EnvironmentController::removeQuotes() - Code Metrics - Inspection of "Scrub user input & remove quote requirement for ap..." - scci/security-employee-tracker - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — 16145-Improve-Installer ( c64d7f...452678 )

by Shawn

created 2016-11-22 20:47 UTC

EnvironmentController::removeQuotes() A

↳ Parent: EnvironmentController

Complexity

Conditions	1
Paths	1

Size

Total Lines	5
Code Lines	3

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
c	0
b	0
f	0
dl	0
loc	5
rs	9.4285
cc	1
eloc	3
nc	1
nop	1

<?php

namespace SET\Http\Controllers\Installation;

use Exception;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Artisan;
use RachidLaasri\LaravelInstaller\Helpers\EnvironmentManager;
use SET\Http\Controllers\Controller;

class EnvironmentController extends Controller
{
    /**
     * @var EnvironmentManager
     */
    protected $EnvironmentManager;
    protected $envPath;

    /**
     * @param EnvironmentManager $environmentManager
     */
    public function __construct(EnvironmentManager $environmentManager)
    {
        $this->EnvironmentManager = $environmentManager;
        $this->envPath = base_path('.env');
    }

    /**
     * Display the Environment page.
     *
     * @return \Illuminate\View\View
     */
    public function index()
    {
        $envConfig = $this->EnvironmentManager->getEnvContent();
        $fields = $this->breakApartEnv($envConfig);

        return view('vendor.installer.environment', compact('fields'));
    }

    /**
     * Processes the newly saved environment configuration and redirects back.
     *
     * @param Request $input
     *
     * @return \Illuminate\Http\RedirectResponse
     */
    public function store(Request $input)
    {
        $env = $this->flattenRequest($input);
        $message = $this->saveFile($env);

        Artisan::call('key:generate');

        return redirect()->route('LaravelInstaller::requirements')
            ->with(['message' => $message]);
    }

    /**
     * Key should be before the first = symbol and value should be after.
     * Each new line (\r\n) should be a new array entry.
     *
     * @param $string
     *
     * @return array
     */
    private function breakApartEnv($string)
    {
        preg_match_all('/([^=]*?)=([^\r\n]*?)[\r\n]+/', $string, $matches);

        $array = array_combine($matches[1], $matches[2]);
        $array['MAIL_FROM_NAME'] = $this->removeQuotes($array['MAIL_FROM_NAME']);
        return $array;
    }

    private function flattenRequest(Request $input)
    {
        $fields = $this->breakApartEnv($this->EnvironmentManager->getEnvContent());
        $results = filter_var_array(array_merge($fields, $input->toArray()));
        unset($results['_token']);
        $results['MAIL_FROM_NAME'] = '"'.$this->removeQuotes($results['MAIL_FROM_NAME']).'"';

        $env = '';
        foreach ($results as $key => $value) {
            $env .= $key.'='.$value."\r\n";
        }

        return $env;
    }

    /**
     * Save the edited content to the file.
     *
     * @param $string
     *
     * @return string
     */
    public function saveFile($string)
    {
        $message = trans('messages.environment.success');

        try {
            file_put_contents($this->envPath, $string);
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
        } catch (Exception $e) {
            $message = trans('messages.environment.errors');
        }

        return $message;
    }

    private function removeQuotes($string)
    {
        $string = str_replace('"', "", $string);
        return str_replace("'", "", $string);
    }
}


