Issues in views.php (master) - Issues in master - spiral-modules/phpfastcache - Measure and Improve Code Quality continuously with Scrutinizer

Issues (28)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

tests/-app-/config/views.php (6 issues)

Labels

Severity

Minor 6

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/**
 * ViewManager component configuration file. Attention, configs might include runtime code which
 * depended on environment values only.
 *
 * @see ViewsConfig
 */
use Spiral\Views\Engines;
use Spiral\Views\Processors;

return [
    'cache' => [
        /*
         * Indicates that view engines must enable caching for their templates, you can reset existed
         * view cache by executing command "view:compile"
         */
        'enabled'   => env('VIEW_CACHE', false),
        /*
         * Location where view cache has to be stored into. By default you can use
         * app/runtime/cache/views directory.
         */
        'directory' => directory("cache") . 'views/'
    ],

    'namespaces'  => [
        /*
         * This is default application namespace which can be used without any prefix.
         */
        'default'  => [
            directory("application") . 'views/',
            /*{{namespaces.default}}*/

        ],
        /*
         * This namespace contain few framework views like http error pages and exception view
         * used in snapshots. In addition, same namespace used by Toolkit module to share it's
         * views and widgets.
         */
        'spiral'   => [
            directory("libraries") . 'spiral/framework/source/views/',
            /*{{namespaces.spiral}}*/

        ],
        'profiler' => [
            directory("root") . '../../source/views/',
        ],
        /*{{namespaces}}*/
    ],

    /*
     * Environment variable define what cache version to be used for different engines, it primary
     * goal is to provide ability to evaluate some functionality at compilation (not runtime) phase.
     */
    'environment' => [
        'language' => ['translator', 'getLocale'],
        'basePath' => ['http', 'basePath'],
        /*{{environment}}*/
    ],

    /*
     * You can connect as many engines as you want, simply declare engine name, class and extension
     * to be handled. Every engine class resolve using container, you are able to define your own
     * dependencies in your implementation.
     */
    'engines'     => [
        /*
         * You can always extend TwigEngine class and define your own configuration rules in it.
         */
        'twig'   => [
            'class'      => Engines\TwigEngine::class,
            'extension'  => 'twig',
            'options'    => [
                'auto_reload' => true
            ],

            /*
            * Modifiers applied to imported or extended view source before it's getting parsed by
            * HtmlTemplater, every modifier has to implement ModifierInterface and as result view
            * name, namespace and filename are available for it. Modifiers is the best to connect
            * custom syntax processors (for example Laravel's Blade).
            */
            'modifiers'  => [
                //Automatically replaces [[string]] with their translations
                Processors\TranslateProcessor::class,

                //Mounts view environment variables using @{name} pattern.
                Processors\EnvironmentProcessor::class,

                /*{{twig.modifiers}}*/

            ],

            /*
            * Here you define list of extensions to be mounted into twig engine, every extension
            * class will be resolved using container so you can use constructor dependencies.
            */
            'extensions' => [
                //Provides access to dump() and spiral() functions inside twig templates
                Engines\Twig\Extensions\SpiralExtension::class
                /*{{twig.extension}}*/

            ]
        ],
        /*
         * Stempler does not provide any custom command syntax (however you can connect one using
         * modifiers section), instead it compose templates together using html tags based on
         * defined syntax (in our case "Dark").
         */
        'dark'   => [
            'class'      => Engines\StemplerEngine::class,

            /*
             * Do not change this extension, it used across spiral toolkit, profiler and
             * administration modules.
             */
            'extension'  => 'dark.php',

            /*
             * Modifiers applied to imported or extended view source before it's getting parsed by
             * HtmlTemplater, every modifier has to implement ModifierInterface and as result view
             * name, namespace and filename are available for it. Modifiers one of the options to
             * connect custom syntax processors (for example Laravel's Blade or Nette Latte).
             */
            'modifiers'  => [
                //Automatically replaces [[string]] with their translations
                Processors\TranslateProcessor::class,

                //Mounts view environment variables using @{name} pattern.
                Processors\EnvironmentProcessor::class,

                //This modifier automatically replace some php constructors with evaluated php code,
                //such modifier used in spiral toolkit to simplify widget includes (see documentation
                //and examples).
                Processors\ExpressionsProcessors::class,

                /*{{dark.modifiers}}*/

            ],

            /*
             * Processors applied to compiled view source after templating work is done and view is
             * fully composited.
             */
            'processors' => [
                //Evaluates php block with #compile comment at moment of template compilation
                Processors\EvaluateProcessor::class,

                //Drops empty lines and normalize attributes
                Processors\PrettifyProcessor::class,

                /*{{dark.processors}}*/

            ]
        ],
        /*
         * Native engine simply executes php file without any additional features. You can access
         * NativeView object using variable $this from your view code, to get instance of view
         * container use $this->container.
         */
        'native' => [
            'class'     => Engines\NativeEngine::class,
            'extension' => 'php'
        ],
        /*{{engines}}*/
    ]
];

