Issues in Snapshot.php (master) - Issues in master - smtech/grading-analytics - Measure and Improve Code Quality continuously with Scrutinizer

Issues (23)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Snapshots/Snapshot.php (1 issue)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/** Snapshot class */

namespace smtech\GradingAnalytics\Snapshots;

/**
 * A snapshot of course statistics relevant to a particular domain
 *
 * @author Seth Battis <[email protected]>
 */
class Snapshot extends CacheableDatabase
{
    const NOT_ASSOCIATED_WITH_COURSE = '-';

    /**
     * History of the course specified by `$courseOrDepartmentId` in constructor
     * @var History
     */
    protected $history;

    /**
     * Department ID given as `$courseOrDepartmentId` in constructor
     * @var string|integer|false
     */
    protected $departmentId = false;

    /**
     * The domain of this snapshot
     * @var Domain
     */
    protected $domain;

    /**
     * Date timestamp of this snapshot
     * @var string|false
     */
    protected $timestamp = false;

    /**
     * Course statistics records that make up the snapshot
     * @var array
     */
    protected static $data;

    /**
     * Averages calculated from the data
     * @var array
     */
    protected $averages;

    /**
     * Teacher filter (a numerica Canvas user ID) for restricted views of data
     * @var string|integer|boolean
     */
    public static $teacherFilter;

    /**
     * Construct a Snapshot object
     *
     * Note that the snapshots are queried and/or cached from the database
     * "just in time", and not during instantiation.
     *
     * If the snapshot is constructed relative to a course ID, the domain will
     * being snapshotted will will be snapshotted at the time of that course's
     * most recent statistic collection (so, if it's June 20, and the last
     * statistic collected for the course was May 20, the department snapshot
     * will be for May 20, even if more recent snapshots are available within
     * the department).
     *
     * @param \mysqli|\smtech\ReflexiveCanvasLTI\Toolbox\CacheableDatabase
     *        $databaseProvider An object containing a mysqli database access
     *          object
     * @param Domain $domain The domain of the snapshot
     * @param string|integer $courseOrDepartmentId A numeric Canvas course or
     *        ccount ID (course is is assumed unless explicitly specified by
     *        `$isCourseId`)
     * @param boolean $isCourseId (Optional, defaults to `TRUE`) Whether
     *                            `$courseOrDepartmentId` is course ID (`TRUE`)
     *                             or an account ID (`FALSE`)
     */
    public function __construct($databaseProvider, Domain $domain, $courseOrDepartmentId, $isCourseId = true)
    {
        parent::__construct($databaseProvider);

        $this->domain = $domain;

        if ($isCourseId) {
            $this->history = new History($this, $courseOrDepartmentId);
        } elseif (is_numeric($courseOrDepartmentId)) {
            $this->departmentId = $courseOrDepartmentId;
class Id
{
    public $id;

    public function __construct($id)
    {
        $this->id = $id;
    }

}

class Account
{
    /** @var  Id $id */
    public $id;
}

$account_id = false;

if (starsAreRight()) {
    $account_id = new Id(42);
}

$account = new Account();
if ($account instanceof Id)
{
    $account->id = $account_id;
}
        }
    }

    /**
     * Get the numeric Canvas course ID relevant to this snapshot
     *
     * There may be no course relevant to this snapshot if it was created from
     * a department ID.
     *
     * @return string|integer Returns `Snapshot::NOT_ASSOCIATED_WITH_COURSE` if
     *                                no course is associated with the snapshot.
     */
    public function getCourseId()
    {
        if (!empty($this->history)) {
            return $this->history->getCourseId();
        }
        return self::NOT_ASSOCIATED_WITH_COURSE;
    }

    /**
     * Get the numeric Canvas account ID relevant to this snapshot
     *
     * @return string|integer|false Will return `FALSE` if the snapshot is
     *                                   associated with a course for which
     *                                   there are not yet any statistics
     *                                   available.
     */
    public function getDepartmentId()
    {
        if ($this->departmentId === false) {
            $this->departmentId = $this->history->getDepartmentId();
        }
        return $this->departmentId;
    }

    /**
     * Get the domain of the snapshot
     *
     * @return Domain
     */
    public function getDomain()
    {
        return $this->domain;
    }

