Issues in CanvasPest.php (master) - Issues in master - smtech/canvaspest - Measure and Improve Code Quality continuously with Scrutinizer

Issues (14)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/CanvasPest.php (12 issues)

Labels

Severity

Major 12

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

/** smtech\CanvasPest\CanvasPest */

namespace smtech\CanvasPest;

/**
 * An object to handle interactions with the Canvas API.
 *
 * For more information on the Canvas API refer to the offical
 * {@link https://canvas.instructure.com/doc/api/ Canvas API documentation} or
 * to the (slightly more up-to-date and pleasingly interactive)
 * {@link https://canvas.instructure.com/doc/api/live live documentation}.
 *
 * You can access the live documentation for your own Canvas instance and make
 * actual API calls to it at `https://<path-to-your-instance>/doc/api/live`
 *
 * @author Seth Battis <[email protected]>
 **/
class CanvasPest extends \Battis\Educoder\Pest
{

    /** Name of the parameter controlling the number of responses per page */
    const PARAM_PER_PAGE = 'per_page';

    /** @var string[] $headers Additional headers to be passed to the API with each call */
    protected $headers;

    /**
     * Construct a new CanvasPest
     *
     * @api
     *
     * @param string $apiInstanceUrl URL of the API instance (e.g.
     *        `'https://canvas.instructure.com/api/v1'`)
     * @param string $apiAuthorizationToken (Optional) API access token for the
     *        API instance (if not provided now, it will need to be provided later)
     *
     * @see CanvasPest::setupToken() To configure the API access token later
     **/
    public function __construct($apiInstanceUrl, $apiAuthorizationToken = null)
    {
        parent::__construct($apiInstanceUrl);
        if (!empty($apiAuthorizationToken)) {
            $this->setupToken($apiAuthorizationToken);
        }
    }

    /**
     * Set up a new API access token to access this instance
     *
     * @param string $token API access token
     *
     * @return boolean
     *
     * @throws CanvasPest_Exception INVALID_TOKEN on an empty or non-string token value
     **/
    public function setupToken($token)
    {
        if (!empty($token)) {
            $this->headers['Authorization'] = "Bearer $token";
            return true;
        } else {
            if ($this->throw_exceptions) {
                throw new CanvasPest_Exception(
                    'API authorization token must be a non-zero-length string',
                    CanvasPest_Exception::INVALID_TOKEN
                );
            }
            return false;
        }
    }

    /**
     * Preprocess API call parameters before use
     *
     * Force maximum response page size, if not already defined.
     *
     * @param string[] $data Array of parameters for the next API call
     *
     * @return string[] Updated array of parameters
     *
     * @see CanvasArray::MAXIMUM_PER_PAGE Maximum number of responses per page
     * @see CanvasPest::PARAM_PER_PAGE Page size parameter
     **/
    private function preprocessData($data)
    {
        if (is_array($data) && !array_key_exists(self::PARAM_PER_PAGE, $data)) {
            $data[self::PARAM_PER_PAGE] = CanvasArray::MAXIMUM_PER_PAGE;
        }
        return $data;
    }

    /**
     * Prepare API request headers
     *
     * Flatten headers from an associative array to a numerically indexed array
     * of `"Name: Value"` style entries like `CURLOPT_HTTPHEADER` expects.
     * Numerically indexed arrays are not modified.
     *
     * Extended by CanvasPest to include the API access token in the
     * `Authorization` header.
     *
     * @param string[] $headers
     * @return string[]
     **/
    protected function prepHeaders($headers)
    {
        return parent::prepHeaders(array_merge($this->headers, $headers));
    }

    /**
     * Parse the API response into an object (or collection of objects).
     *
     * For queries to individually identified endpoints (e.g.
     * `accounts/1/users/123`), return a CanvasObject representing the API response
     * describing _that_ individually identified object affected by the query.
     *
     * For queries to generic endpoints (e.g. `accounts/1/users`), return a
     * traversable CanvasArray (of CanvasObjects) representing the API response
     * describing the list of objects affected by the query.
     *
     * @param string $response JSON-encoded response from the API
     *
     * @return CanvasObject|CanvasArray|false
     *
     * @throws CanvasPest_Exception INVALID_JSON_RESPONSE if an
     *         non-JSON-formatted response is received (and
     *         $this->throw_exceptions is true -- otherwise it returns false)
     **/
    protected function postprocessResponse($response)
    {
        if (substr($response, 0, 1) == '{') {
            return new CanvasObject($response);
        } elseif (substr($response, 0, 1) == '[') {
            return new CanvasArray($response, $this);
        } else {
            if ($this->throw_exceptions) {
                throw new CanvasPest_Exception(
                    $response,
                    CanvasPest_Exception::INVALID_JSON_RESPONSE
                );
            }
            return false;
        }
    }

