245
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge()in app/Http/Controllers/Installation/EnvironmentController.php on line 99
in vendor/app/Http/Controllers/Installation/EnvironmentController.php on line 139
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 99
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 100
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 103
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 104
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 69
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 70
HTTP_CONTENT_TYPE
from$_SERVER,
and$server
is assigned in Request.php on line 277HTTP_CONTENT_TYPE
from$_SERVER,
and$server
is assignedin vendor/Request.php on line 277
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 281
$server
is passed to Request::__construct()in vendor/Request.php on line 1939
$server
is passed to Request::initialize()in vendor/Request.php on line 222
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 245
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge()in app/Http/Controllers/Installation/EnvironmentController.php on line 99
in vendor/app/Http/Controllers/Installation/EnvironmentController.php on line 139
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 99
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 100
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 103
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 104
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 69
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 70
$server['HTTP_HOST']
seems to return tainted data, and$server
is assigned in Request.php on line 347$server['HTTP_HOST']
seems to return tainted data, and$server
is assignedin vendor/Request.php on line 347
$server
is assignedin vendor/Request.php on line 395
$server
is assignedin vendor/Request.php on line 396
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 398
$server
is passed to Request::__construct()in vendor/Request.php on line 1939
$server
is passed to Request::initialize()in vendor/Request.php on line 222
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 245
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge()in app/Http/Controllers/Installation/EnvironmentController.php on line 99
in vendor/app/Http/Controllers/Installation/EnvironmentController.php on line 139
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 99
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 100
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 103
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 104
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 69
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 70
$this->parameters['PHP_AUTH_USER']
seems to return tainted data, and$headers
is assigned in ServerBag.php on line 43$this->parameters['PHP_AUTH_USER']
seems to return tainted data, and$headers
is assignedin vendor/ServerBag.php on line 43
$headers
is assignedin vendor/ServerBag.php on line 44
$this->server->getHeaders()
is passed to HeaderBag::__construct()in vendor/Request.php on line 246
$values
is assignedin vendor/HeaderBag.php on line 31
$values
is passed to HeaderBag::set()in vendor/HeaderBag.php on line 32
(array) $values
is passed through array_values(), and$values
is assignedin vendor/HeaderBag.php on line 142
in vendor/HeaderBag.php on line 145
in vendor/HeaderBag.php on line 125
$requestUri
is assignedin vendor/Request.php on line 1709
$requestUri
is passed to ParameterBag::set()in vendor/Request.php on line 1740
in vendor/ParameterBag.php on line 99
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge()in app/Http/Controllers/Installation/EnvironmentController.php on line 99
in vendor/app/Http/Controllers/Installation/EnvironmentController.php on line 139
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 99
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 100
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 103
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 104
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 69
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 70
$this->parameters['PHP_AUTH_PW']
seems to return tainted data, and$headers
is assigned in ServerBag.php on line 44$this->parameters['PHP_AUTH_PW']
seems to return tainted data, and$headers
is assignedin vendor/ServerBag.php on line 44
$this->server->getHeaders()
is passed to HeaderBag::__construct()in vendor/Request.php on line 246
$values
is assignedin vendor/HeaderBag.php on line 31
$values
is passed to HeaderBag::set()in vendor/HeaderBag.php on line 32
(array) $values
is passed through array_values(), and$values
is assignedin vendor/HeaderBag.php on line 142
in vendor/HeaderBag.php on line 145
in vendor/HeaderBag.php on line 125
$requestUri
is assignedin vendor/Request.php on line 1709
$requestUri
is passed to ParameterBag::set()in vendor/Request.php on line 1740
in vendor/ParameterBag.php on line 99
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge()in app/Http/Controllers/Installation/EnvironmentController.php on line 99
in vendor/app/Http/Controllers/Installation/EnvironmentController.php on line 139
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 99
$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 100
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 103
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 104
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 69
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 70
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: