AnalyticsEventConsumer::execute() - Code Metrics - Inspection of "Merge pull request #975 from superdesk/2.0" - superdesk/web-publisher - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — master ( d01ad3...6b97e6 )

by Paweł

created 2019-10-15 13:09 UTC

AnalyticsEventConsumer::execute() A

↳ Parent: AnalyticsEventConsumer

Complexity

Conditions	4
Paths	4

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
dl	0
loc	25
rs	9.52
c	0
b	0
f	0
cc	4
nc	4
nop	1

<?php

declare(strict_types=1);

/*
 * This file is part of the Superdesk Web Publisher Core Bundle.
 *
 * Copyright 2017 Sourcefabric z.ú. and contributors.
 *
 * For the full copyright and license information, please see the
 * AUTHORS and LICENSE files distributed with this source code.
 *
 * @copyright 2017 Sourcefabric z.ú
 * @license http://www.superdesk.org/license
 */

namespace SWP\Bundle\CoreBundle\Consumer;

use Doctrine\Common\Persistence\ObjectManager;
use OldSound\RabbitMqBundle\RabbitMq\ConsumerInterface;
use PhpAmqpLib\Message\AMQPMessage;
use SWP\Bundle\AnalyticsBundle\Model\ArticleEventInterface;
use SWP\Bundle\AnalyticsBundle\Services\ArticleStatisticsServiceInterface;
use SWP\Bundle\CoreBundle\Model\ArticleStatistics;
use SWP\Component\MultiTenancy\Context\TenantContextInterface;
use SWP\Component\MultiTenancy\Exception\TenantNotFoundException;
use SWP\Component\MultiTenancy\Resolver\TenantResolver;
use Symfony\Component\HttpFoundation\Request;

final class AnalyticsEventConsumer implements ConsumerInterface
{
    private $articleStatisticsService;

    private $tenantResolver;

    private $tenantContext;

    private $articleStatisticsObjectManager;

    public function __construct(
        ArticleStatisticsServiceInterface $articleStatisticsService,
        TenantResolver $tenantResolver,
        TenantContextInterface $tenantContext,
        ObjectManager $articleStatisticsObjectManager
    ) {
        $this->articleStatisticsService = $articleStatisticsService;
        $this->tenantResolver = $tenantResolver;
        $this->tenantContext = $tenantContext;
        $this->articleStatisticsObjectManager = $articleStatisticsObjectManager;
    }

    public function execute(AMQPMessage $message)
    {
        /** @var Request $request */
        $request = unserialize($message->getBody());
        if (!$request instanceof Request) {
            return ConsumerInterface::MSG_REJECT;
        }

        try {
            $this->setTenant($request);
        } catch (TenantNotFoundException $e) {
            echo $e->getMessage()."\n";

            return ConsumerInterface::MSG_REJECT;
        }
        echo 'Set tenant: '.$this->tenantContext->getTenant()->getCode()."\n";

        if ($request->query->has('articleId')) {
            $this->handleArticlePageViews($request);

            echo 'Pageview for article '.$request->query->get('articleId')." was processed \n";
// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);
        }

        return ConsumerInterface::MSG_ACK;
    }

    private function handleArticlePageViews(Request $request): void
    {
        $articleId = $request->query->get('articleId', null);
        if (null !== $articleId && 0 !== (int) $articleId) {
            $articleStatistics = $this->articleStatisticsService->addArticleEvent((int) $articleId, ArticleEventInterface::ACTION_PAGEVIEW, [
                'pageViewSource' => $this->getPageViewSource($request),
            ]);

            $query = $this->articleStatisticsObjectManager->createQuery('UPDATE '.ArticleStatistics::class.' s SET s.pageViewsNumber = s.pageViewsNumber + 1 WHERE s.id = :id');
            $query->setParameter('id', $articleStatistics->getId());
            $query->execute();
        }
    }

    private function getPageViewSource(Request $request): string
    {
        $pageViewReferer = $request->query->get('ref', null);
        if (null !== $pageViewReferer) {
            $refererHost = $this->getFragmentFromUrl($pageViewReferer, 'host');
            if ($refererHost && $this->isHostMatchingTenant($refererHost)) {
                return ArticleEventInterface::PAGEVIEW_SOURCE_INTERNAL;
            }
        }

        return ArticleEventInterface::PAGEVIEW_SOURCE_EXTERNAL;
    }

    private function getFragmentFromUrl(string $url, string $fragment): ?string
    {
        $fragments = \parse_url($url);
        if (!\array_key_exists($fragment, $fragments)) {
            return null;
        }

        return $fragments[$fragment];
    }

    private function isHostMatchingTenant(string $host): bool
    {
        $tenant = $this->tenantContext->getTenant();
        $tenantHost = $tenant->getDomainName();
        if (null !== ($subdomain = $tenant->getSubdomain())) {
            $tenantHost = $subdomain.'.'.$tenantHost;
        }

        return $host === $tenantHost;
    }

    private function setTenant(Request $request): void
    {
        $this->tenantContext->setTenant(
            $this->tenantResolver->resolve(
                $request->server->get('HTTP_REFERER',
                    $request->query->get('host',
                        $request->getHost()
                    )
                )
            )
        );
    }
}


