This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace SP\Crawler\Element; |
||
4 | |||
5 | use GuzzleHttp\Psr7\Request; |
||
6 | use GuzzleHttp\Psr7\Uri; |
||
7 | use GuzzleHttp\Psr7\MultipartStream; |
||
8 | use GuzzleHttp\Psr7\ServerRequest; |
||
9 | |||
10 | /** |
||
11 | * @author Ivan Kerin <[email protected]> |
||
12 | * @copyright 2015, Clippings Ltd. |
||
13 | * @license http://spdx.org/licenses/BSD-3-Clause |
||
14 | */ |
||
15 | class Form extends AbstractElement |
||
16 | { |
||
17 | /** |
||
18 | * @var string |
||
19 | */ |
||
20 | private static $fieldsXPath = <<<FIELDS |
||
21 | //*[not(@disabled) and ( |
||
22 | (self::input and @type = 'radio' and @checked) |
||
23 | or (self::input and @type = 'checkbox' and @checked) |
||
24 | or (self::input and @type != 'radio' and @type != 'file' and @type != 'checkbox' and @type != 'submit') |
||
25 | or (self::input and not(@type)) |
||
26 | or self::select |
||
27 | or self::textarea |
||
28 | )] |
||
29 | FIELDS; |
||
30 | |||
31 | private static $filesXPath = "//input[not(@disabled) and @type = 'file' and @value]"; |
||
32 | private static $allFilesXPath = "//input[not(@disabled) and @type = 'file']"; |
||
33 | |||
34 | 3 | public static function toNestedParams(array $params) |
|
35 | { |
||
36 | 3 | $flatParams = []; |
|
37 | 3 | foreach ($params as $key => $value) { |
|
38 | 3 | $flatParams []= $key.'='.$value; |
|
39 | 3 | } |
|
40 | |||
41 | 3 | $params = join('&', $flatParams); |
|
42 | 3 | parse_str($params, $nested); |
|
43 | |||
44 | 3 | return $nested; |
|
45 | } |
||
46 | |||
47 | /** |
||
48 | * @return string |
||
49 | */ |
||
50 | 1 | public static function getFieldsXPath() |
|
51 | { |
||
52 | 1 | return self::$fieldsXPath; |
|
53 | } |
||
54 | |||
55 | /** |
||
56 | * @return string |
||
57 | */ |
||
58 | 1 | public static function getFilesXPath() |
|
59 | { |
||
60 | 1 | return self::$filesXPath; |
|
61 | } |
||
62 | |||
63 | private $multipartBoundary = null; |
||
64 | |||
65 | /** |
||
66 | * @param string $multipartBoundary |
||
67 | */ |
||
68 | 1 | public function setMultipartBoundary($multipartBoundary) |
|
69 | { |
||
70 | 1 | $this->multipartBoundary = $multipartBoundary; |
|
71 | 1 | } |
|
72 | |||
73 | /** |
||
74 | * @return string |
||
75 | */ |
||
76 | 1 | public function getMultipartBoundary() |
|
77 | { |
||
78 | 1 | if (null === $this->multipartBoundary) { |
|
79 | 1 | $this->multipartBoundary = '----SpiderlingCrawler'.uniqid(); |
|
80 | 1 | } |
|
81 | |||
82 | 1 | return $this->multipartBoundary; |
|
83 | } |
||
84 | |||
85 | /** |
||
86 | * @param string $xpath |
||
87 | * @return AbstractInput[] |
||
88 | */ |
||
89 | 1 | public function getInputs($xpath) |
|
90 | { |
||
91 | 1 | return array_map( |
|
92 | 1 | [$this->getReader(), 'getInput'], |
|
93 | 1 | iterator_to_array($this->getReader()->query($xpath), false) |
|
94 | 1 | ); |
|
95 | } |
||
96 | |||
97 | /** |
||
98 | * @return string |
||
99 | */ |
||
100 | 1 | public function getMethod() |
|
101 | { |
||
102 | 1 | return $this->getAttribute('method') ?: 'GET'; |
|
103 | } |
||
104 | |||
105 | /** |
||
106 | * @return boolean |
||
107 | */ |
||
108 | 1 | public function isGet() |
|
109 | { |
||
110 | 1 | return strtoupper($this->getMethod()) === 'GET'; |
|
111 | } |
||
112 | |||
113 | /** |
||
114 | * @return string |
||
115 | */ |
||
116 | 1 | public function getAction() |
|
117 | { |
||
118 | 1 | return $this->getAttribute('action'); |
|
119 | } |
||
120 | |||
121 | /** |
||
122 | * @return boolean |
||
123 | */ |
||
124 | 1 | public function isMultipart() |