1			<?php
2			/**
3			* ViewManager component configuration file. Attention, configs might include runtime code which
4			* depended on environment values only.
5			*
6			* @see ViewsConfig
7			*/
8			use Spiral\Views\Engines;
9			use Spiral\Views\Processors;
10
11			return [
12			'cache' => [
13			/*
14			* Indicates that view engines must enable caching for their templates, you can reset existed
15			* view cache by executing command "view:compile"
16			*/
17			'enabled' => env('VIEW_CACHE', false),
18			/*
19			* Location where view cache has to be stored into. By default you can use
20			* app/runtime/cache/views directory.
21			*/
22			'directory' => directory("cache") . 'views/'
23			],
24
25			'namespaces' => [
26			/*
27			* This is default application namespace which can be used without any prefix.
28			*/
29			'default' => [
30			directory("application") . 'views/',
31			/{{namespaces.default}}/
			0 ignored issues – show Unused Code Comprehensibility introduced 2017-04-06 15:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this `72%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
32			],
33			/*
34			* This namespace contain few framework views like http error pages and exception view
35			* used in snapshots. In addition, same namespace used by Toolkit module to share it's
36			* views and widgets.
37			*/
38			'spiral' => [
39			directory("libraries") . 'spiral/framework/source/views/',
40			/{{namespaces.spiral}}/
			0 ignored issues – show Unused Code Comprehensibility introduced 2017-04-06 15:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this `58%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
41			],
42			'profiler' => [
43			directory("root") . '../../source/views/',
44			],
45			/{{namespaces}}/
46			],
47
48			/*
49			* Environment variable define what cache version to be used for different engines, it primary
50			* goal is to provide ability to evaluate some functionality at compilation (not runtime) phase.
51			*/
52			'environment' => [
53			'language' => ['translator', 'getLocale'],
54			'basePath' => ['http', 'basePath'],
55			/{{environment}}/
56			],
57
58			/*
59			* You can connect as many engines as you want, simply declare engine name, class and extension
60			* to be handled. Every engine class resolve using container, you are able to define your own
61			* dependencies in your implementation.
62			*/
63			'engines' => [
64			/*
65			* You can always extend TwigEngine class and define your own configuration rules in it.
66			*/
67			'twig' => [
68			'class' => Engines\TwigEngine::class,
69			'extension' => 'twig',
70			'options' => [
71			'auto_reload' => true
72			],
73
74			/*
75			* Modifiers applied to imported or extended view source before it's getting parsed by
76			* HtmlTemplater, every modifier has to implement ModifierInterface and as result view
77			* name, namespace and filename are available for it. Modifiers is the best to connect
78			* custom syntax processors (for example Laravel's Blade).
79			*/
80			'modifiers' => [
81			//Automatically replaces [[string]] with their translations
82			Processors\TranslateProcessor::class,
83
84			//Mounts view environment variables using @{name} pattern.
85			Processors\EnvironmentProcessor::class,
86
87			/{{twig.modifiers}}/
			0 ignored issues – show Unused Code Comprehensibility introduced 2017-04-06 15:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this `58%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
88			],
89
90			/*
91			* Here you define list of extensions to be mounted into twig engine, every extension
92			* class will be resolved using container so you can use constructor dependencies.
93			*/
94			'extensions' => [
95			//Provides access to dump() and spiral() functions inside twig templates
96			Engines\Twig\Extensions\SpiralExtension::class
97			/{{twig.extension}}/
			0 ignored issues – show Unused Code Comprehensibility introduced 2017-04-06 15:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this `58%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
98			]
99			],
100			/*
101			* Stempler does not provide any custom command syntax (however you can connect one using
102			* modifiers section), instead it compose templates together using html tags based on
103			* defined syntax (in our case "Dark").
104			*/
105			'dark' => [
106			'class' => Engines\StemplerEngine::class,
107
108			/*
109			* Do not change this extension, it used across spiral toolkit, profiler and
110			* administration modules.
111			*/
112			'extension' => 'dark.php',
113
114			/*
115			* Modifiers applied to imported or extended view source before it's getting parsed by
116			* HtmlTemplater, every modifier has to implement ModifierInterface and as result view
117			* name, namespace and filename are available for it. Modifiers one of the options to
118			* connect custom syntax processors (for example Laravel's Blade or Nette Latte).
119			*/
120			'modifiers' => [
121			//Automatically replaces [[string]] with their translations
122			Processors\TranslateProcessor::class,
123
124			//Mounts view environment variables using @{name} pattern.
125			Processors\EnvironmentProcessor::class,
126
127			//This modifier automatically replace some php constructors with evaluated php code,
128			//such modifier used in spiral toolkit to simplify widget includes (see documentation
129			//and examples).
130			Processors\ExpressionsProcessors::class,
131
132			/{{dark.modifiers}}/
			0 ignored issues – show Unused Code Comprehensibility introduced 2017-04-06 15:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this `58%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
133			],
134
135			/*
136			* Processors applied to compiled view source after templating work is done and view is
137			* fully composited.
138			*/
139			'processors' => [
140			//Evaluates php block with #compile comment at moment of template compilation
141			Processors\EvaluateProcessor::class,
142
143			//Drops empty lines and normalize attributes
144			Processors\PrettifyProcessor::class,
145
146			/{{dark.processors}}/
			0 ignored issues – show Unused Code Comprehensibility introduced 2017-04-06 15:41 UTC by Report Bug Copy Issue Report Show Similar Issues like this `58%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
147			]
148			],
149			/*
150			* Native engine simply executes php file without any additional features. You can access
151			* NativeView object using variable $this from your view code, to get instance of view
152			* container use $this->container.
153			*/
154			'native' => [
155			'class' => Engines\NativeEngine::class,
156			'extension' => 'php'
157			],
158			/{{engines}}/
159			]
160			];

spiral-modules / phpfastcache

Issues (28)

Security Analysis no request data

tests/-app-/config/views.php (6 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like