Issues (115)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

BehatExtension/Context/EmailContext.php (10 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace SilverStripe\BehatExtension\Context;
4
5
use Behat\Behat\Context\ClosuredContextInterface;
6
use Behat\Behat\Context\TranslatedContextInterface;
7
use Behat\Behat\Context\BehatContext;
8
use Behat\Behat\Context\Step;
9
use Behat\Behat\Event\FeatureEvent;
10
use Behat\Behat\Event\ScenarioEvent;
11
use Behat\Behat\Exception\PendingException;
12
use Behat\Gherkin\Node\PyStringNode;
13
use Behat\Gherkin\Node\TableNode;
14
use Symfony\Component\DomCrawler\Crawler;
15
16
// PHPUnit
17
require_once BASE_PATH . '/vendor/phpunit/phpunit/src/Framework/Assert/Functions.php';
18
19
/**
20
 * Context used to define steps related to email sending.
21
 */
22
class EmailContext extends BehatContext
23
{
24
    protected $context;
25
26
    protected $mailer;
27
28
    /**
29
     * Stored to simplify later assertions
30
     */
31
    protected $lastMatchedEmail;
32
33
    /**
34
     * Initializes context.
35
     * Every scenario gets it's own context object.
36
     *
37
     * @param array $parameters context parameters (set them up through behat.yml)
38
     */
39
    public function __construct(array $parameters)
40
    {
41
        // Initialize your context here
42
        $this->context = $parameters;
43
    }
44
45
    /**
46
     * Get Mink session from MinkContext
47
     */
48
    public function getSession($name = null)
49
    {
50
        return $this->getMainContext()->getSession($name);
0 ignored issues
show
It seems like you code against a concrete implementation and not the interface Behat\Behat\Context\ExtendedContextInterface as the method getSession() does only exist in the following implementations of said interface: Behat\MinkExtension\Context\MinkContext, Behat\MinkExtension\Context\RawMinkContext, SilverStripe\BehatExtension\Context\BasicContext, SilverStripe\BehatExtension\Context\EmailContext, SilverStripe\BehatExtension\Context\FixtureContext, SilverStripe\BehatExtension\Context\LoginContext, SilverStripe\BehatExtens...ext\SilverStripeContext.

Let’s take a look at an example:

interface User
{
    /** @return string */
    public function getPassword();
}

class MyUser implements User
{
    public function getPassword()
    {
        // return something
    }

    public function getDisplayName()
    {
        // return some name.
    }
}

class AuthSystem
{
    public function authenticate(User $user)
    {
        $this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName()));
        // do something.
    }
}

In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different implementation of User which does not have a getDisplayName() method, the code will break.

Available Fixes

  1. Change the type-hint for the parameter:

    class AuthSystem
    {
        public function authenticate(MyUser $user) { /* ... */ }
    }
    
  2. Add an additional type-check:

    class AuthSystem
    {
        public function authenticate(User $user)
        {
            if ($user instanceof MyUser) {
                $this->logger->info(/** ... */);
            }
    
            // or alternatively
            if ( ! $user instanceof MyUser) {
                throw new \LogicException(
                    '$user must be an instance of MyUser, '
                   .'other instances are not supported.'
                );
            }
    
        }
    }
    
Note: PHP Analyzer uses reverse abstract interpretation to narrow down the types inside the if block in such a case.
  1. Add the method to the interface:

    interface User
    {
        /** @return string */
        public function getPassword();
    
        /** @return string */
        public function getDisplayName();
    }
    
Loading history...
51
    }
52
53
    /**
54
     * @BeforeScenario
55
     */
56
    public function before(ScenarioEvent $event)
0 ignored issues
show
The parameter $event is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
57
    {
58
        // Also set through the 'supportbehat' extension
59
        // to ensure its available both in CLI execution and the tested browser session
60
        $this->mailer = new \SilverStripe\BehatExtension\Utility\TestMailer();
61
        \Email::set_mailer($this->mailer);
0 ignored issues
show
Deprecated Code introduced by
The method Email::set_mailer() has been deprecated with message: since version 4.0

This method has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead.

Loading history...
62
        \Config::inst()->update("Email", "send_all_emails_to", null);
63
    }
64
65
    /**
66
     * @Given /^there should (not |)be an email (to|from) "([^"]*)"$/
67
     */
68
    public function thereIsAnEmailFromTo($negate, $direction, $email)
69
    {
70
        $to = ($direction == 'to') ? $email : null;
71
        $from = ($direction == 'from') ? $email : null;
72
        $match = $this->mailer->findEmail($to, $from);
73
        if (trim($negate)) {
74
            assertNull($match);
75
        } else {
76
            assertNotNull($match);
77
        }
78
        $this->lastMatchedEmail = $match;
79
    }
80
81
    /**
82
     * @Given /^there should (not |)be an email (to|from) "([^"]*)" titled "([^"]*)"$/
83
     */
84
    public function thereIsAnEmailFromToTitled($negate, $direction, $email, $subject)
85
    {
86
        $to = ($direction == 'to') ? $email : null;
87
        $from = ($direction == 'from') ? $email : null;
88
        $match = $this->mailer->findEmail($to, $from, $subject);
89
        $allMails = $this->mailer->findEmails($to, $from);
90
        $allTitles = $allMails ? '"' . implode('","', array_map(function ($email) {
91
            return $email->Subject;
92
        }, $allMails)) . '"' : null;
93
        if (trim($negate)) {
94
            assertNull($match);
95
        } else {
96
            $msg = sprintf(
97
                'Could not find email %s "%s" titled "%s".',
98
                $direction,
99
                $email,
100
                $subject
101
            );
102
            if ($allTitles) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $allTitles of type string|null is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
103
                $msg .= ' Existing emails: ' . $allTitles;
104
            }
105
            assertNotNull($match, $msg);
106
        }
107
        $this->lastMatchedEmail = $match;
108
    }
109
110
    /**
111
     * Example: Given the email should contain "Thank you for registering!".
112
     * Assumes an email has been identified by a previous step,
113
     * e.g. through 'Given there should be an email to "[email protected]"'.
114
     *
115
     * @Given /^the email should (not |)contain "([^"]*)"$/
116
     */
117
    public function thereTheEmailContains($negate, $content)
118
    {
119
        if (!$this->lastMatchedEmail) {
120
            throw new \LogicException('No matched email found from previous step');
121
        }
122
123
        $email = $this->lastMatchedEmail;
124
        $emailContent = null;
0 ignored issues
show
$emailContent is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
125
        if ($email->Content) {
126
            $emailContent = $email->Content;
127
        } else {
128
            $emailContent = $email->PlainContent;
129
        }
130
131
        if (trim($negate)) {
132
            assertNotContains($content, $emailContent);
133
        } else {
134
            assertContains($content, $emailContent);
135
        }
136
    }
137
138
    /**
139
     * Example: Given the email contains "Thank you for <strong>registering!<strong>".
140
     * Then the email should contain plain text "Thank you for registering!"
141
     * Assumes an email has been identified by a previous step,
142
     * e.g. through 'Given there should be an email to "[email protected]"'.
143
     *
144
     * @Given /^the email should contain plain text "([^"]*)"$/
145
     */
146
    public function thereTheEmailContainsPlainText($content)
147
    {
148
        if (!$this->lastMatchedEmail) {
149
            throw new \LogicException('No matched email found from previous step');
150
        }
151
152
        $email = $this->lastMatchedEmail;
153
        $emailContent = ($email->Content) ? ($email->Content) : ($email->PlainContent);
154
        $emailPlainText = strip_tags($emailContent);
155
        $emailPlainText = preg_replace("/\h+/", " ", $emailPlainText);
156
157
        assertContains($content, $emailPlainText);
158
    }
159
160
    /**
161
     * @When /^I click on the "([^"]*)" link in the email (to|from) "([^"]*)"$/
162
     */
163 View Code Duplication
    public function iGoToInTheEmailTo($linkSelector, $direction, $email)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
164
    {
165
        $to = ($direction == 'to') ? $email : null;
166
        $from = ($direction == 'from') ? $email : null;
167
        $match = $this->mailer->findEmail($to, $from);
168
        assertNotNull($match);
169
170
        $crawler = new Crawler($match->Content);
171
        $linkEl = $crawler->selectLink($linkSelector);
172
        assertNotNull($linkEl);
173
        $link = $linkEl->attr('href');
174
        assertNotNull($link);
175
        
