Issues in DoctrineORMMapper.php (master) - Issues in master - sonata-project/SonataEasyExtendsBundle - Measure and Improve Code Quality continuously with Scrutinizer

Issues (32)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Mapper/DoctrineORMMapper.php (7 issues)

Labels

Compatibility 7

Severity

Minor 7

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

declare(strict_types=1);

/*
 * This file is part of the Sonata Project package.
 *
 * (c) Thomas Rabaix <[email protected]>
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace Sonata\EasyExtendsBundle\Mapper;

use Doctrine\Common\EventSubscriber;
use Doctrine\Common\Persistence\Event\LoadClassMetadataEventArgs;
use Doctrine\Common\Persistence\ManagerRegistry;
use Doctrine\ORM\Mapping\ClassMetadataInfo;

class DoctrineORMMapper implements EventSubscriber
{
    /**
     * @var array
     */
    protected $associations;

    /**
     * @var array
     */
    protected $discriminators;

    /**
     * @var array
     */
    protected $discriminatorColumns;

    /**
     * @var array
     */
    protected $inheritanceTypes;

    /**
     * @var ManagerRegistry
     */
    protected $doctrine;

    /**
     * @var array
     */
    protected $indexes;

    /**
     * @var array
     */
    protected $uniques;

    /**
     * @var array
     */
    protected $overrides;

    public function __construct(ManagerRegistry $doctrine, array $associations = [], array $indexes = [], array $discriminators = [], array $discriminatorColumns = [], array $inheritanceTypes = [], array $uniques = [], array $overrides = [])
    {
        $this->doctrine = $doctrine;
        $this->associations = $associations;
        $this->indexes = $indexes;
        $this->uniques = $uniques;
        $this->discriminatorColumns = $discriminatorColumns;
        $this->discriminators = $discriminators;
        $this->inheritanceTypes = $inheritanceTypes;
        $this->overrides = $overrides;
    }

    public function getSubscribedEvents(): array
    {
        return [
            'loadClassMetadata',
        ];
    }

    public function addAssociation(string $class, string $field, array $options): void
    {
        if (!isset($this->associations[$class])) {
            $this->associations[$class] = [];
        }

        $this->associations[$class][$field] = $options;
    }

    /**
     * Add a discriminator to a class.
     *
     * @param string $class              The Class
     * @param string $key                Key is the database value and values are the classes
     * @param string $discriminatorClass The mapped class
     */
    public function addDiscriminator(string $class, string $key, string $discriminatorClass): void
    {
        if (!isset($this->discriminators[$class])) {
            $this->discriminators[$class] = [];
        }

        if (!isset($this->discriminators[$class][$key])) {
            $this->discriminators[$class][$key] = $discriminatorClass;
        }
    }

    public function addDiscriminatorColumn(string $class, array $columnDef): void
    {
        if (!isset($this->discriminatorColumns[$class])) {
            $this->discriminatorColumns[$class] = $columnDef;
        }
    }

    public function addInheritanceType(string $class, string $type): void
    {
        if (!isset($this->inheritanceTypes[$class])) {
            $this->inheritanceTypes[$class] = $type;
        }
    }

    public function addIndex(string $class, string $name, array $columns): void
    {
        if (!isset($this->indexes[$class])) {
            $this->indexes[$class] = [];
        }

        if (isset($this->indexes[$class][$name])) {
            return;
        }

        $this->indexes[$class][$name] = $columns;
    }

    public function addUnique(string $class, string $name, array $columns): void
    {
        if (!isset($this->uniques[$class])) {
            $this->uniques[$class] = [];
        }

        if (isset($this->uniques[$class][$name])) {
            return;
        }

        $this->uniques[$class][$name] = $columns;
    }

    /**
     * Adds new ORM override.
     */
    final public function addOverride(string $class, string $type, array $options): void
    {
        if (!isset($this->overrides[$class])) {
            $this->overrides[$class] = [];
        }

        $this->overrides[$class][$type] = $options;
    }

    public function loadClassMetadata(LoadClassMetadataEventArgs $eventArgs): void
    {
        $metadata = $eventArgs->getClassMetadata();

        $this->loadAssociations($metadata);

        $this->loadIndexes($metadata);

        $this->loadUniques($metadata);


        $this->loadDiscriminatorColumns($metadata);

        $this->loadDiscriminators($metadata);

        $this->loadInheritanceTypes($metadata);

        $this->loadOverrides($metadata);

