Completed
Pull Request — master (#1132)
by Tim
15:36
created

lib/SimpleSAML/Logger/FileLoggingHandler.php (1 issue)

Severity
1
<?php
2
3
declare(strict_types=1);
4
5
namespace SimpleSAML\Logger;
6
7
use SimpleSAML\Configuration;
8
use SimpleSAML\Logger;
9
use SimpleSAML\Utils;
10
11
/**
12
 * A logging handler that dumps logs to files.
13
 *
14
 * @author Lasse Birnbaum Jensen, SDU.
15
 * @author Andreas Åkre Solberg, UNINETT AS. <[email protected]>
16
 * @package SimpleSAMLphp
17
 */
18
class FileLoggingHandler implements LoggingHandlerInterface
19
{
20
    /**
21
     * A string with the path to the file where we should log our messages.
22
     *
23
     * @var null|string
24
     */
25
    protected $logFile = null;
26
27
    /**
28
     * This array contains the mappings from syslog log levels to names. Copied more or less directly from
29
     * SimpleSAML\Logger\ErrorLogLoggingHandler.
30
     *
31
     * @var array
32
     */
33
    private static $levelNames = [
34
        Logger::EMERG   => 'EMERGENCY',
35
        Logger::ALERT   => 'ALERT',
36
        Logger::CRIT    => 'CRITICAL',
37
        Logger::ERR     => 'ERROR',
38
        Logger::WARNING => 'WARNING',
39
        Logger::NOTICE  => 'NOTICE',
40
        Logger::INFO    => 'INFO',
41
        Logger::DEBUG   => 'DEBUG',
42
    ];
43
44
    /** @var string|null */
45
    protected $processname = null;
46
47
    /** @var string */
48
    protected $format = "%b %d %H:%M:%S";
49
50
51
    /**
52
     * Build a new logging handler based on files.
53
     * @param \SimpleSAML\Configuration $config
54
     */
55
    public function __construct(Configuration $config)
56
    {
57
        // get the metadata handler option from the configuration
58
        $this->logFile = $config->getPathValue('loggingdir', 'log/') .
59
            $config->getString('logging.logfile', 'simplesamlphp.log');
60
        $this->processname = $config->getString('logging.processname', 'SimpleSAMLphp');
61
62
        if (@file_exists($this->logFile)) {
63
            if (!@is_writeable($this->logFile)) {
64
                throw new \Exception("Could not write to logfile: " . $this->logFile);
65
            }
66
        } else {
67
            if (!@touch($this->logFile)) {
68
                throw new \Exception(
69
                    "Could not create logfile: " . $this->logFile .
70
                    " The logging directory is not writable for the web server user."
71
                );
72
            }
73
        }
74
75
        Utils\Time::initTimezone();
76
    }
77
78
79
    /**
80
     * Set the format desired for the logs.
81
     *
82
     * @param string $format The format used for logs.
83
     * @return void
84
     */
85
    public function setLogFormat($format)
86
    {
87
        $this->format = $format;
88
    }
89
90
91
    /**
92
     * Log a message to the log file.
93
     *
94
     * @param int    $level The log level.
95
     * @param string $string The formatted message to log.
96
     * @return void
97
     */
98
    public function log($level, $string)
99
    {
100
        if (!is_null($this->logFile)) {
101
            // set human-readable log level. Copied from SimpleSAML\Logger\ErrorLogLoggingHandler.
102
            $levelName = sprintf('UNKNOWN%d', $level);
103
            if (array_key_exists($level, self::$levelNames)) {
104
                $levelName = self::$levelNames[$level];
105
            }
106
107
            $formats = ['%process', '%level'];
108
            $replacements = [$this->processname, $levelName];
109
110
            $matches = [];
111
            if (preg_match('/%date(?:\{([^\}]+)\})?/', $this->format, $matches)) {
112
                $format = "%b %d %H:%M:%S";
113
                if (isset($matches[1])) {
114
                    $format = $matches[1];
115
                }
116
117
                array_push($formats, $matches[0]);
118
                array_push($replacements, strftime($format));
119
            }
120
121
            $string = str_replace($formats, $replacements, $string);
122
            file_put_contents($this->logFile, $string . \PHP_EOL, FILE_APPEND);
0 ignored issues
show
Security File Manipulation introduced by
$string . PHP_EOL can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.