176
        return new Step\When(sprintf('I go to "%s"', $link));
177
    }
178
179
    /**
180
     * @When /^I click on the "([^"]*)" link in the email (to|from) "([^"]*)" titled "([^"]*)"$/
181
     */
182 View Code Duplication
    public function iGoToInTheEmailToTitled($linkSelector, $direction, $email, $title)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
183
    {
184
        $to = ($direction == 'to') ? $email : null;
185
        $from = ($direction == 'from') ? $email : null;
186
        $match = $this->mailer->findEmail($to, $from, $title);
187
        assertNotNull($match);
188
189
        $crawler = new Crawler($match->Content);
190
        $linkEl = $crawler->selectLink($linkSelector);
191
        assertNotNull($linkEl);
192
        $link = $linkEl->attr('href');
193
        assertNotNull($link);
194
        return new Step\When(sprintf('I go to "%s"', $link));
195
    }
196
    
197
    /**
198
     * Assumes an email has been identified by a previous step,
199
     * e.g. through 'Given there should be an email to "[email protected]"'.
200
     *
201
     * @When /^I click on the "([^"]*)" link in the email"$/
202
     */
203
    public function iGoToInTheEmail($linkSelector)
204
    {
205
        if (!$this->lastMatchedEmail) {
206
            throw new \LogicException('No matched email found from previous step');
207
        }
208
209
        $match = $this->lastMatchedEmail;
210
        $crawler = new Crawler($match->Content);
211
        $linkEl = $crawler->selectLink($linkSelector);
212
        assertNotNull($linkEl);
213
        $link = $linkEl->attr('href');
214
        assertNotNull($link);
215
216
        return new Step\When(sprintf('I go to "%s"', $link));
217
    }
218
219
    /**
220
     * @Given /^I clear all emails$/
221
     */
222
    public function iClearAllEmails()
223
    {
224
        $this->lastMatchedEmail = null;
225
        return $this->mailer->clearEmails();
226
    }
227
228
    /**
229
     * Example: Then the email should contain the following data:
230
     * | row1 |
231
     * | row2 |
232
     * Assumes an email has been identified by a previous step.
233
     * @Then /^the email should (not |)contain the following data:$/
234
     */
235
    public function theEmailContainFollowingData($negate, TableNode $table)
236
    {
237
        if (!$this->lastMatchedEmail) {
238
            throw new \LogicException('No matched email found from previous step');
239
        }
240
241
        $email = $this->lastMatchedEmail;
242
        $emailContent = null;
0 ignored issues
show
$emailContent is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
243
        if ($email->Content) {
244
            $emailContent = $email->Content;
245
        } else {
246
            $emailContent = $email->PlainContent;
247
        }
248
        // Convert html content to plain text
249
        $emailContent = strip_tags($emailContent);
250
        $emailContent = preg_replace("/\h+/", " ", $emailContent);
251
        $rows = $table->getRows();
252
        
253
        // For "should not contain"
254
        if (trim($negate)) {
255
            foreach ($rows as $row) {
256
                assertNotContains($row[0], $emailContent);
257
            }
258
        } else {
259
            foreach ($rows as $row) {
260
                assertContains($row[0], $emailContent);
261
            }
262
        }
263
    }
264
265
    /**
266
     * @Then /^there should (not |)be an email titled "([^"]*)"$/
267
     */
268
    public function thereIsAnEmailTitled($negate, $subject)
269
    {
270
        $match = $this->mailer->findEmail(null, null, $subject);
271
        if (trim($negate)) {
272
            assertNull($match);
273
        } else {
274
            $msg = sprintf(
275
                'Could not find email titled "%s".',
276
                $subject
277
            );
278
            assertNotNull($match, $msg);
279
        }
280
        $this->lastMatchedEmail = $match;
281
    }
282
283
    /**
284
     * @Then /^the email should (not |)be sent from "([^"]*)"$/
285
     */
286 View Code Duplication
    public function theEmailSentFrom($negate, $from)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
287
    {
288
        if (!$this->lastMatchedEmail) {
289
            throw new \LogicException('No matched email found from previous step');
290
        }
291
292
        $match = $this->lastMatchedEmail;
293
        if (trim($negate)) {
294
            assertNotContains($from, $match->From);
295
        } else {
296
            assertContains($from, $match->From);
297
        }
298
    }
299
300
    /**
301
     * @Then /^the email should (not |)be sent to "([^"]*)"$/
302
     */
303 View Code Duplication
    public function theEmailSentTo($negate, $to)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
304
    {
305
        if (!$this->lastMatchedEmail) {
306
            throw new \LogicException('No matched email found from previous step');
307
        }
308
309
        $match = $this->lastMatchedEmail;
310
        if (trim($negate)) {
311
            assertNotContains($to, $match->To);
312
        } else {
313
            assertContains($to, $match->To);
314
        }
315
    }
316
}
317