    /**
     * Get the date of the snapshot
     *
     * @see Snapshot::__construct() `Snapshot::__construct()` for a fuller
     *      discussion of timestamp selection
     *
     * @return string|false Returns the date in `YYYY-MM-DD` format or `FALSE`
     *                      if a timestamp could not be calculated (if no
     *                      statistics are available for the current
     *                      domain/course combination, for example)
     */
    public function getTimestamp()
    {
        if ($this->timestamp === false) {
            if (!empty($this->history)) {
                $this->timestamp = $this->history->getCurrentTimestamp();
            } else {
                if ($response = $this->getMySql()->query("
                    SELECT * FROM `course_statistics`
                        WHERE
                            `course[account_id]` = '" . $this->getDepartmentId() . "'
                        ORDER BY
                            `timestamp` DESC
                        LIMIT 1
                ")) {
                    if ($row = $response->fetch_assoc()) {
                        $this->timestamp = substr($row['timestamp'], 0, 10);
                    }
                }
            }
        }
        return $this->timestamp;
    }

    /**
     * Get a particular average calculated across the snapshot
     *
     * @see Average `Average` for available averages
     *
     * @param  Average $average
     * @return double|false Returns `FALSE` if an average could not be computed
     *                      (e.g. if there are no stastics from which to
     *                      compute it)
     */
    public function getAverage(Average $average)
    {
        if ($this->cacheSnapshot()) {
            return $this->averages[$average->getValue()];
        }
        return false;
    }

    /**
     * Get the snapshotted course statistics data
     *
     * @link https://smtech.github.io/grading-analytics/definitions.html Online
     *       documentation of course statistic fields
     *
     * @param string|integer|boolean $teacherFilter (Optional, defaults to
     *                                              `FALSE`) An optional filter
     *                                              to limit the snapshot data
     *                                              to courses taught by a
     *                                              particular numerica Canvas
     *                                              user ID
     * @return array|false One row per course statistic collected daily, as
     *                         described in the documentation, or `FALSE` if no
     *                         statistics are available
     */
    public function getSnapshot($teacherFilter = false)
    {
        if ($this->domain == Domain::COURSE()) {
            $snapshot = $this->history->getHistory();
            if (is_array($snapshot) && count($snapshot) > 0) {
                return $snapshot[0];
            }
        } elseif ($this->cacheSnapshot()) {
            $d = $this->getDomain()->getValue();
            if ($teacherFilter) {
                self::$teacherFilter = $teacherFilter;
                return array_filter(
                    static::$data[$this->getCourseId()][$d][$this->getTimestamp()],
                    function ($elt) {
                        return array_search(
                            self::$teacherFilter,
                            unserialize($elt['teacher[id]s'])
                        ) !== false;
                    }
                );
            }
            return static::$data[$this->getCourseId()][$d][$this->getTimestamp()];
        }
        return false;
    }

    /**
     * Trigger a caching of snapshotted course statistics, if not already cached
     *
     * @return boolean `TRUE` if there is a non-empty cache of course
     *                        statistics to work with, `FALSE` otherwise
     */
    public function cacheSnapshot()
    {
        $domain = $this->getDomain();
        if ($domain == Domain::COURSE()) {
            return $this->history->cacheHistory();
        } else {
            $courseId = $this->getCourseId();
            $d = $domain->getValue();
            $timestamp = $this->getTimestamp();
            if (empty(static::$data[$courseId][$d][$timestamp])) {
                $this->getCache()->pushKey($courseId);
                $this->getCache()->pushKey(($domain == Domain::DEPARTMENT() ? $this->getDepartmentId() : 'school'));
                static::$data[$courseId][$d][$timestamp] = $this->getCache()->getCache($timestamp);
                $this->averages = $this->getCache()->getCache("$timestamp-averages");
                if (empty(static::$data[$courseId][$d][$timestamp])) {
                    if ($response = $this->getMySql()->query("
                        SELECT * FROM `course_statistics`
                            WHERE
                                " . ($domain == Domain::DEPARTMENT() ?
                                        "`course[account_id]` = '" . $this->getDepartmentId() . "' AND" :
                                        ''
                                    ) . "
                                `timestamp` LIKE '$timestamp%'
                            GROUP BY
                                `course[id]`
                            ORDER BY
                                `timestamp` DESC
                    ")) {
                        $total = [
                            Average::TURN_AROUND => 0,
                            Average::ASSIGNMENT_COUNT => 0
                        ];
                        $divisor = [
                            Average::TURN_AROUND => 0,
                            Average::ASSIGNMENT_COUNT => $response->num_rows
                        ];

                        while ($row = $response->fetch_assoc()) {
                            static::$data[$courseId][$d][$timestamp][] = $row;

                            $total[Average::TURN_AROUND] +=
                                $row['average_grading_turn_around'] *
                                $row['student_count'] *
                                $row['graded_assignment_count'];
                            $divisor[Average::TURN_AROUND] +=
                                $row['student_count'] *
                                $row['graded_assignment_count'];

                            $total[Average::ASSIGNMENT_COUNT] +=
                                $row['assignments_due_count'] +
                                $row['dateless_assignment_count'];
                        }

                        foreach (Average::values() as $avg) {
                            $i = $avg->getValue();
                            $this->averages[$i] = ($divisor[$i] !== 0 ?
                                    $total[$i] / $divisor[$i] :
                                    0
                                );
                        }

                        $this->getCache()->setCache($timestamp, static::$data[$courseId][$d][$timestamp]);
                        $this->getCache()->setCache("$timestamp-averages", $this->averages);
                    }
                }
            }
            return is_array(static::$data) &&
                is_array(static::$data[$courseId]) &&
                is_array(static::$data[$courseId][$d]) &&
                is_array(static::$data[$courseId][$d][$timestamp]) &&
                count(static::$data[$courseId][$d][$timestamp]) > 0;
        }
    }
}


