ArticlePreviousRelativeUrlListener::onKernelException() - Code Metrics - Inspection of "Merge Master to 2.1 branch" - superdesk/web-publisher - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Pull Request — 2.1 (#1090)

by Paweł

created 2020-04-27 09:26 UTC

onKernelException() A

↳ Parent: ArticlePreviousRelativeUrlListener

Complexity

Conditions	3
Paths	3

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
dl	0
loc	25
rs	9.52
c	0
b	0
f	0
cc	3
nc	3
nop	1

<?php

declare(strict_types=1);

/*
 * This file is part of the Superdesk Web Publisher Content Bundle.
 *
 * Copyright 2020 Sourcefabric z.ú. and contributors.
 *
 * For the full copyright and license information, please see the
 * AUTHORS and LICENSE files distributed with this source code.
 *
 * @copyright 2020 Sourcefabric z.ú
 * @license http://www.superdesk.org/license
 */

namespace SWP\Bundle\ContentBundle\EventListener;

use SWP\Component\Storage\Repository\RepositoryInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Event\ExceptionEvent;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
use Symfony\Component\Routing\RouterInterface;

final class ArticlePreviousRelativeUrlListener
{
    private $router;

    private $articlePreviousUrlRepository;

    public function __construct(RouterInterface $router, RepositoryInterface $articlePreviousUrlRepository)
    {
        $this->router = $router;
        $this->articlePreviousUrlRepository = $articlePreviousUrlRepository;
    }

    public function onKernelException(ExceptionEvent $event): void
    {
        $exception = $event->getException();

        $request = $event->getRequest();

        if (!$exception instanceof NotFoundHttpException) {
            return;
        }

        $articleRelativeUrl = $this->articlePreviousUrlRepository->findOneBy(['relativeUrl' => $request->getRequestUri()]);

        if (null !== $articleRelativeUrl) {
            $article = $articleRelativeUrl->getArticle();

            $event->setResponse(new RedirectResponse(
                $this->router->generate(
// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);
                    $article->getRoute()->getName(),
                    [
                        'slug' => $article->getSlug(),
                    ]
                ),
                Response::HTTP_MOVED_PERMANENTLY
            ));
        }
    }
}