13 paths for user data to reach this point

  1. Path: Read from $_REQUEST, and $_REQUEST['username'] is assigned to $username in modules/core/www/loginuserpass.php on line 29
  1. Read from $_REQUEST, and $_REQUEST['username'] is assigned to $username
    in modules/core/www/loginuserpass.php on line 29
  2. UserPassBase::handleLogin() is called
    in modules/core/www/loginuserpass.php on line 84
  3. Enters via parameter $username
    in modules/core/lib/Auth/UserPassBase.php on line 292
  4. Logger::stats() is called
    in modules/core/lib/Auth/UserPassBase.php on line 324
  5. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 258
  6. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 260
  7. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  8. Logger::defer() is called
    in lib/SimpleSAML/Logger.php on line 514
  9. Enters via parameter $message
    in lib/SimpleSAML/Logger.php on line 394
  10. array('level' => $level, 'string' => $message, 'statsLog' => $stats) is assigned to property Logger::$earlyLog
    in lib/SimpleSAML/Logger.php on line 397
  11. Read from property Logger::$earlyLog, and self::earlyLog is assigned to $msg
    in lib/SimpleSAML/Logger.php on line 306
  12. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 307
  13. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  14. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  15. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  16. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  17. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  18. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  2. Path: Read tainted data from array, and Logger::debug() is called in lib/SimpleSAML/XHTML/Template.php on line 618
  1. Read tainted data from array, and Logger::debug() is called
    in lib/SimpleSAML/XHTML/Template.php on line 618
  2. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 246
  3. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 248
  4. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  5. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  6. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  7. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  8. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  9. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  3. Path: Read tainted data from array, and Logger::error() is called in lib/SimpleSAML/Locale/Translate.php on line 455
  1. Read tainted data from array, and Logger::error() is called
    in lib/SimpleSAML/Locale/Translate.php on line 455
  2. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 197
  3. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 199
  4. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  5. Logger::defer() is called
    in lib/SimpleSAML/Logger.php on line 514
  6. Enters via parameter $message
    in lib/SimpleSAML/Logger.php on line 394
  7. array('level' => $level, 'string' => $message, 'statsLog' => $stats) is assigned to property Logger::$earlyLog
    in lib/SimpleSAML/Logger.php on line 397
  8. Read from property Logger::$earlyLog, and self::earlyLog is assigned to $msg
    in lib/SimpleSAML/Logger.php on line 306
  9. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 307
  10. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  11. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  12. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  13. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  14. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  15. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  4. Path: Read from $_REQUEST, and $_REQUEST['username'] is assigned to $username in modules/core/www/loginuserpassorg.php on line 32
  1. Read from $_REQUEST, and $_REQUEST['username'] is assigned to $username
    in modules/core/www/loginuserpassorg.php on line 32
  2. UserPassOrgBase::handleLogin() is called
    in modules/core/www/loginuserpassorg.php on line 106
  3. Enters via parameter $username
    in modules/core/lib/Auth/UserPassOrgBase.php on line 276
  4. Logger::stats() is called
    in modules/core/lib/Auth/UserPassOrgBase.php on line 319
  5. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 258
  6. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 260
  7. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  8. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  9. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  10. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  11. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  12. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  5. Path: Read from $_REQUEST, and $_REQUEST['reportId'] is assigned to $reportId in www/errorreport.php on line 16
  1. Read from $_REQUEST, and $_REQUEST['reportId'] is assigned to $reportId
    in www/errorreport.php on line 16
  2. Logger::error() is called
    in www/errorreport.php on line 53
  3. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 197
  4. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 199
  5. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  6. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  7. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  8. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  9. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  10. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  6. Path: Read from $_REQUEST, and $_REQUEST['organization'] is assigned to $organization in modules/core/www/loginuserpassorg.php on line 48
  1. Read from $_REQUEST, and $_REQUEST['organization'] is assigned to $organization
    in modules/core/www/loginuserpassorg.php on line 48
  2. UserPassOrgBase::handleLogin() is called
    in modules/core/www/loginuserpassorg.php on line 108
  3. Enters via parameter $organization
    in modules/core/lib/Auth/UserPassOrgBase.php on line 276
  4. Logger::stats() is called
    in modules/core/lib/Auth/UserPassOrgBase.php on line 319
  5. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 258
  6. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 260
  7. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  8. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  9. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  10. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  11. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  12. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  7. Path: ParameterBag::get() returns request data in vendor/symfony/http-foundation/ParameterBag.php on line 82
  1. ParameterBag::get() returns request data
    in vendor/symfony/http-foundation/ParameterBag.php on line 82
  2. $request->server->get('PATH_INFO') is assigned to $url
    in lib/SimpleSAML/Module.php on line 138
  3. Data is passed through substr(), and substr($url, $modEnd + 1) is assigned to $url
    in lib/SimpleSAML/Module.php on line 153
  4. $moduleDir . $url is assigned to $path
    in lib/SimpleSAML/Module.php on line 228
  5. Logger::warning() is called
    in lib/SimpleSAML/Module.php on line 289
  6. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 209