1			<?php
2			/** Snapshot class */
3
4			namespace smtech\GradingAnalytics\Snapshots;
5
6			/**
7			* A snapshot of course statistics relevant to a particular domain
8			*
9			* @author Seth Battis <[email protected]>
10			*/
11			class Snapshot extends CacheableDatabase
12			{
13			const NOT_ASSOCIATED_WITH_COURSE = '-';
14
15			/**
16			* History of the course specified by `$courseOrDepartmentId` in constructor
17			* @var History
18			*/
19			protected $history;
20
21			/**
22			* Department ID given as `$courseOrDepartmentId` in constructor
23			* @var string\|integer\|false
24			*/
25			protected $departmentId = false;
26
27			/**
28			* The domain of this snapshot
29			* @var Domain
30			*/
31			protected $domain;
32
33			/**
34			* Date timestamp of this snapshot
35			* @var string\|false
36			*/
37			protected $timestamp = false;
38
39			/**
40			* Course statistics records that make up the snapshot
41			* @var array
42			*/
43			protected static $data;
44
45			/**
46			* Averages calculated from the data
47			* @var array
48			*/
49			protected $averages;
50
51			/**
52			* Teacher filter (a numerica Canvas user ID) for restricted views of data
53			* @var string\|integer\|boolean
54			*/
55			public static $teacherFilter;
56
57			/**
58			* Construct a Snapshot object
59			*
60			* Note that the snapshots are queried and/or cached from the database
61			* "just in time", and not during instantiation.
62			*
63			* If the snapshot is constructed relative to a course ID, the domain will
64			* being snapshotted will will be snapshotted at the time of that course's
65			* most recent statistic collection (so, if it's June 20, and the last
66			* statistic collected for the course was May 20, the department snapshot
67			* will be for May 20, even if more recent snapshots are available within
68			* the department).
69			*
70			* @param \mysqli\|\smtech\ReflexiveCanvasLTI\Toolbox\CacheableDatabase
71			* $databaseProvider An object containing a mysqli database access
72			* object
73			* @param Domain $domain The domain of the snapshot
74			* @param string\|integer $courseOrDepartmentId A numeric Canvas course or
75			* ccount ID (course is is assumed unless explicitly specified by
76			* `$isCourseId`)
77			* @param boolean $isCourseId (Optional, defaults to `TRUE`) Whether
78			* `$courseOrDepartmentId` is course ID (`TRUE`)
79			* or an account ID (`FALSE`)
80			*/
81			public function __construct($databaseProvider, Domain $domain, $courseOrDepartmentId, $isCourseId = true)
82			{
83			parent::__construct($databaseProvider);
84
85			$this->domain = $domain;
86
87			if ($isCourseId) {
88			$this->history = new History($this, $courseOrDepartmentId);
89			} elseif (is_numeric($courseOrDepartmentId)) {
90			$this->departmentId = $courseOrDepartmentId;
			0 ignored issues – show Documentation Bug introduced 2017-06-07 20:27 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `$courseOrDepartmentId` can also be of type `double`. However, the property `$departmentId` is declared as type `string\|integer\|false`. Maybe add an additional type check? Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly. For example, imagine you have a variable `$accountId` that can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to the `id` property of an instance of the `Account` class. This class holds a proper account, so the id value must no longer be false. Either this assignment is in error or a type check should be added for that assignment. class Id { public $id; public function __construct($id) { $this->id = $id; } } class Account { /** @var Id $id */ public $id; } $account_id = false; if (starsAreRight()) { $account_id = new Id(42); } $account = new Account(); if ($account instanceof Id) { $account->id = $account_id; } Loading history...
91			}
92			}
93
94			/**
95			* Get the numeric Canvas course ID relevant to this snapshot
96			*
97			* There may be no course relevant to this snapshot if it was created from
98			* a department ID.
99			*
100			* @return string\|integer Returns `Snapshot::NOT_ASSOCIATED_WITH_COURSE` if
101			* no course is associated with the snapshot.
102			*/
103			public function getCourseId()
104			{
105			if (!empty($this->history)) {
106			return $this->history->getCourseId();
107			}
108			return self::NOT_ASSOCIATED_WITH_COURSE;
109			}
110
111			/**
112			* Get the numeric Canvas account ID relevant to this snapshot
113			*
114			* @return string\|integer\|false Will return `FALSE` if the snapshot is
115			* associated with a course for which
116			* there are not yet any statistics
117			* available.
118			*/
119			public function getDepartmentId()
120			{
121			if ($this->departmentId === false) {
122			$this->departmentId = $this->history->getDepartmentId();
123			}
124			return $this->departmentId;
125			}
126
127			/**
128			* Get the domain of the snapshot
129			*
130			* @return Domain
131			*/
132			public function getDomain()
133			{
134			return $this->domain;
135			}
136
137			/**
138			* Get the date of the snapshot
139			*
140			* @see Snapshot::__construct() `Snapshot::__construct()` for a fuller
141			* discussion of timestamp selection
142			*
143			* @return string\|false Returns the date in `YYYY-MM-DD` format or `FALSE`
144			* if a timestamp could not be calculated (if no
145			* statistics are available for the current
146			* domain/course combination, for example)
