EnvironmentController::saveFile() - Code Metrics - Inspection of "16145 improve installer" - scci/security-employee-tracker - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Pull Request — master (#32)

by Shawn

created 2016-11-22 19:25 UTC

EnvironmentController::saveFile() A

↳ Parent: EnvironmentController

Complexity

Conditions	2
Paths	2

Size

Total Lines	12
Code Lines	7

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	1	Features	0

Metric	Value
c	1
b	1
f	0
dl	0
loc	12
rs	9.4285
cc	2
eloc	7
nc	2
nop	1

<?php

namespace SET\Http\Controllers\Installation;

use Exception;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Artisan;
use RachidLaasri\LaravelInstaller\Helpers\EnvironmentManager;
use SET\Http\Controllers\Controller;

class EnvironmentController extends Controller
{
    /**
     * @var EnvironmentManager
     */
    protected $EnvironmentManager;
    protected $envPath;

    /**
     * @param EnvironmentManager $environmentManager
     */
    public function __construct(EnvironmentManager $environmentManager)
    {
        $this->EnvironmentManager = $environmentManager;
        $this->envPath = base_path('.env');
    }

    /**
     * Display the Environment page.
     *
     * @return \Illuminate\View\View
     */
    public function index()
    {
        $envConfig = $this->EnvironmentManager->getEnvContent();
        $fields = $this->breakApartEnv($envConfig);

        return view('vendor.installer.environment', compact('fields'));
    }

    /**
     * Processes the newly saved environment configuration and redirects back.
     *
     * @param Request $input
     *
     * @return \Illuminate\Http\RedirectResponse
     */
    public function store(Request $input)
    {
        $env = $this->flattenRequest($input);
        $message = $this->saveFile($env);

        Artisan::call('key:generate');

        return redirect()->route('LaravelInstaller::requirements')
            ->with(['message' => $message]);
    }

    /**
     * Key should be before the first = symbol and value should be after.
     * Each new line (\r\n) should be a new array entry.
     *
     * @param $string
     *
     * @return array
     */
    private function breakApartEnv($string)
    {
        preg_match_all('/([^=]*?)=([^\r\n]*?)[\r\n]+/', $string, $matches);

        return array_combine($matches[1], $matches[2]);
    }

    private function flattenRequest(Request $input)
    {
        $fields = $this->breakApartEnv($this->EnvironmentManager->getEnvContent());
        $results = array_merge($fields, $input->toArray());
        unset($results['_token']);

        $env = '';
        foreach ($results as $key => $value) {
            $env .= $key.'='.$value."\r\n";
        }

        return $env;
    }

    /**
     * Save the edited content to the file.
     *
     * @param $string
     *
     * @return string
     */
    public function saveFile($string)
    {
        $message = trans('messages.environment.success');

        try {
            file_put_contents($this->envPath, $string);
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
        } catch (Exception $e) {
            $message = trans('messages.environment.errors');
        }