1			<?php
2
3			declare(strict_types=1);
4
5			/*
6			* This file is part of the Superdesk Web Publisher Core Bundle.
7			*
8			* Copyright 2017 Sourcefabric z.ú. and contributors.
9			*
10			* For the full copyright and license information, please see the
11			* AUTHORS and LICENSE files distributed with this source code.
12			*
13			* @copyright 2017 Sourcefabric z.ú
14			* @license http://www.superdesk.org/license
15			*/
16
17			namespace SWP\Bundle\CoreBundle\Consumer;
18
19			use Doctrine\Common\Persistence\ObjectManager;
20			use OldSound\RabbitMqBundle\RabbitMq\ConsumerInterface;
21			use PhpAmqpLib\Message\AMQPMessage;
22			use SWP\Bundle\AnalyticsBundle\Model\ArticleEventInterface;
23			use SWP\Bundle\AnalyticsBundle\Services\ArticleStatisticsServiceInterface;
24			use SWP\Bundle\CoreBundle\Model\ArticleStatistics;
25			use SWP\Component\MultiTenancy\Context\TenantContextInterface;
26			use SWP\Component\MultiTenancy\Exception\TenantNotFoundException;
27			use SWP\Component\MultiTenancy\Resolver\TenantResolver;
28			use Symfony\Component\HttpFoundation\Request;
29
30			final class AnalyticsEventConsumer implements ConsumerInterface
31			{
32			private $articleStatisticsService;
33
34			private $tenantResolver;
35
36			private $tenantContext;
37
38			private $articleStatisticsObjectManager;
39
40			public function __construct(
41			ArticleStatisticsServiceInterface $articleStatisticsService,
42			TenantResolver $tenantResolver,
43			TenantContextInterface $tenantContext,
44			ObjectManager $articleStatisticsObjectManager
45			) {
46			$this->articleStatisticsService = $articleStatisticsService;
47			$this->tenantResolver = $tenantResolver;
48			$this->tenantContext = $tenantContext;
49			$this->articleStatisticsObjectManager = $articleStatisticsObjectManager;
50			}
51
52			public function execute(AMQPMessage $message)
53			{
54			/** @var Request $request */
55			$request = unserialize($message->getBody());
56			if (!$request instanceof Request) {
57			return ConsumerInterface::MSG_REJECT;
58			}
59
60			try {
61			$this->setTenant($request);
62			} catch (TenantNotFoundException $e) {
63			echo $e->getMessage()."\n";
64
65			return ConsumerInterface::MSG_REJECT;
66			}
67			echo 'Set tenant: '.$this->tenantContext->getTenant()->getCode()."\n";
68
69			if ($request->query->has('articleId')) {
70			$this->handleArticlePageViews($request);
71
72			echo 'Pageview for article '.$request->query->get('articleId')." was processed \n";
			0 ignored issues – show Security Cross-Site Scripting introduced 2019-03-13 12:36 UTC by Report Bug Copy Issue Report `'Pageview for article ' ...') . ' was processed '` can contain request data and is used in output context(s) leading to a potential security vulnerability. 2 paths for user data to reach this point 1. Path: `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in ServerBag.php on line 62 `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in vendor/ServerBag.php on line 62 ParameterBag::$parameters is assigned in vendor/ServerBag.php on line 77 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 84 ParameterBag::get() returns tainted data in src/SWP/Bundle/CoreBundle/Consumer/AnalyticsEventConsumer.php on line 72 2. Path: Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in Request.php on line 281 Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$request` is passed to Request::__construct() in vendor/Request.php on line 1953 `$request` is passed to Request::initialize() in vendor/Request.php on line 235 `$request` is passed to ParameterBag::__construct() in vendor/Request.php on line 253 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 31 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 84 ParameterBag::get() returns tainted data in src/SWP/Bundle/CoreBundle/Consumer/AnalyticsEventConsumer.php on line 72 Preventing Cross-Site-Scripting Attacks Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user. In order to prevent this, make sure to escape all user-provided data: // for HTML $sanitized = htmlentities($tainted, ENT_QUOTES); // for URLs $sanitized = urlencode($tainted); General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
73			}
74
75			return ConsumerInterface::MSG_ACK;
76			}
77
78			private function handleArticlePageViews(Request $request): void
79			{
80			$articleId = $request->query->get('articleId', null);
81			if (null !== $articleId && 0 !== (int) $articleId) {
82			$articleStatistics = $this->articleStatisticsService->addArticleEvent((int) $articleId, ArticleEventInterface::ACTION_PAGEVIEW, [
83			'pageViewSource' => $this->getPageViewSource($request),
84			]);
85
86			$query = $this->articleStatisticsObjectManager->createQuery('UPDATE '.ArticleStatistics::class.' s SET s.pageViewsNumber = s.pageViewsNumber + 1 WHERE s.id = :id');
87			$query->setParameter('id', $articleStatistics->getId());
88			$query->execute();
89			}
90			}
91
92			private function getPageViewSource(Request $request): string
93			{
94			$pageViewReferer = $request->query->get('ref', null);
95			if (null !== $pageViewReferer) {
96			$refererHost = $this->getFragmentFromUrl($pageViewReferer, 'host');
97			if ($refererHost && $this->isHostMatchingTenant($refererHost)) {
98			return ArticleEventInterface::PAGEVIEW_SOURCE_INTERNAL;
99			}
100			}
101
102			return ArticleEventInterface::PAGEVIEW_SOURCE_EXTERNAL;
103			}
104
105			private function getFragmentFromUrl(string $url, string $fragment): ?string
106			{
107			$fragments = \parse_url($url);
108			if (!\array_key_exists($fragment, $fragments)) {
109			return null;
110			}
111
112			return $fragments[$fragment];
113			}
114
115			private function isHostMatchingTenant(string $host): bool
116			{
117			$tenant = $this->tenantContext->getTenant();
118			$tenantHost = $tenant->getDomainName();
119			if (null !== ($subdomain = $tenant->getSubdomain())) {
120			$tenantHost = $subdomain.'.'.$tenantHost;
121			}
122
123			return $host === $tenantHost;
124			}
125
126			private function setTenant(Request $request): void
127			{
128			$this->tenantContext->setTenant(
129			$this->tenantResolver->resolve(
130			$request->server->get('HTTP_REFERER',
131			$request->query->get('host',
132			$request->getHost()
133			)
134			)
135			)
136			);
137			}
138			}
139

superdesk / web-publisher

Push — master ( d01ad3...6b97e6 )

AnalyticsEventConsumer::execute() A

Complexity

Size

Duplication

Importance

2 paths for user data to reach this point

Preventing Cross-Site-Scripting Attacks

General Strategies to prevent injection

Duplication Side-by-Side

Filter issues like