1			<?php
2
3			declare(strict_types=1);
4
5			/*
6			* This file is part of the Superdesk Web Publisher Content Bundle.
7			*
8			* Copyright 2020 Sourcefabric z.ú. and contributors.
9			*
10			* For the full copyright and license information, please see the
11			* AUTHORS and LICENSE files distributed with this source code.
12			*
13			* @copyright 2020 Sourcefabric z.ú
14			* @license http://www.superdesk.org/license
15			*/
16
17			namespace SWP\Bundle\ContentBundle\EventListener;
18
19			use SWP\Component\Storage\Repository\RepositoryInterface;
20			use Symfony\Component\HttpFoundation\RedirectResponse;
21			use Symfony\Component\HttpFoundation\Response;
22			use Symfony\Component\HttpKernel\Event\ExceptionEvent;
23			use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
24			use Symfony\Component\Routing\RouterInterface;
25
26			final class ArticlePreviousRelativeUrlListener
27			{
28			private $router;
29
30			private $articlePreviousUrlRepository;
31
32			public function __construct(RouterInterface $router, RepositoryInterface $articlePreviousUrlRepository)
33			{
34			$this->router = $router;
35			$this->articlePreviousUrlRepository = $articlePreviousUrlRepository;
36			}
37
38			public function onKernelException(ExceptionEvent $event): void
39			{
40			$exception = $event->getException();
			0 ignored issues – show Deprecated Code introduced 2020-04-20 13:38 UTC by Report Bug Copy Issue Report The method `Symfony\Component\HttpKe...onEvent::getException()` has been deprecated with message: since Symfony 4.4, use getThrowable instead This method has been deprecated. The supplier of the class has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead. Loading history...
41			$request = $event->getRequest();
42
43			if (!$exception instanceof NotFoundHttpException) {
44			return;
45			}
46
47			$articleRelativeUrl = $this->articlePreviousUrlRepository->findOneBy(['relativeUrl' => $request->getRequestUri()]);
48
49			if (null !== $articleRelativeUrl) {
50			$article = $articleRelativeUrl->getArticle();
51
52			$event->setResponse(new RedirectResponse(
53			$this->router->generate(
			0 ignored issues – show Security Cross-Site Scripting introduced 2020-04-21 11:41 UTC by Report Bug Copy Issue Report `$this->router->generate(...> $article->getSlug()))` can contain request data and is used in output context(s) leading to a potential security vulnerability. 4 paths for user data to reach this point 1. Path: `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in ServerBag.php on line 59 `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in vendor/ServerBag.php on line 59 ParameterBag::$parameters is assigned in vendor/ServerBag.php on line 74 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 77 ParameterBag::get() returns tainted data, and `$baseUrl` is assigned in vendor/Request.php on line 1797 `$baseUrl` is passed through rtrim() in vendor/Request.php on line 1853 Request::prepareBaseUrl() returns tainted data, and Request::$baseUrl is assigned in vendor/Request.php on line 889 Tainted property Request::$baseUrl is read in vendor/Request.php on line 892 Request::getBaseUrl() returns tainted data, and `$request->getBaseUrl()` is passed to RequestContext::setBaseUrl() in vendor/RequestContext.php on line 55 RequestContext::$baseUrl is assigned in vendor/RequestContext.php on line 86 Tainted property RequestContext::$baseUrl is read in vendor/RequestContext.php on line 74 RequestContext::getBaseUrl() returns tainted data, and `$url` is assigned in vendor/Generator/UrlGenerator.php on line 289 UrlGenerator::doGenerate() returns tainted data in vendor/Generator/CompiledUrlGenerator.php on line 63 CompiledUrlGenerator::generate() returns tainted data in vendor/Router.php on line 252 Router::generate() returns tainted data in src/SWP/Bundle/ContentBundle/EventListener/ArticlePreviousRelativeUrlListener.php on line 53 2. Path: Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in Request.php on line 285 Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 285 `$request` is passed to Request::__construct() in vendor/Request.php on line 1978 `$request` is passed to Request::initialize() in vendor/Request.php on line 239 `$request` is passed to ParameterBag::__construct() in vendor/Request.php on line 257 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 28 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 77 ParameterBag::get() returns tainted data, and `$baseUrl` is assigned in vendor/Request.php on line 1797 `$baseUrl` is passed through rtrim() in vendor/Request.php on line 1853 Request::prepareBaseUrl() returns tainted data, and Request::$baseUrl is assigned in vendor/Request.php on line 889 Tainted property Request::$baseUrl is read in vendor/Request.php on line 892 Request::getBaseUrl() returns tainted data, and `$request->getBaseUrl()` is passed to RequestContext::setBaseUrl() in vendor/RequestContext.php on line 55 RequestContext::$baseUrl is assigned in vendor/RequestContext.php on line 86 Tainted property RequestContext::$baseUrl is read in vendor/RequestContext.php on line 74 RequestContext::getBaseUrl() returns tainted data, and `$url` is assigned in vendor/Generator/UrlGenerator.php on line 289 