        return $message;
    }
}


1			<?php
2
3			namespace SET\Http\Controllers\Installation;
4
5			use Exception;
6			use Illuminate\Http\Request;
7			use Illuminate\Support\Facades\Artisan;
8			use RachidLaasri\LaravelInstaller\Helpers\EnvironmentManager;
9			use SET\Http\Controllers\Controller;
10
11			class EnvironmentController extends Controller
12			{
13			/**
14			* @var EnvironmentManager
15			*/
16			protected $EnvironmentManager;
17			protected $envPath;
18
19			/**
20			* @param EnvironmentManager $environmentManager
21			*/
22			public function __construct(EnvironmentManager $environmentManager)
23			{
24			$this->EnvironmentManager = $environmentManager;
25			$this->envPath = base_path('.env');
26			}
27
28			/**
29			* Display the Environment page.
30			*
31			* @return \Illuminate\View\View
32			*/
33			public function index()
34			{
35			$envConfig = $this->EnvironmentManager->getEnvContent();
36			$fields = $this->breakApartEnv($envConfig);
37
38			return view('vendor.installer.environment', compact('fields'));
39			}
40
41			/**
42			* Processes the newly saved environment configuration and redirects back.
43			*
44			* @param Request $input
45			*
46			* @return \Illuminate\Http\RedirectResponse
47			*/
48			public function store(Request $input)
49			{
50			$env = $this->flattenRequest($input);
51			$message = $this->saveFile($env);
52
53			Artisan::call('key:generate');
54
55			return redirect()->route('LaravelInstaller::requirements')
56			->with(['message' => $message]);
57			}
58
59			/**
60			* Key should be before the first = symbol and value should be after.
61			* Each new line (\r\n) should be a new array entry.
62			*
63			* @param $string
64			*
65			* @return array
66			*/
67			private function breakApartEnv($string)
68			{
69			preg_match_all('/([^=]?)=([^\r\n]?)[\r\n]+/', $string, $matches);
70
71			return array_combine($matches[1], $matches[2]);
72			}
73
74			private function flattenRequest(Request $input)
75			{
76			$fields = $this->breakApartEnv($this->EnvironmentManager->getEnvContent());
77			$results = array_merge($fields, $input->toArray());
78			unset($results['_token']);
79
80			$env = '';
81			foreach ($results as $key => $value) {
82			$env .= $key.'='.$value."\r\n";
83			}
84
85			return $env;
86			}
87
88			/**
89			* Save the edited content to the file.
90			*
91			* @param $string
92			*
93			* @return string
94			*/
95			public function saveFile($string)
96			{
97			$message = trans('messages.environment.success');
98
99			try {
100			file_put_contents($this->envPath, $string);
			0 ignored issues – show Security File Manipulation introduced 2016-11-21 22:00 UTC by Report Bug Copy Issue Report `$string` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 8 paths for user data to reach this point 1. Path: `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in ServerBag.php on line 62 `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in vendor/ServerBag.php on line 62 ParameterBag::$parameters is assigned in vendor/ServerBag.php on line 77 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 77 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 82 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 2. Path: Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in Request.php on line 281 Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$request` is passed to Request::__construct() in vendor/Request.php on line 1939 `$request` is passed to Request::initialize() in vendor/Request.php on line 222 `$request` is passed to ParameterBag::__construct() in vendor/Request.php on line 240 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 77 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 82 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 3. Path: Read from `$_SERVER,` and `$server` is assigned in Request.php on line 271 Read from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 271 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1939 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 77 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 82 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 4. Path: Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in Request.php on line 274 Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 274 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1939 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 77 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 82 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 5. Path: Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in Request.php on line 277 Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 277 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1939 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 77 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 82 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 6. Path: `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in Request.php on line 347 `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in vendor/Request.php on line 347 `$server` is assigned in vendor/Request.php on line 395 `$server` is assigned in vendor/Request.php on line 396 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 398 `$server` is passed to Request::__construct() in vendor/Request.php on line 1939 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 77 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 82 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 7. Path: `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 43 `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 43 `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1709 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1740 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 77 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 82 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 8. Path: `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 44 `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1709 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1740 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$files` is assigned in vendor/src/Illuminate/Http/Request.php on line 431 Data is passed through array_map() in vendor/src/Illuminate/Http/Request.php on line 454 Request::$convertedFiles is assigned in vendor/src/Illuminate/Http/Request.php on line 435 Tainted property Request::$convertedFiles is read in vendor/src/Illuminate/Http/Request.php on line 434 Request::allFiles() returns tainted data, and `$this->allFiles()` is passed through array_replace_recursive() in vendor/src/Illuminate/Http/Request.php on line 323 Request::all() returns tainted data in vendor/src/Illuminate/Http/Request.php on line 1015 Request::toArray() returns tainted data, and `$input->toArray()` is passed through array_merge(), and `$results` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 77 `$key` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 81 `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 82 EnvironmentController::flattenRequest() returns tainted data, and `$env` is assigned in app/Http/Controllers/Installation/EnvironmentController.php on line 50 `$env` is passed to EnvironmentController::saveFile() in app/Http/Controllers/Installation/EnvironmentController.php on line 51 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
101			} catch (Exception $e) {
102			$message = trans('messages.environment.errors');
103			}
104
105			return $message;
106			}
107			}
108

scci / security-employee-tracker

Pull Request — master (#32)

EnvironmentController::saveFile() A

Complexity

Size

Duplication

Importance

8 paths for user data to reach this point

General Strategies to prevent injection

Duplication Side-by-Side

Filter issues like