147			*/
148			public function getTimestamp()
149			{
150			if ($this->timestamp === false) {
151			if (!empty($this->history)) {
152			$this->timestamp = $this->history->getCurrentTimestamp();
153			} else {
154			if ($response = $this->getMySql()->query("
155			SELECT * FROM `course_statistics`
156			WHERE
157			`course[account_id]` = '" . $this->getDepartmentId() . "'
158			ORDER BY
159			`timestamp` DESC
160			LIMIT 1
161			")) {
162			if ($row = $response->fetch_assoc()) {
163			$this->timestamp = substr($row['timestamp'], 0, 10);
164			}
165			}
166			}
167			}
168			return $this->timestamp;
169			}
170
171			/**
172			* Get a particular average calculated across the snapshot
173			*
174			* @see Average `Average` for available averages
175			*
176			* @param Average $average
177			* @return double\|false Returns `FALSE` if an average could not be computed
178			* (e.g. if there are no stastics from which to
179			* compute it)
180			*/
181			public function getAverage(Average $average)
182			{
183			if ($this->cacheSnapshot()) {
184			return $this->averages[$average->getValue()];
185			}
186			return false;
187			}
188
189			/**
190			* Get the snapshotted course statistics data
191			*
192			* @link https://smtech.github.io/grading-analytics/definitions.html Online
193			* documentation of course statistic fields
194			*
195			* @param string\|integer\|boolean $teacherFilter (Optional, defaults to
196			* `FALSE`) An optional filter
197			* to limit the snapshot data
198			* to courses taught by a
199			* particular numerica Canvas
200			* user ID
201			* @return array\|false One row per course statistic collected daily, as
202			* described in the documentation, or `FALSE` if no
203			* statistics are available
204			*/
205			public function getSnapshot($teacherFilter = false)
206			{
207			if ($this->domain == Domain::COURSE()) {
208			$snapshot = $this->history->getHistory();
209			if (is_array($snapshot) && count($snapshot) > 0) {
210			return $snapshot[0];
211			}
212			} elseif ($this->cacheSnapshot()) {
213			$d = $this->getDomain()->getValue();
214			if ($teacherFilter) {
215			self::$teacherFilter = $teacherFilter;
216			return array_filter(
217			static::$data[$this->getCourseId()][$d][$this->getTimestamp()],
218			function ($elt) {
219			return array_search(
220			self::$teacherFilter,
221			unserialize($elt['teacher[id]s'])
222			) !== false;
223			}
224			);
225			}
226			return static::$data[$this->getCourseId()][$d][$this->getTimestamp()];
227			}
228			return false;
229			}
230
231			/**
232			* Trigger a caching of snapshotted course statistics, if not already cached
233			*
234			* @return boolean `TRUE` if there is a non-empty cache of course
235			* statistics to work with, `FALSE` otherwise
236			*/
237			public function cacheSnapshot()
238			{
239			$domain = $this->getDomain();
240			if ($domain == Domain::COURSE()) {
241			return $this->history->cacheHistory();
242			} else {
243			$courseId = $this->getCourseId();
244			$d = $domain->getValue();
245			$timestamp = $this->getTimestamp();
246			if (empty(static::$data[$courseId][$d][$timestamp])) {
247			$this->getCache()->pushKey($courseId);
248			$this->getCache()->pushKey(($domain == Domain::DEPARTMENT() ? $this->getDepartmentId() : 'school'));
249			static::$data[$courseId][$d][$timestamp] = $this->getCache()->getCache($timestamp);
250			$this->averages = $this->getCache()->getCache("$timestamp-averages");
251			if (empty(static::$data[$courseId][$d][$timestamp])) {
252			if ($response = $this->getMySql()->query("
253			SELECT * FROM `course_statistics`
254			WHERE
255			" . ($domain == Domain::DEPARTMENT() ?
256			"`course[account_id]` = '" . $this->getDepartmentId() . "' AND" :
257			''
258			) . "
259			`timestamp` LIKE '$timestamp%'
260			GROUP BY
261			`course[id]`
262			ORDER BY
263			`timestamp` DESC
264			")) {
265			$total = [
266			Average::TURN_AROUND => 0,
267			Average::ASSIGNMENT_COUNT => 0
268			];
269			$divisor = [
270			Average::TURN_AROUND => 0,
271			Average::ASSIGNMENT_COUNT => $response->num_rows
272			];
273
274			while ($row = $response->fetch_assoc()) {
275			static::$data[$courseId][$d][$timestamp][] = $row;
276
277			$total[Average::TURN_AROUND] +=
278			$row['average_grading_turn_around'] *
279			$row['student_count'] *
280			$row['graded_assignment_count'];
281			$divisor[Average::TURN_AROUND] +=
282			$row['student_count'] *
283			$row['graded_assignment_count'];
284
285			$total[Average::ASSIGNMENT_COUNT] +=
286			$row['assignments_due_count'] +
287			$row['dateless_assignment_count'];
288			}
289
290			foreach (Average::values() as $avg) {
291			$i = $avg->getValue();
292			$this->averages[$i] = ($divisor[$i] !== 0 ?
293			$total[$i] / $divisor[$i] :
294			0
295			);
296			}
297
298			$this->getCache()->setCache($timestamp, static::$data[$courseId][$d][$timestamp]);
299			$this->getCache()->setCache("$timestamp-averages", $this->averages);
300			}
301			}
302			}
303			return is_array(static::$data) &&
304			is_array(static::$data[$courseId]) &&
305			is_array(static::$data[$courseId][$d]) &&
306			is_array(static::$data[$courseId][$d][$timestamp]) &&
307			count(static::$data[$courseId][$d][$timestamp]) > 0;
308			}
309			}
310			}
311

smtech / grading-analytics

Issues (23)

Security Analysis not enabled

src/Snapshots/Snapshot.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like