Issues (65)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Anshar/Http/Request.php (37 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Subreality\Dilmun\Anshar\Http;
4
5
use Psr\Http\Message\RequestInterface;
6
use Psr\Http\Message\StreamInterface;
7
use Psr\Http\Message\UriInterface;
8
9
class Request implements RequestInterface
10
{
11
    /**
12
     * @var string
13
     */
14
    protected $protocol_version = "1.1";
15
16
    /**
17
     * @var string[][]
18
     */
19
    protected $headers;
20
21
    /**
22
     * @var StreamInterface
23
     */
24
    protected $body;
25
26
    /**
27
     * @var string
28
     */
29
    protected $request_target;
30
31
    /**
32
     * @var string
33
     */
34
    protected $method;
35
36
    /**
37
     * @var UriInterface
38
     */
39
    protected $uri;
40
41
    public function __construct($uri = null, $method = null, array $headers = [])
0 ignored issues
show
The parameter $uri is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $method is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $headers is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
42
    {
43
    }
44
45
    /**
46
     * Retrieves the HTTP protocol version as a string.
47
     *
48
     * The string MUST contain only the HTTP version number (e.g., "1.1", "1.0").
49
     *
50
     * @return string HTTP protocol version.
0 ignored issues
show
Should the return type not be string|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
51
     */
52
    public function getProtocolVersion()
53
    {
54
        // TODO: Implement getProtocolVersion() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
55
    }
56
57
    /**
58
     * Return an instance with the specified HTTP protocol version.
59
     *
60
     * The version string MUST contain only the HTTP version number (e.g.,
61
     * "1.1", "1.0").
62
     *
63
     * This method MUST be implemented in such a way as to retain the
64
     * immutability of the message, and MUST return an instance that has the
65
     * new protocol version.
66
     *
67
     * @param string $version HTTP protocol version
68
     * @return static
0 ignored issues
show
Should the return type not be Request|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
69
     */
70
    public function withProtocolVersion($version)
71
    {
72
        // TODO: Implement withProtocolVersion() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
73
    }
74
75
    /**
76
     * Retrieves all message header values.
77
     *
78
     * The keys represent the header name as it will be sent over the wire, and
79
     * each value is an array of strings associated with the header.
80
     *
81
     *     // Represent the headers as a string
82
     *     foreach ($message->getHeaders() as $name => $values) {
83
     *         echo $name . ": " . implode(", ", $values);
84
     *     }
85
     *
86
     *     // Emit headers iteratively:
87
     *     foreach ($message->getHeaders() as $name => $values) {
88
     *         foreach ($values as $value) {
89
     *             header(sprintf('%s: %s', $name, $value), false);
90
     *         }
91
     *     }
92
     *
93
     * While header names are not case-sensitive, getHeaders() will preserve the
94
     * exact case in which headers were originally specified.
95
     *
96
     * @return string[][] Returns an associative array of the message's headers. Each
0 ignored issues
show
Should the return type not be string[][]|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
97
     *     key MUST be a header name, and each value MUST be an array of strings
98
     *     for that header.
99
     */
100
    public function getHeaders()
101
    {
102
        // TODO: Implement getHeaders() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
103
    }
104
105
    /**
106
     * Checks if a header exists by the given case-insensitive name.
107
     *
108
     * @param string $name Case-insensitive header field name.
109
     * @return bool Returns true if any header names match the given header
0 ignored issues
show
Should the return type not be boolean|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
110
     *     name using a case-insensitive string comparison. Returns false if
111
     *     no matching header name is found in the message.
112
     */
113
    public function hasHeader($name)
114
    {
115
        // TODO: Implement hasHeader() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
116
    }
117
118
    /**
119
     * Retrieves a message header value by the given case-insensitive name.
120
     *
121
     * This method returns an array of all the header values of the given
122
     * case-insensitive header name.
123
     *
124
     * If the header does not appear in the message, this method MUST return an
125
     * empty array.
126
     *
127
     * @param string $name Case-insensitive header field name.
128
     * @return string[] An array of string values as provided for the given
0 ignored issues
show
Should the return type not be string[]|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
129
     *    header. If the header does not appear in the message, this method MUST
130
     *    return an empty array.
131
     */
132
    public function getHeader($name)
133
    {
134
        // TODO: Implement getHeader() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
135
    }
136
137
    /**
138
     * Retrieves a comma-separated string of the values for a single header.
139
     *
140
     * This method returns all of the header values of the given
141
     * case-insensitive header name as a string concatenated together using
142
     * a comma.
143
     *
144
     * NOTE: Not all header values may be appropriately represented using
145
     * comma concatenation. For such headers, use getHeader() instead
146
     * and supply your own delimiter when concatenating.
147
     *
148
     * If the header does not appear in the message, this method MUST return
149
     * an empty string.
150
     *
151
     * @param string $name Case-insensitive header field name.
152
     * @return string A string of values as provided for the given header
0 ignored issues
show
Should the return type not be string|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
153
     *    concatenated together using a comma. If the header does not appear in
154
     *    the message, this method MUST return an empty string.
155
     */
156
    public function getHeaderLine($name)
157
    {
158
        // TODO: Implement getHeaderLine() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
159
    }
160
161
    /**
162
     * Return an instance with the provided value replacing the specified header.
163
     *
164
     * While header names are case-insensitive, the casing of the header will
165
     * be preserved by this function, and returned from getHeaders().
166
     *
167
     * This method MUST be implemented in such a way as to retain the
168
     * immutability of the message, and MUST return an instance that has the
169
     * new and/or updated header and value.
170
     *
171
     * @param string $name Case-insensitive header field name.
172
     * @param string|string[] $value Header value(s).
173
     * @return static
0 ignored issues
show
Should the return type not be Request|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
174
     * @throws \InvalidArgumentException for invalid header names or values.
175
     */
176
    public function withHeader($name, $value)
177
    {
178
        // TODO: Implement withHeader() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
179
    }
180
181
    /**
182
     * Return an instance with the specified header appended with the given value.
183
     *
184
     * Existing values for the specified header will be maintained. The new
185
     * value(s) will be appended to the existing list. If the header did not
186
     * exist previously, it will be added.
187
     *
188
     * This method MUST be implemented in such a way as to retain the
189
     * immutability of the message, and MUST return an instance that has the
190
     * new header and/or value.
191
     *
192
     * @param string $name Case-insensitive header field name to add.
193
     * @param string|string[] $value Header value(s).
194
     * @return static
0 ignored issues
show
Should the return type not be Request|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
195
     * @throws \InvalidArgumentException for invalid header names or values.
196
     */
197
    public function withAddedHeader($name, $value)
198
    {
199
        // TODO: Implement withAddedHeader() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
200
    }
201
202
    /**
203
     * Return an instance without the specified header.
204
     *
205
     * Header resolution MUST be done without case-sensitivity.
206
     *
207
     * This method MUST be implemented in such a way as to retain the
208
     * immutability of the message, and MUST return an instance that removes
209
     * the named header.
210
     *
211
     * @param string $name Case-insensitive header field name to remove.
212
     * @return static
0 ignored issues
show
Should the return type not be Request|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
213
     */
214
    public function withoutHeader($name)
215
    {
216
        // TODO: Implement withoutHeader() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
217
    }
218
219
    /**
220
     * Gets the body of the message.
221
     *
222
     * @return StreamInterface Returns the body as a stream.
0 ignored issues
show
Should the return type not be StreamInterface|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
223
     */
224
    public function getBody()
225
    {
226
        // TODO: Implement getBody() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
227
    }
228
229
    /**
230
     * Return an instance with the specified message body.
231
     *
232
     * The body MUST be a StreamInterface object.
233
     *
234
     * This method MUST be implemented in such a way as to retain the
235
     * immutability of the message, and MUST return a new instance that has the
236
     * new body stream.
237
     *
238
     * @param StreamInterface $body Body.
239
     * @return static
0 ignored issues
show
Should the return type not be Request|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
240
     * @throws \InvalidArgumentException When the body is not valid.
241
     */
242
    public function withBody(StreamInterface $body)
243
    {
244
        // TODO: Implement withBody() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
245
    }
246
247
    /**
248
     * Retrieves the message's request target.
249
     *
250
     * Retrieves the message's request-target either as it will appear (for
251
     * clients), as it appeared at request (for servers), or as it was
252
     * specified for the instance (see withRequestTarget()).
253
     *
254
     * In most cases, this will be the origin-form of the composed URI,
255
     * unless a value was provided to the concrete implementation (see
256
     * withRequestTarget() below).
