This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace Stecman\Component\Symfony\Console\BashCompletion; |
||
| 4 | |||
| 5 | use Symfony\Component\Console\Command\Command as SymfonyCommand; |
||
| 6 | use Symfony\Component\Console\Input\InputDefinition; |
||
| 7 | use Symfony\Component\Console\Input\InputInterface; |
||
| 8 | use Symfony\Component\Console\Input\InputOption; |
||
| 9 | use Symfony\Component\Console\Output\OutputInterface; |
||
| 10 | |||
| 11 | class CompletionCommand extends SymfonyCommand |
||
| 12 | { |
||
| 13 | /** |
||
| 14 | * @var CompletionHandler |
||
| 15 | */ |
||
| 16 | protected $handler; |
||
| 17 | |||
| 18 | protected function configure() |
||
| 19 | { |
||
| 20 | $this |
||
| 21 | ->setName('_completion') |
||
| 22 | ->setDefinition($this->createDefinition()) |
||
| 23 | ->setDescription('BASH completion hook.') |
||
| 24 | ->setHelp(<<<END |
||
| 25 | To enable BASH completion, run: |
||
| 26 | |||
| 27 | <comment>eval `[program] _completion -g`</comment>. |
||
| 28 | |||
| 29 | Or for an alias: |
||
| 30 | |||
| 31 | <comment>eval `[program] _completion -g -p [alias]`</comment>. |
||
| 32 | |||
| 33 | END |
||
| 34 | ); |
||
| 35 | |||
| 36 | // Hide this command from listing if supported |
||
| 37 | // Command::setHidden() was not available before Symfony 3.2.0 |
||
| 38 | if (method_exists($this, 'setHidden')) { |
||
| 39 | $this->setHidden(true); |
||
| 40 | } |
||
| 41 | } |
||
| 42 | |||
| 43 | /** |
||
| 44 | * {@inheritdoc} |
||
| 45 | */ |
||
| 46 | public function getNativeDefinition() |
||
| 47 | { |
||
| 48 | return $this->createDefinition(); |
||
| 49 | } |
||
| 50 | |||
| 51 | /** |
||
| 52 | * Ignore user-defined global options |
||
| 53 | * |
||
| 54 | * Any global options defined by user-code are meaningless to this command. |
||
| 55 | * Options outside of the core defaults are ignored to avoid name and shortcut conflicts. |
||
| 56 | */ |
||
| 57 | public function mergeApplicationDefinition($mergeArgs = true) |
||
| 58 | { |
||
| 59 | // Get current application options |
||
| 60 | $appDefinition = $this->getApplication()->getDefinition(); |
||
| 61 | $originalOptions = $appDefinition->getOptions(); |
||
| 62 | |||
| 63 | // Temporarily replace application options with a filtered list |
||
| 64 | $appDefinition->setOptions( |
||
| 65 | $this->filterApplicationOptions($originalOptions) |
||
| 66 | ); |
||
| 67 | |||
| 68 | parent::mergeApplicationDefinition($mergeArgs); |
||
| 69 | |||
| 70 | // Restore original application options |
||
| 71 | $appDefinition->setOptions($originalOptions); |
||
| 72 | } |
||
| 73 | |||
| 74 | /** |
||
| 75 | * Reduce the passed list of options to the core defaults (if they exist) |
||
| 76 | * |
||
| 77 | * @param InputOption[] $appOptions |
||
| 78 | * @return InputOption[] |
||
| 79 | */ |
||
| 80 | protected function filterApplicationOptions(array $appOptions) |
||
| 81 | { |
||
| 82 | return array_filter($appOptions, function(InputOption $option) { |
||
| 83 | static $coreOptions = array( |
||
| 84 | 'help' => true, |
||
| 85 | 'quiet' => true, |
||
| 86 | 'verbose' => true, |
||
| 87 | 'version' => true, |
||
| 88 | 'ansi' => true, |
||
| 89 | 'no-ansi' => true, |
||
| 90 | 'no-interaction' => true, |
||
| 91 | ); |
||
| 92 | |||
| 93 | return isset($coreOptions[$option->getName()]); |
||
| 94 | }); |
||
| 95 | } |
||
| 96 | |||
| 97 | protected function execute(InputInterface $input, OutputInterface $output) |
||
| 98 | { |
||
| 99 | $this->handler = new CompletionHandler($this->getApplication()); |
||
| 100 | $handler = $this->handler; |
||
| 101 | |||
| 102 | if ($input->getOption('generate-hook')) { |
||
| 103 | global $argv; |
||
| 104 | $program = $argv[0]; |
||
| 105 | |||
| 106 | $factory = new HookFactory(); |
||
| 107 | $alias = $input->getOption('program'); |
||
| 108 | $multiple = (bool)$input->getOption('multiple'); |
||
| 109 | |||
| 110 | if (!$alias) { |
||
| 111 | $alias = basename($program); |
||
| 112 | } |
||
| 113 | |||
| 114 | $hook = $factory->generateHook( |
||
| 115 | $input->getOption('shell-type') ?: $this->getShellType(), |
||
| 116 | $program, |
||
| 117 | $alias, |
||
| 118 | $multiple |
||
| 119 | ); |
||
| 120 | |||
| 121 | $output->write($hook, true); |
||
| 122 | } else { |
||
| 123 | $handler->setContext(new EnvironmentCompletionContext()); |
||
| 124 | |||
| 125 | // Get completion results |
||
| 126 | $results = $this->runCompletion(); |
||
| 127 | |||
| 128 | // Escape results for the current shell |
||