    }

    /**
     * @throws \RuntimeException
     */
    private function loadAssociations(ClassMetadataInfo $metadata): void
    {
        if (!\array_key_exists($metadata->name, $this->associations)) {
            return;
        }

        try {
            foreach ($this->associations[$metadata->name] as $type => $mappings) {
                foreach ($mappings as $mapping) {
                    // the association is already set, skip the native one
                    if ($metadata->hasAssociation($mapping['fieldName'])) {
                        continue;
                    }

                    $metadata->$type($mapping);
                }
            }
        } catch (\ReflectionException $e) {
            throw new \RuntimeException(sprintf(
                'Error with class %s : %s',
                $metadata->name,
                $e->getMessage()
            ), 404, $e);
        }
    }

    /**
     * @throws \RuntimeException
     */
    private function loadDiscriminatorColumns(ClassMetadataInfo $metadata): void
    {
        if (!\array_key_exists($metadata->name, $this->discriminatorColumns)) {
            return;
        }

        try {
            if (isset($this->discriminatorColumns[$metadata->name])) {
                $arrayDiscriminatorColumns = $this->discriminatorColumns[$metadata->name];
                if (isset($metadata->discriminatorColumn)) {
                    $arrayDiscriminatorColumns = array_merge(
                        $metadata->discriminatorColumn,
                        $this->discriminatorColumns[$metadata->name]
                    );
                }
                $metadata->setDiscriminatorColumn($arrayDiscriminatorColumns);
            }
        } catch (\ReflectionException $e) {
            throw new \RuntimeException(sprintf(
                'Error with class %s : %s',
                $metadata->name,
                $e->getMessage()
            ), 404, $e);
        }
    }

    /**
     * @throws \RuntimeException
     */
    private function loadInheritanceTypes(ClassMetadataInfo $metadata): void
    {
        if (!\array_key_exists($metadata->name, $this->inheritanceTypes)) {
            return;
        }

        try {
            if (isset($this->inheritanceTypes[$metadata->name])) {
                $metadata->setInheritanceType($this->inheritanceTypes[$metadata->name]);
            }
        } catch (\ReflectionException $e) {
            throw new \RuntimeException(sprintf(
                'Error with class %s : %s',
                $metadata->name,
                $e->getMessage()
            ), 404, $e);
        }
    }

    /**
     * @throws \RuntimeException
     */
    private function loadDiscriminators(ClassMetadataInfo $metadata): void
    {
        if (!\array_key_exists($metadata->name, $this->discriminators)) {
            return;
        }

        try {
            foreach ($this->discriminators[$metadata->name] as $key => $class) {
                if (\in_array($key, $metadata->discriminatorMap, true)) {
                    continue;
                }
                $metadata->setDiscriminatorMap([$key => $class]);
            }
        } catch (\ReflectionException $e) {
            throw new \RuntimeException(sprintf(
                'Error with class %s : %s',
                $metadata->name,
                $e->getMessage()
            ), 404, $e);
        }
    }

    private function loadIndexes(ClassMetadataInfo $metadata): void
    {
        if (!\array_key_exists($metadata->name, $this->indexes)) {
            return;
        }

        foreach ($this->indexes[$metadata->name] as $name => $columns) {
            $metadata->table['indexes'][$name] = ['columns' => $columns];
        }
    }

    private function loadUniques(ClassMetadataInfo $metadata): void
    {
        if (!\array_key_exists($metadata->name, $this->uniques)) {
            return;
        }

        foreach ($this->uniques[$metadata->name] as $name => $columns) {
            $metadata->table['uniqueConstraints'][$name] = ['columns' => $columns];
        }
    }

    /**
     * @throws \RuntimeException
     */
    private function loadOverrides(ClassMetadataInfo $metadata): void
    {
        if (!\array_key_exists($metadata->name, $this->overrides)) {
            return;
        }

        try {
            foreach ($this->overrides[$metadata->name] as $type => $overrides) {
                foreach ($overrides as $override) {
                    $metadata->$type($override['fieldName'], $override);
                }
            }
        } catch (\ReflectionException $e) {
            throw new \RuntimeException(sprintf(
                'Error with class %s : %s',
                $metadata->name,
                $e->getMessage()
            ), 404, $e);
        }
    }
}