257
     *
258
     * If no URI is available, and no request-target has been specifically
259
     * provided, this method MUST return the string "/".
260
     *
261
     * @return string
0 ignored issues
show
Should the return type not be string|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
262
     */
263
    public function getRequestTarget()
264
    {
265
        // TODO: Implement getRequestTarget() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
266
    }
267
268
    /**
269
     * Return an instance with the specific request-target.
270
     *
271
     * If the request needs a non-origin-form request-target — e.g., for
272
     * specifying an absolute-form, authority-form, or asterisk-form —
273
     * this method may be used to create an instance with the specified
274
     * request-target, verbatim.
275
     *
276
     * This method MUST be implemented in such a way as to retain the
277
     * immutability of the message, and MUST return an instance that has the
278
     * changed request target.
279
     *
280
     * @link http://tools.ietf.org/html/rfc7230#section-5.3 (for the various
281
     *     request-target forms allowed in request messages)
282
     * @param mixed $requestTarget
283
     * @return static
0 ignored issues
show
Should the return type not be Request|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
284
     */
285
    public function withRequestTarget($requestTarget)
286
    {
287
        // TODO: Implement withRequestTarget() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
288
    }
289
290
    /**
291
     * Retrieves the HTTP method of the request.
292
     *
293
     * @return string Returns the request method.
0 ignored issues
show
Should the return type not be string|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
294
     */
295
    public function getMethod()
296
    {
297
        // TODO: Implement getMethod() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
298
    }
299
300
    /**
301
     * Return an instance with the provided HTTP method.
302
     *
303
     * While HTTP method names are typically all uppercase characters, HTTP
304
     * method names are case-sensitive and thus implementations SHOULD NOT
305
     * modify the given string.
306
     *
307
     * This method MUST be implemented in such a way as to retain the
308
     * immutability of the message, and MUST return an instance that has the
309
     * changed request method.
310
     *
311
     * @param string $method Case-sensitive method.
312
     * @return static
0 ignored issues
show
Should the return type not be Request|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
313
     * @throws \InvalidArgumentException for invalid HTTP methods.
314
     */
315
    public function withMethod($method)
316
    {
317
        // TODO: Implement withMethod() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
318
    }
319
320
    /**
321
     * Retrieves the URI instance.
322
     *
323
     * This method MUST return a UriInterface instance.
324
     *
325
     * @link http://tools.ietf.org/html/rfc3986#section-4.3
326
     * @return UriInterface Returns a UriInterface instance
0 ignored issues
show
Should the return type not be UriInterface|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
327
     *     representing the URI of the request.
328
     */
329
    public function getUri()
330
    {
331
        // TODO: Implement getUri() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
332
    }
333
334
    /**
335
     * Returns an instance with the provided URI.
336
     *
337
     * This method MUST update the Host header of the returned request by
338
     * default if the URI contains a host component. If the URI does not
339
     * contain a host component, any pre-existing Host header MUST be carried
340
     * over to the returned request.
341
     *
342
     * You can opt-in to preserving the original state of the Host header by
343
     * setting `$preserveHost` to `true`. When `$preserveHost` is set to
344
     * `true`, this method interacts with the Host header in the following ways:
345
     *
346
     * - If the Host header is missing or empty, and the new URI contains
347
     *   a host component, this method MUST update the Host header in the returned
348
     *   request.
349
     * - If the Host header is missing or empty, and the new URI does not contain a
350
     *   host component, this method MUST NOT update the Host header in the returned
351
     *   request.
352
     * - If a Host header is present and non-empty, this method MUST NOT update
353
     *   the Host header in the returned request.
354
     *
355
     * This method MUST be implemented in such a way as to retain the
356
     * immutability of the message, and MUST return an instance that has the
357
     * new UriInterface instance.
358
     *
359
     * @link http://tools.ietf.org/html/rfc3986#section-4.3
360
     * @param UriInterface $uri New request URI to use.
361
     * @param bool $preserveHost Preserve the original state of the Host header.
362
     * @return static
0 ignored issues
show
Should the return type not be Request|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
363
     */
364
    public function withUri(UriInterface $uri, $preserveHost = false)
365
    {
366
        // TODO: Implement withUri() method.
0 ignored issues
show
Coding Style Best Practice introduced by
Comments for TODO tasks are often forgotten in the code; it might be better to use a dedicated issue tracker.
Loading history...
367
    }
368
}
369