  7. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 211
  8. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  9. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  10. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  11. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  12. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  13. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  8. Path: Read from $_COOKIE, and $_COOKIE[$source->getAuthId() . '-username'] is assigned to $username in modules/core/www/loginuserpassorg.php on line 34
  1. Read from $_COOKIE, and $_COOKIE[$source->getAuthId() . '-username'] is assigned to $username
    in modules/core/www/loginuserpassorg.php on line 34
  2. UserPassOrgBase::handleLogin() is called
    in modules/core/www/loginuserpassorg.php on line 106
  3. Enters via parameter $username
    in modules/core/lib/Auth/UserPassOrgBase.php on line 276
  4. Logger::stats() is called
    in modules/core/lib/Auth/UserPassOrgBase.php on line 319
  5. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 258
  6. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 260
  7. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  8. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  9. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  10. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  11. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  12. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  9. Path: Read tainted data from array, and Logger::debug() is called in lib/SimpleSAML/Locale/Localization.php on line 264
  1. Read tainted data from array, and Logger::debug() is called
    in lib/SimpleSAML/Locale/Localization.php on line 264
  2. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 246
  3. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 248
  4. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  5. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  6. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  7. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  8. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  9. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  10. Path: Read tainted data from array, and Logger::debug() is called in lib/SimpleSAML/Locale/Localization.php on line 249
  1. Read tainted data from array, and Logger::debug() is called
    in lib/SimpleSAML/Locale/Localization.php on line 249
  2. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 246
  3. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 248
  4. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  5. Logger::defer() is called
    in lib/SimpleSAML/Logger.php on line 514
  6. Enters via parameter $message
    in lib/SimpleSAML/Logger.php on line 394
  7. array('level' => $level, 'string' => $message, 'statsLog' => $stats) is assigned to property Logger::$earlyLog
    in lib/SimpleSAML/Logger.php on line 397
  8. Read from property Logger::$earlyLog, and self::earlyLog is assigned to $msg
    in lib/SimpleSAML/Logger.php on line 306
  9. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 307
  10. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  11. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  12. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  13. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  14. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  15. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  11. Path: Read from $_COOKIE, and $_COOKIE[$source->getAuthId() . '-username'] is assigned to $username in modules/core/www/loginuserpass.php on line 31
  1. Read from $_COOKIE, and $_COOKIE[$source->getAuthId() . '-username'] is assigned to $username
    in modules/core/www/loginuserpass.php on line 31
  2. UserPassBase::handleLogin() is called
    in modules/core/www/loginuserpass.php on line 84
  3. Enters via parameter $username
    in modules/core/lib/Auth/UserPassBase.php on line 292
  4. Logger::stats() is called
    in modules/core/lib/Auth/UserPassBase.php on line 324
  5. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 258
  6. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 260
  7. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  8. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  9. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  10. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  11. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  12. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  12. Path: Read from $_COOKIE, and $_COOKIE[$source->getAuthId() . '-organization'] is assigned to $organization in modules/core/www/loginuserpassorg.php on line 53
  1. Read from $_COOKIE, and $_COOKIE[$source->getAuthId() . '-organization'] is assigned to $organization
    in modules/core/www/loginuserpassorg.php on line 53
  2. UserPassOrgBase::handleLogin() is called
    in modules/core/www/loginuserpassorg.php on line 108
  3. Enters via parameter $organization
    in modules/core/lib/Auth/UserPassOrgBase.php on line 276
  4. Logger::stats() is called
    in modules/core/lib/Auth/UserPassOrgBase.php on line 319
  5. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 258
  6. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 260
  7. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  8. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  9. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  10. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  11. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  12. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121
  13. Path: Logger::log() is called in lib/SimpleSAML/Logger.php on line 307
  1. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 307
  2. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  3. Logger::defer() is called
    in lib/SimpleSAML/Logger.php on line 514
  4. Enters via parameter $message
    in lib/SimpleSAML/Logger.php on line 394
  5. array('level' => $level, 'string' => $message, 'statsLog' => $stats) is assigned to property Logger::$earlyLog
    in lib/SimpleSAML/Logger.php on line 397
  6. Read from property Logger::$earlyLog, and self::earlyLog is assigned to $msg
    in lib/SimpleSAML/Logger.php on line 306
  7. Logger::log() is called
    in lib/SimpleSAML/Logger.php on line 307
  8. Enters via parameter $string
    in lib/SimpleSAML/Logger.php on line 471
  9. array(self::trackid, $string, $_SERVER['REMOTE_ADDR']) is assigned to $replacements
    in lib/SimpleSAML/Logger.php on line 504
  10. Data is passed through str_replace(), and str_replace($formats, $replacements, self::format) is assigned to $string
    in lib/SimpleSAML/Logger.php on line 523
  11. FileLoggingHandler::log() is called
    in lib/SimpleSAML/Logger.php on line 524
  12. Enters via parameter $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 98
  13. Data is passed through str_replace(), and str_replace($formats, $replacements, $string) is assigned to $string
    in lib/SimpleSAML/Logger/FileLoggingHandler.php on line 121

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
123
        }
124
    }
125
}
126