1			<?php
2
3			declare(strict_types=1);
4
5			/*
6			* This file is part of the Sonata Project package.
7			*
8			* (c) Thomas Rabaix <[email protected]>
9			*
10			* For the full copyright and license information, please view the LICENSE
11			* file that was distributed with this source code.
12			*/
13
14			namespace Sonata\EasyExtendsBundle\Mapper;
15
16			use Doctrine\Common\EventSubscriber;
17			use Doctrine\Common\Persistence\Event\LoadClassMetadataEventArgs;
18			use Doctrine\Common\Persistence\ManagerRegistry;
19			use Doctrine\ORM\Mapping\ClassMetadataInfo;
20
21			class DoctrineORMMapper implements EventSubscriber
22			{
23			/**
24			* @var array
25			*/
26			protected $associations;
27
28			/**
29			* @var array
30			*/
31			protected $discriminators;
32
33			/**
34			* @var array
35			*/
36			protected $discriminatorColumns;
37
38			/**
39			* @var array
40			*/
41			protected $inheritanceTypes;
42
43			/**
44			* @var ManagerRegistry
45			*/
46			protected $doctrine;
47
48			/**
49			* @var array
50			*/
51			protected $indexes;
52
53			/**
54			* @var array
55			*/
56			protected $uniques;
57
58			/**
59			* @var array
60			*/
61			protected $overrides;
62
63			public function __construct(ManagerRegistry $doctrine, array $associations = [], array $indexes = [], array $discriminators = [], array $discriminatorColumns = [], array $inheritanceTypes = [], array $uniques = [], array $overrides = [])
64			{
65			$this->doctrine = $doctrine;
66			$this->associations = $associations;
67			$this->indexes = $indexes;
68			$this->uniques = $uniques;
69			$this->discriminatorColumns = $discriminatorColumns;
70			$this->discriminators = $discriminators;
71			$this->inheritanceTypes = $inheritanceTypes;
72			$this->overrides = $overrides;
73			}
74
75			public function getSubscribedEvents(): array
76			{
77			return [
78			'loadClassMetadata',
79			];
80			}
81
82			public function addAssociation(string $class, string $field, array $options): void
83			{
84			if (!isset($this->associations[$class])) {
85			$this->associations[$class] = [];
86			}
87
88			$this->associations[$class][$field] = $options;
89			}
90
91			/**
92			* Add a discriminator to a class.
93			*
94			* @param string $class The Class
95			* @param string $key Key is the database value and values are the classes
96			* @param string $discriminatorClass The mapped class
97			*/
98			public function addDiscriminator(string $class, string $key, string $discriminatorClass): void
99			{
100			if (!isset($this->discriminators[$class])) {
101			$this->discriminators[$class] = [];
102			}
103
104			if (!isset($this->discriminators[$class][$key])) {
105			$this->discriminators[$class][$key] = $discriminatorClass;
106			}
107			}
108
109			public function addDiscriminatorColumn(string $class, array $columnDef): void
110			{
111			if (!isset($this->discriminatorColumns[$class])) {
112			$this->discriminatorColumns[$class] = $columnDef;
113			}
114			}
115
116			public function addInheritanceType(string $class, string $type): void
117			{
118			if (!isset($this->inheritanceTypes[$class])) {
119			$this->inheritanceTypes[$class] = $type;
120			}
121			}
122
123			public function addIndex(string $class, string $name, array $columns): void
124			{
125			if (!isset($this->indexes[$class])) {
126			$this->indexes[$class] = [];
127			}
128
129			if (isset($this->indexes[$class][$name])) {
130			return;
131			}
132
133			$this->indexes[$class][$name] = $columns;
134			}
135
136			public function addUnique(string $class, string $name, array $columns): void
137			{
138			if (!isset($this->uniques[$class])) {
139			$this->uniques[$class] = [];
140			}
141
142			if (isset($this->uniques[$class][$name])) {
143			return;
144			}
145
146			$this->uniques[$class][$name] = $columns;
147			}
148
149			/**
150			* Adds new ORM override.
151			*/
152			final public function addOverride(string $class, string $type, array $options): void
153			{
154			if (!isset($this->overrides[$class])) {
155			$this->overrides[$class] = [];
156			}
157
158			$this->overrides[$class][$type] = $options;
159			}
160
161			public function loadClassMetadata(LoadClassMetadataEventArgs $eventArgs): void
162			{
163			$metadata = $eventArgs->getClassMetadata();
164
165			$this->loadAssociations($metadata);
			0 ignored issues – show Compatibility introduced 2015-12-02 22:18 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$metadata` of type `object<Doctrine\Common\P...\Mapping\ClassMetadata>` is not a sub-type of `object<Doctrine\ORM\Mapping\ClassMetadataInfo>`. It seems like you assume a concrete implementation of the interface `Doctrine\Common\Persistence\Mapping\ClassMetadata` to be always present. This check looks for parameters that are defined as one type in their type hint or doc comment but seem to be used as a narrower type, i.e an implementation of an interface or a subclass. Consider changing the type of the parameter or doing an instanceof check before assuming your parameter is of the expected type. Loading history...
166			$this->loadIndexes($metadata);
			0 ignored issues – show Compatibility introduced 2015-12-02 22:18 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$metadata` of type `object<Doctrine\Common\P...\Mapping\ClassMetadata>` is not a sub-type of `object<Doctrine\ORM\Mapping\ClassMetadataInfo>`. It seems like you assume a concrete implementation of the interface `Doctrine\Common\Persistence\Mapping\ClassMetadata` to be always present. This check looks for parameters that are defined as one type in their type hint or doc comment but seem to be used as a narrower type, i.e an implementation of an interface or a subclass. Consider changing the type of the parameter or doing an instanceof check before assuming your parameter is of the expected type. Loading history...
167			$this->loadUniques($metadata);
			0 ignored issues – show Compatibility introduced 2015-12-02 22:18 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$metadata` of type `object<Doctrine\Common\P...\Mapping\ClassMetadata>` is not a sub-type of `object<Doctrine\ORM\Mapping\ClassMetadataInfo>`. It seems like you assume a concrete implementation of the interface `Doctrine\Common\Persistence\Mapping\ClassMetadata` to be always present. This check looks for parameters that are defined as one type in their type hint or doc comment but seem to be used as a narrower type, i.e an implementation of an interface or a subclass. Consider changing the type of the parameter or doing an instanceof check before assuming your parameter is of the expected type. Loading history...
168
169			$this->loadDiscriminatorColumns($metadata);
			0 ignored issues – show Compatibility introduced 2015-12-02 22:18 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$metadata` of type `object<Doctrine\Common\P...\Mapping\ClassMetadata>` is not a sub-type of `object<Doctrine\ORM\Mapping\ClassMetadataInfo>`. It seems like you assume a concrete implementation of the interface `Doctrine\Common\Persistence\Mapping\ClassMetadata` to be always present. This check looks for parameters that are defined as one type in their type hint or doc comment but seem to be used as a narrower type, i.e an implementation of an interface or a subclass. Consider changing the type of the parameter or doing an instanceof check before assuming your parameter is of the expected type. Loading history...
170			$this->loadDiscriminators($metadata);
			0 ignored issues – show Compatibility introduced 2015-12-02 22:18 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$metadata` of type `object<Doctrine\Common\P...\Mapping\ClassMetadata>` is not a sub-type of `object<Doctrine\ORM\Mapping\ClassMetadataInfo>`. It seems like you assume a concrete implementation of the interface `Doctrine\Common\Persistence\Mapping\ClassMetadata` to be always present. This check looks for parameters that are defined as one type in their type hint or doc comment but seem to be used as a narrower type, i.e an implementation of an interface or a subclass. Consider changing the type of the parameter or doing an instanceof check before assuming your parameter is of the expected type. Loading history...
171			$this->loadInheritanceTypes($metadata);
			0 ignored issues – show Compatibility introduced 2015-12-02 22:18 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$metadata` of type `object<Doctrine\Common\P...\Mapping\ClassMetadata>` is not a sub-type of `object<Doctrine\ORM\Mapping\ClassMetadataInfo>`. It seems like you assume a concrete implementation of the interface `Doctrine\Common\Persistence\Mapping\ClassMetadata` to be always present. This check looks for parameters that are defined as one type in their type hint or doc comment but seem to be used as a narrower type, i.e an implementation of an interface or a subclass. Consider changing the type of the parameter or doing an instanceof check before assuming your parameter is of the expected type. Loading history...
172			$this->loadOverrides($metadata);
			0 ignored issues – show Compatibility introduced 2016-07-22 15:01 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$metadata` of type `object<Doctrine\Common\P...\Mapping\ClassMetadata>` is not a sub-type of `object<Doctrine\ORM\Mapping\ClassMetadataInfo>`. It seems like you assume a concrete implementation of the interface `Doctrine\Common\Persistence\Mapping\ClassMetadata` to be always present. This check looks for parameters that are defined as one type in their type hint or doc comment but seem to be used as a narrower type, i.e an implementation of an interface or a subclass. Consider changing the type of the parameter or doing an instanceof check before assuming your parameter is of the expected type. Loading history...
173			}
174
175			/**
176			* @throws \RuntimeException
177			*/
178			private function loadAssociations(ClassMetadataInfo $metadata): void
179			{
180			if (!\array_key_exists($metadata->name, $this->associations)) {
181			return;
182			}
183
184			try {
185			foreach ($this->associations[$metadata->name] as $type => $mappings) {
186			foreach ($mappings as $mapping) {
187			// the association is already set, skip the native one
188			if ($metadata->hasAssociation($mapping['fieldName'])) {
189			continue;
190			}
191
192			$metadata->$type($mapping);
193			}
194			}
195			} catch (\ReflectionException $e) {
196			throw new \RuntimeException(sprintf(
197			'Error with class %s : %s',
198			$metadata->name,
199			$e->getMessage()
200			), 404, $e);
201			}
202			}
203
204			/**
205			* @throws \RuntimeException
206			*/
207			private function loadDiscriminatorColumns(ClassMetadataInfo $metadata): void
208			{
209			if (!\array_key_exists($metadata->name, $this->discriminatorColumns)) {
210			return;
211			}
212
213			try {
214			if (isset($this->discriminatorColumns[$metadata->name])) {
215			$arrayDiscriminatorColumns = $this->discriminatorColumns[$metadata->name];
216			if (isset($metadata->discriminatorColumn)) {
217			$arrayDiscriminatorColumns = array_merge(
218			$metadata->discriminatorColumn,
219			$this->discriminatorColumns[$metadata->name]
220			);
221			}
222			$metadata->setDiscriminatorColumn($arrayDiscriminatorColumns);
223			}
224			} catch (\ReflectionException $e) {
225			throw new \RuntimeException(sprintf(
226			'Error with class %s : %s',
227			$metadata->name,
228			$e->getMessage()
229			), 404, $e);
230			}
231			}
232
233			/**
234			* @throws \RuntimeException
235			*/
236			private function loadInheritanceTypes(ClassMetadataInfo $metadata): void
237			{
238			if (!\array_key_exists($metadata->name, $this->inheritanceTypes)) {
239			return;
240			}
241
242			try {
243			if (isset($this->inheritanceTypes[$metadata->name])) {
244			$metadata->setInheritanceType($this->inheritanceTypes[$metadata->name]);
245			}
246			} catch (\ReflectionException $e) {
247			throw new \RuntimeException(sprintf(
248			'Error with class %s : %s',
249			$metadata->name,
250			$e->getMessage()
251			), 404, $e);
252			}
253			}
254
255			/**
256			* @throws \RuntimeException
257			*/
258			private function loadDiscriminators(ClassMetadataInfo $metadata): void
259			{
260			if (!\array_key_exists($metadata->name, $this->discriminators)) {
261			return;
262			}
263
264			try {
265			foreach ($this->discriminators[$metadata->name] as $key => $class) {
266			if (\in_array($key, $metadata->discriminatorMap, true)) {
267			continue;
268			}
269			$metadata->setDiscriminatorMap([$key => $class]);
270			}
271			} catch (\ReflectionException $e) {
272			throw new \RuntimeException(sprintf(
273			'Error with class %s : %s',
274			$metadata->name,
275			$e->getMessage()
276			), 404, $e);
277			}
278			}
279
280			private function loadIndexes(ClassMetadataInfo $metadata): void
281			{
282			if (!\array_key_exists($metadata->name, $this->indexes)) {
283			return;
284			}
285
286			foreach ($this->indexes[$metadata->name] as $name => $columns) {
287			$metadata->table['indexes'][$name] = ['columns' => $columns];
288			}
289			}
290
291			private function loadUniques(ClassMetadataInfo $metadata): void
292			{
293			if (!\array_key_exists($metadata->name, $this->uniques)) {
294			return;
295			}
296
297			foreach ($this->uniques[$metadata->name] as $name => $columns) {
298			$metadata->table['uniqueConstraints'][$name] = ['columns' => $columns];
299			}
300			}
301
302			/**
303			* @throws \RuntimeException
304			*/
305			private function loadOverrides(ClassMetadataInfo $metadata): void
306			{
307			if (!\array_key_exists($metadata->name, $this->overrides)) {
308			return;
309			}
310
311			try {
312			foreach ($this->overrides[$metadata->name] as $type => $overrides) {
313			foreach ($overrides as $override) {
314			$metadata->$type($override['fieldName'], $override);
315			}
316			}
317			} catch (\ReflectionException $e) {
318			throw new \RuntimeException(sprintf(
319			'Error with class %s : %s',
320			$metadata->name,
321			$e->getMessage()
322			), 404, $e);
323			}
324			}
325			}
326

sonata-project / SonataEasyExtendsBundle

Issues (32)

Security Analysis no request data

src/Mapper/DoctrineORMMapper.php (7 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like