1			<?php
2
3			namespace SET\Http\Controllers\Installation;
4
5			use Exception;
6			use Illuminate\Http\Request;
7			use Illuminate\Support\Facades\Artisan;
8			use RachidLaasri\LaravelInstaller\Helpers\EnvironmentManager;
9			use SET\Http\Controllers\Controller;
10
11			class EnvironmentController extends Controller
12			{
13			/**
14			* @var EnvironmentManager
15			*/
16			protected $EnvironmentManager;
17			protected $envPath;
18
19			/**
20			* @param EnvironmentManager $environmentManager
21			*/
22			public function __construct(EnvironmentManager $environmentManager)
23			{
24			$this->EnvironmentManager = $environmentManager;
25			$this->envPath = base_path('.env');
26			}
27
28			/**
29			* Display the Environment page.
30			*
31			* @return \Illuminate\View\View
32			*/
33			public function index()
34			{
35			$envConfig = $this->EnvironmentManager->getEnvContent();
36			$fields = $this->breakApartEnv($envConfig);
37
38			return view('vendor.installer.environment', compact('fields'));
39			}
40
41			/**
42			* Processes the newly saved environment configuration and redirects back.
43			*
44			* @param Request $input
45			*
46			* @return \Illuminate\Http\RedirectResponse
47			*/
48			public function store(Request $input)
49			{
50			$env = $this->flattenRequest($input);
51			$message = $this->saveFile($env);
52
53			Artisan::call('key:generate');
54
55			return redirect()->route('LaravelInstaller::requirements')
56			->with(['message' => $message]);
57			}
58
59			/**
60			* Key should be before the first = symbol and value should be after.
61			* Each new line (\r\n) should be a new array entry.
62			*
63			* @param $string
64			*
65			* @return array
66			*/
67			private function breakApartEnv($string)
68			{
69			preg_match_all('/([^=]?)=([^\r\n]?)[\r\n]+/', $string, $matches);
70
71			$array = array_combine($matches[1], $matches[2]);
72			$array['MAIL_FROM_NAME'] = $this->removeQuotes($array['MAIL_FROM_NAME']);
73			return $array;
74			}
75
76			private function flattenRequest(Request $input)
77			{
78			$fields = $this->breakApartEnv($this->EnvironmentManager->getEnvContent());
79			$results = filter_var_array(array_merge($fields, $input->toArray()));
80			unset($results['_token']);
81			$results['MAIL_FROM_NAME'] = '"'.$this->removeQuotes($results['MAIL_FROM_NAME']).'"';
82
83			$env = '';
84			foreach ($results as $key => $value) {
85			$env .= $key.'='.$value."\r\n";
86			}
87
88			return $env;
89			}
90
91			/**
92			* Save the edited content to the file.
93			*
94			* @param $string
95			*
96			* @return string
97			*/
98			public function saveFile($string)
99			{
100			$message = trans('messages.environment.success');
101
102			try {
103			file_put_contents($this->envPath, $string);
			0 ignored issues – show Security File Manipulation introduced 2016-11-22 20:49 UTC by Report Bug Copy Issue Report `$string` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 8 paths for user data to reach this point 1. Path: `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in ServerBag.php on line 62 `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in vendor/ServerBag.php on line 62 ParameterBag::$parameters is assigned in vendor/ServerBag.php on line 77 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `array_merge($fields, $input->toArray())` is passed through filter_var_array(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 79 `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 84 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 85 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 2. Path: Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in Request.php on line 281 Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$request` is passed to Request::__construct() in vendor/Request.php on line 1939 `$request` is passed to Request::initialize() in vendor/Request.php on line 222 `$request` is passed to ParameterBag::__construct() in vendor/Request.php on line 240 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `array_merge($fields, $input->toArray())` is passed through filter_var_array(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 79 `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 84 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 85 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 3. Path: Read from `$_SERVER,` and `$server` is assigned in Request.php on line 271 Read from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 271 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1939 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `array_merge($fields, $input->toArray())` is passed through filter_var_array(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 79 `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 84 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 85 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 4. Path: Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in Request.php on line 274 Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 274 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1939 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `array_merge($fields, $input->toArray())` is passed through filter_var_array(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 79 `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 84 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 85 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 5. Path: Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in Request.php on line 277 Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 277 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1939 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `array_merge($fields, $input->toArray())` is passed through filter_var_array(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 79 `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 84 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 85 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 6. Path: `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in Request.php on line 347 `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in vendor/Request.php on line 347 `$server` is assigned in vendor/Request.php on line 395 `$server` is assigned in vendor/Request.php on line 396 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 398 `$server` is passed to Request::__construct() in vendor/Request.php on line 1939 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `array_merge($fields, $input->toArray())` is passed through filter_var_array(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 79 `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 84 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 85 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 7. Path: `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 43 `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 43 `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1709 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1740 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `array_merge($fields, $input->toArray())` is passed through filter_var_array(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 79 `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 84 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 85 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 8. Path: `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 44 `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1709 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1740 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `array_merge($fields, $input->toArray())` is passed through filter_var_array(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 79 `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 84 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 85 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
104			} catch (Exception $e) {
105			$message = trans('messages.environment.errors');
106			}
107
108			return $message;
109			}
110
111			private function removeQuotes($string)
112			{
113			$string = str_replace('"', "", $string);
114			return str_replace("'", "", $string);
115			}
116			}
117

scci / security-employee-tracker

Push — 16145-Improve-Installer ( c64d7f...452678 )

EnvironmentController::removeQuotes() A

Complexity

Size

Duplication

Importance

8 paths for user data to reach this point

General Strategies to prevent injection

Duplication Side-by-Side

Filter issues like