UrlGenerator::doGenerate() returns tainted data in vendor/Generator/CompiledUrlGenerator.php on line 63 CompiledUrlGenerator::generate() returns tainted data in vendor/Router.php on line 252 Router::generate() returns tainted data in src/SWP/Bundle/ContentBundle/EventListener/ArticlePreviousRelativeUrlListener.php on line 53 3. Path: `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 40 `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 40 `$headers` is assigned in vendor/ServerBag.php on line 41 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 263 `$values` is assigned in vendor/HeaderBag.php on line 29 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 30 `$values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 145 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 148 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 68 HeaderBag::all() returns tainted data, and `$headers` is assigned in vendor/HeaderBag.php on line 113 HeaderBag::get() returns tainted data, and `$host` is assigned in vendor/Request.php on line 1156 `$host` is passed through trim(), and `trim($host)` is passed through preg_replace(), and `preg_replace('/:\\d+$/', '', trim($host))` is passed through strtolower(), and `$host` is assigned in vendor/Request.php on line 1164 Request::getHost() returns tainted data, and `$request->getHost()` is passed to RequestContext::setHost() in vendor/RequestContext.php on line 58 `$host` is passed through strtolower(), and RequestContext::$host is assigned in vendor/RequestContext.php on line 162 Tainted property RequestContext::$host is read in vendor/RequestContext.php on line 150 RequestContext::getHost() returns tainted data, and `$uri` is assigned in src/SWP/Bundle/ContentBundle/Manager/MediaManager.php on line 95 MediaManager::getMediaUri() returns tainted data in src/SWP/Bundle/ContentBundle/Manager/MediaManager.php on line 82 MediaManager::getMediaPublicUrl() returns tainted data in src/SWP/Bundle/CoreBundle/Routing/ArticleAuthorMediaRouter.php on line 47 ArticleAuthorMediaRouter::generate() returns tainted data in src/SWP/Bundle/ContentBundle/EventListener/ArticlePreviousRelativeUrlListener.php on line 53 4. Path: `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 41 `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 41 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 263 `$values` is assigned in vendor/HeaderBag.php on line 29 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 30 `$values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 145 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 148 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 68 HeaderBag::all() returns tainted data, and `$headers` is assigned in vendor/HeaderBag.php on line 113 HeaderBag::get() returns tainted data, and `$host` is assigned in vendor/Request.php on line 1156 `$host` is passed through trim(), and `trim($host)` is passed through preg_replace(), and `preg_replace('/:\\d+$/', '', trim($host))` is passed through strtolower(), and `$host` is assigned in vendor/Request.php on line 1164 Request::getHost() returns tainted data, and `$request->getHost()` is passed to RequestContext::setHost() in vendor/RequestContext.php on line 58 `$host` is passed through strtolower(), and RequestContext::$host is assigned in vendor/RequestContext.php on line 162 Tainted property RequestContext::$host is read in vendor/RequestContext.php on line 150 RequestContext::getHost() returns tainted data, and `$uri` is assigned in src/SWP/Bundle/ContentBundle/Manager/MediaManager.php on line 95 MediaManager::getMediaUri() returns tainted data in src/SWP/Bundle/ContentBundle/Manager/MediaManager.php on line 82 MediaManager::getMediaPublicUrl() returns tainted data in src/SWP/Bundle/CoreBundle/Routing/ArticleAuthorMediaRouter.php on line 47 ArticleAuthorMediaRouter::generate() returns tainted data in src/SWP/Bundle/ContentBundle/EventListener/ArticlePreviousRelativeUrlListener.php on line 53 Used in output context RedirectResponse::__construct() uses RedirectResponse::setTargetUrl() ($url) in vendor/RedirectResponse.php on line 44 RedirectResponse::setTargetUrl() uses Response::setContent() ($content) in vendor/RedirectResponse.php on line 97 Response::setContent() uses property Response::$content for writing in vendor/Response.php on line 406 Property Response::$content is used in echo in vendor/Response.php on line 365 Preventing Cross-Site-Scripting Attacks Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user. In order to prevent this, make sure to escape all user-provided data: // for HTML $sanitized = htmlentities($tainted, ENT_QUOTES); // for URLs $sanitized = urlencode($tainted); General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
54			$article->getRoute()->getName(),
55			[
56			'slug' => $article->getSlug(),
57			]
58			),
59			Response::HTTP_MOVED_PERMANENTLY
60			));
61			}
62			}
63			}
64

superdesk / web-publisher

Pull Request — 2.1 (#1090)

onKernelException() A

Complexity

Size

Duplication

Importance

4 paths for user data to reach this point

Used in output context

Preventing Cross-Site-Scripting Attacks

General Strategies to prevent injection

Duplication Side-by-Side

Filter issues like