    /**
     * Reformat query parameters for Canvas
     *
     * Specifically, Canvas expects no numeric indices for base array parameters.
     *
     * @param mixed $data
     *
     * @return string
     * @codingStandardsIgnoreStart
     **/
    protected function http_build_query($data)
    {
        // @codingStandardsIgnoreEnd
        return preg_replace('/%5B\d+%5D/simU', '[]', http_build_query($data));
    }

    /**
     * Make a GET call to the API
     *
     * For queries to individually identified endpoints (e.g.
     * `accounts/1/users/123`), return a CanvasObject representing the API response
     * describing _that_ individually identified object affected by the query.
     *
     * For queries to generic endpoints (e.g. `accounts/1/users`), return a
     * traversable CanvasArray (of CanvasObjects) representing the API response
     * describing the list of objects affected by the query.
     *
     * @api
     *
     * @param string $path Path to the API endpoint of this call
     * @param string|string[] $data (Optional) Query parameters for this call
     * @param string|string[] $headers (Optional) Any additional HTTP headers for this call
     *
     * @return CanvasObject|CanvasArray|false
     **/
    public function get($path, $data = array(), $headers = array())
    {
        return $this->postprocessResponse(
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
            parent::get($path, $this->preprocessData($data), $headers)

        );
    }

    /**
     * Make a POST call to the API
     *
     * For queries to individually identified endpoints (e.g.
     * `accounts/1/users/123`), return a CanvasObject representing the API response
     * describing _that_ individually identified object affected by the query.
     *
     * @api
     *
     * @param string $path Path to the API endpoint of this call
     * @param string|string[] $data (Optional) Query parameters for this call
     * @param string|string[] $headers (Optional) Any additional HTTP headers for this call
     *
     * @return CanvasObject|false
     **/
    public function post($path, $data = array(), $headers = array())
    {
        return $this->postprocessResponse(
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
            parent::post($path, $this->preprocessData($data), $headers)

        );
    }

    /**
     * Make a PUT call to the API
     *
     * For queries to individually identified endpoints (e.g.
     * `accounts/1/users/123`), return a CanvasObject representing the API response
     * describing _that_ individually identified object affected by the query.
     *
     * @api
     *
     * @param string $path Path to the API endpoint of this call
     * @param string|string[] $data (Optional) Query parameters for this call
     * @param string|string[] $headers (Optional) Any additional HTTP headers for this call
     *
     * @return CanvasObject|false
     **/
    public function put($path, $data = array(), $headers = array())
    {
        return $this->postprocessResponse(
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
            parent::put($path, $this->preprocessData($data), $headers)

        );
    }

    /**
     * Make a DELETE call to the API
     *
     * For queries to individually identified endpoints (e.g.
     * `accounts/1/users/123`), return a CanvasObject representing the API
     * response describing _that_ individually identified object affected by
     * the query.
     *
     * @api
     *
     * @param string $path Path to the API endpoint of this call
     * @param string|string[] $data (Optional) Query parameters for this call
     * @param string|string[] $headers (Optional) Any additional HTTP headers for this call
     *
     * @return CanvasObject|false
     **/
    public function delete($path, $data = array(), $headers = array())
    {
        if (!empty($data)) {
            $pathData = [];
            $pos = strpos($path, '?');
            if ($pos !== false) {
                parse_str(substr($path, $pos + 1), $pathData);
                $path = substr($path, 0, $pos);
            }
            $path .= '?' . $this->http_build_query(array_merge($pathData, $data));
        }
        return $this->postprocessResponse(
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
            parent::delete($path, $headers)

        );
    }

    /**
     * Make a PATCH call to the API
     *
     * @deprecated The Canvas API does not currently support PATCH calls
     *
     * @param string $path Path to the API endpoint of this call
     * @param string|string[] $data (Optional) Query parameters for this call
     * @param string|string[] $headers (Optional) Any additional HTTP headers for this call
     *
     * @return false
     *
     * @throws CanvasPest_Exception UNSUPPORTED_METHOD All calls to this method will cause an exception
     **/
    public function patch($path, $data = array(), $headers = array())
    {
        if ($this->throw_exceptions) {
            throw new CanvasPest_Exception(
                'The Canvas API does not support the PATCH method',
                CanvasPest_Exception::UNSUPPORTED_METHOD
            );
        }
        return false;
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
    }
}


smtech / canvaspest

Issues (14)

Security Analysis no request data

src/CanvasPest.php (12 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like