| 129 | $shellType = $input->getOption('shell-type') ?: $this->getShellType(); |
||
| 130 | |||
| 131 | foreach ($results as &$result) { |
||
| 132 | $result = $this->escapeForShell($result, $shellType); |
||
| 133 | } |
||
| 134 | |||
| 135 | $output->write($results, true); |
||
| 136 | } |
||
| 137 | |||
| 138 | return 0; |
||
| 139 | } |
||
| 140 | |||
| 141 | /** |
||
| 142 | * Escape each completion result for the specified shell |
||
| 143 | * |
||
| 144 | * @param string $result - Completion results that should appear in the shell |
||
| 145 | * @param string $shellType - Valid shell type from HookFactory |
||
| 146 | * @return string |
||
| 147 | */ |
||
| 148 | protected function escapeForShell($result, $shellType) |
||
| 149 | { |
||
| 150 | switch ($shellType) { |
||
| 151 | // BASH requires special escaping for multi-word and special character results |
||
| 152 | // This emulates registering completion with`-o filenames`, without side-effects like dir name slashes |
||
| 153 | case 'bash': |
||
| 154 | $context = $this->handler->getContext(); |
||
| 155 | $wordStart = substr($context->getRawCurrentWord(), 0, 1); |
||
| 156 | |||
| 157 | if ($wordStart == "'") { |
||
| 158 | // If the current word is single-quoted, escape any single quotes in the result |
||
| 159 | $result = str_replace("'", "\\'", $result); |
||
| 160 | } else if ($wordStart == '"') { |
||
| 161 | // If the current word is double-quoted, escape any double quotes in the result |
||
| 162 | $result = str_replace('"', '\\"', $result); |
||
| 163 | } else { |
||
| 164 | // Otherwise assume the string is unquoted and word breaks should be escaped |
||
| 165 | $result = preg_replace('/([\s\'"\\\\])/', '\\\\$1', $result); |
||
| 166 | } |
||
| 167 | |||
| 168 | // Escape output to prevent special characters being lost when passing results to compgen |
||
| 169 | return escapeshellarg($result); |
||
| 170 | |||
| 171 | // No transformation by default |
||
| 172 | default: |
||
| 173 | return $result; |
||
| 174 | } |
||
| 175 | } |
||
| 176 | |||
| 177 | /** |
||
| 178 | * Run the completion handler and return a filtered list of results |
||
| 179 | * |
||
| 180 | * @deprecated - This will be removed in 1.0.0 in favour of CompletionCommand::configureCompletion |
||
| 181 | * |
||
| 182 | * @return string[] |
||
| 183 | */ |
||
| 184 | protected function runCompletion() |
||
| 185 | { |
||
| 186 | $this->configureCompletion($this->handler); |
||
| 187 | return $this->handler->runCompletion(); |
||
| 188 | } |
||
| 189 | |||
| 190 | /** |
||
| 191 | * Configure the CompletionHandler instance before it is run |
||
| 192 | * |
||
| 193 | * @param CompletionHandler $handler |
||
| 194 | */ |
||
| 195 | protected function configureCompletion(CompletionHandler $handler) |
||
|
0 ignored issues
–
show
|
|||
| 196 | { |
||
| 197 | // Override this method to configure custom value completions |
||
| 198 | } |
||
| 199 | |||
| 200 | /** |
||
| 201 | * Determine the shell type for use with HookFactory |
||
| 202 | * |
||
| 203 | * @return string |
||
| 204 | */ |
||
| 205 | protected function getShellType() |
||
| 206 | { |
||
| 207 | if (!getenv('SHELL')) { |
||
| 208 | throw new \RuntimeException('Could not read SHELL environment variable. Please specify your shell type using the --shell-type option.'); |
||
| 209 | } |
||
| 210 | |||
| 211 | return basename(getenv('SHELL')); |
||
| 212 | } |
||
| 213 | |||
| 214 | protected function createDefinition() |
||
| 215 | { |
||
| 216 | return new InputDefinition(array( |
||
| 217 | new InputOption( |
||
| 218 | 'generate-hook', |
||
| 219 | 'g', |
||
| 220 | InputOption::VALUE_NONE, |
||
| 221 | 'Generate BASH code that sets up completion for this application.' |
||
| 222 | ), |
||
| 223 | new InputOption( |
||
| 224 | 'program', |
||
| 225 | 'p', |
||
| 226 | InputOption::VALUE_REQUIRED, |
||
| 227 | "Program name that should trigger completion\n<comment>(defaults to the absolute application path)</comment>." |
||
| 228 | ), |
||
| 229 | new InputOption( |
||
| 230 | 'multiple', |
||
| 231 | 'm', |
||
| 232 | InputOption::VALUE_NONE, |
||
| 233 | "Generated hook can be used for multiple applications." |
||
| 234 | ), |
||
| 235 | new InputOption( |
||
| 236 | 'shell-type', |
||
| 237 | null, |
||
| 238 | InputOption::VALUE_OPTIONAL, |
||
| 239 | 'Set the shell type (zsh or bash). Otherwise this is determined automatically.' |
||
| 240 | ), |
||
| 241 | )); |
||
| 242 | } |
||
| 243 | } |
||
| 244 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.