|
125 | { |
||
126 | 1 | return $this->getAttribute('enctype') === 'multipart/form-data'; |
|
127 | } |
||
128 | |||
129 | /** |
||
130 | * @param array $additional |
||
131 | * @return array |
||
132 | */ |
||
133 | 1 | public function getData(array $additional = []) |
|
134 | { |
||
135 | 1 | $data = []; |
|
136 | |||
137 | 1 | foreach ($this->getInputs(self::$fieldsXPath) as $input) { |
|
138 | 1 | $data[$input->getName()] = $input->getValue(); |
|
139 | 1 | } |
|
140 | |||
141 | 1 | return array_merge($data, $additional); |
|
142 | } |
||
143 | |||
144 | /** |
||
145 | * @param array $additional |
||
146 | * @return array |
||
147 | */ |
||
148 | 1 | public function getMultipartData(array $additional = []) |
|
149 | { |
||
150 | 1 | $data = []; |
|
151 | |||
152 | 1 | foreach ($this->getData($additional) as $name => $value) { |
|
153 | 1 | $data []= [ |
|
154 | 1 | 'name' => $name, |
|
155 | 'contents' => $value |
||
156 | 1 | ]; |
|
157 | 1 | } |
|
158 | |||
159 | 1 | foreach ($this->getInputs(self::$filesXPath) as $input) { |
|
160 | 1 | $data []= [ |
|
161 | 1 | 'name' => $input->getName(), |
|
162 | 1 | 'contents' => fopen($input->getValue(), 'r'), |
|
163 | 1 | 'filename' => $input->getValue(), |
|
164 | ]; |
||
165 | 1 | } |
|
166 | |||
167 | 1 | return $data; |
|
168 | } |
||
169 | |||
170 | /** |
||
171 | * @return array |
||
172 | */ |
||
173 | 3 | public function getHeaders() |
|
174 | { |
||
175 | 3 | if ($this->isGet()) { |
|
176 | 1 | return []; |
|
177 | 2 | } elseif ($this->isMultipart()) { |
|
178 | 1 | return ['Content-Type' => 'multipart/form-data; boundary='.$this->getMultipartBoundary()]; |
|
179 | } else { |
||
180 | 1 | return ['Content-Type' => 'application/x-www-form-urlencoded']; |
|
181 | } |
||
182 | } |
||
183 | |||
184 | /** |
||
185 | * @return array |
||
186 | */ |
||
187 | 1 | public function getFiles() |
|
188 | { |
||
189 | 1 | $files = []; |
|
190 | |||
191 | 1 | foreach ($this->getInputs(self::$allFilesXPath) as $input) { |
|
192 | 1 | foreach ($input->getPhpFileArray() as $key => $value) { |
|
193 | 1 | $files[$input->getName()."[$key]"] = $value; |
|
194 | 1 | } |
|
195 | 1 | } |
|
196 | |||
197 | 1 | return self::toNestedParams($files); |
|
198 | } |
||
199 | |||
200 | /** |
||
201 | * @param array $data |
||
202 | * @return ServerRequest |
||
203 | */ |
||
204 | 3 | public function getRequest(array $data = []) |
|
205 | { |
||
206 | 3 | $method = $this->getMethod(); |
|
207 | 3 | $uri = new Uri($this->getAction()); |
|
208 | 3 | $body = null; |
|
209 | |||
210 | 3 | if ($this->isGet()) { |
|
211 | 1 | foreach ($this->getData($data) as $key => $value) { |
|
212 | 1 | $uri = Uri::withQueryValue($uri, $key, $value); |
|
213 | 1 | } |
|
214 | 3 | } elseif ($this->isMultipart()) { |
|
215 | 1 | $body = new MultipartStream($this->getMultipartData($data), $this->getMultipartBoundary()); |
|
216 | 1 | } else { |
|
217 | 1 | $body = http_build_query($this->getData($data), null, '&'); |
|
218 | } |
||
219 | |||
220 | 3 | $request = new ServerRequest($method, $uri, $this->getHeaders(), $body); |
|
221 | |||
222 | 3 | $files = $this->getFiles(); |
|
223 | |||
224 | return $request |
||
225 | 3 | ->withParsedBody(self::toNestedParams($this->getData($data))) |
|
226 | 3 | ->withAttribute('FILES', $files) |
|
227 | 3 | ->withUploadedFiles(ServerRequest::normalizeFiles($files)); |
|
0 ignored issues
–
show
|
|||
228 | } |
||
229 | } |
||
230 |
If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check:
If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue.