This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | declare(strict_types=1); |
||
4 | |||
5 | /** |
||
6 | * @copyright Copyright (c) 2016 ublaboo <[email protected]> |
||
7 | * @author Pavel Janda <[email protected]> |
||
8 | * @package Ublaboo |
||
9 | */ |
||
10 | |||
11 | namespace Ublaboo\ApiRouter; |
||
12 | |||
13 | use Nette; |
||
14 | use Nette\Application\IRouter; |
||
15 | use Nette\Application\Request; |
||
16 | use Nette\SmartObject; |
||
17 | use Nette\Utils\Strings; |
||
18 | |||
19 | /** |
||
20 | * @method mixed onMatch(static, Nette\Application\Request $request) |
||
21 | * |
||
22 | * @Annotation |
||
23 | * @Target({"CLASS", "METHOD"}) |
||
24 | */ |
||
25 | class ApiRoute extends ApiRouteSpec implements IRouter |
||
26 | { |
||
27 | use SmartObject; |
||
28 | |||
29 | /** |
||
30 | * @var callable[] |
||
31 | */ |
||
32 | public $onMatch; |
||
33 | |||
34 | /** |
||
35 | * @var string|null |
||
36 | */ |
||
37 | private $presenter; |
||
38 | |||
39 | /** |
||
40 | * @var array |
||
41 | */ |
||
42 | private $actions = [ |
||
43 | 'POST' => false, |
||
44 | 'GET' => false, |
||
45 | 'PUT' => false, |
||
46 | 'DELETE' => false, |
||
47 | 'OPTIONS' => false, |
||
48 | 'PATCH' => false, |
||
49 | ]; |
||
50 | |||
51 | /** |
||
52 | * @var array |
||
53 | */ |
||
54 | private $default_actions = [ |
||
55 | 'POST' => 'create', |
||
56 | 'GET' => 'read', |
||
57 | 'PUT' => 'update', |
||
58 | 'DELETE' => 'delete', |
||
59 | 'OPTIONS' => 'options', |
||
60 | 'PATCH' => 'patch', |
||
61 | ]; |
||
62 | |||
63 | /** |
||
64 | * @var array |
||
65 | */ |
||
66 | private $formats = [ |
||
67 | 'json' => 'application/json', |
||
68 | 'xml' => 'application/xml', |
||
69 | ]; |
||
70 | |||
71 | /** |
||
72 | * @var array |
||
73 | */ |
||
74 | private $placeholder_order = []; |
||
75 | |||
76 | |||
77 | public function __construct($path, string $presenter = null, array $data = []) |
||
78 | { |
||
79 | /** |
||
80 | * Interface for setting route via annotation or directly |
||
81 | */ |
||
82 | if (!is_array($path)) { |
||
83 | $data['value'] = $path; |
||
84 | $data['presenter'] = $presenter; |
||
85 | |||
86 | if (empty($data['methods'])) { |
||
87 | $this->actions = $this->default_actions; |
||
88 | } else { |
||
89 | foreach ($data['methods'] as $method => $action) { |
||
90 | if (is_string($method)) { |
||
91 | $this->setAction($action, $method); |
||
92 | } else { |
||
93 | $m = $action; |
||
94 | |||
95 | if (isset($this->default_actions[$m])) { |
||
96 | $this->setAction($this->default_actions[$m], $m); |
||
97 | } |
||
98 | } |
||
99 | } |
||
100 | |||
101 | unset($data['methods']); |
||
102 | } |
||
103 | } else { |
||
104 | $data = $path; |
||
105 | } |
||
106 | |||
107 | /** |
||
108 | * Set Path |
||
109 | */ |
||
110 | $this->setPath($data['value']); |
||
111 | unset($data['value']); |
||
112 | |||
113 | parent::__construct($data); |
||
114 | } |
||
115 | |||
116 | |||
117 | public function setPresenter(?string $presenter): void |
||
118 | { |
||
119 | $this->presenter = $presenter; |
||
120 | } |
||
121 | |||
122 | |||
123 | public function getPresenter(): ?string |
||
124 | { |
||
125 | return $this->presenter; |
||
126 | } |
||
127 | |||
128 | |||
129 | public function setAction(string $action, string $method = null): void |
||
130 | { |
||
131 | if ($method === null) { |
||
132 | $method = array_search($action, $this->default_actions, true); |
||
133 | } |
||
134 | |||
135 | if (!isset($this->default_actions[$method])) { |
||
136 | return; |
||
137 | } |
||
138 | |||
139 | $this->actions[$method] = $action; |
||
140 | } |
||
141 | |||
142 | |||
143 | private function prepareForMatch(string $string): string |
||
144 | { |
||
145 | return sprintf('/%s/', str_replace('/', '\/', $string)); |
||
146 | } |
||
147 | |||
148 | |||
149 | /** |
||
150 | * Get all parameters from url mask |
||
151 | */ |
||
152 | public function getPlacehodlerParameters(): array |
||
153 | { |
||
154 | if (!empty($this->placeholder_order)) { |
||
155 | return array_filter($this->placeholder_order); |
||
156 | } |
||
157 | |||
158 | $return = []; |
||
159 | |||
160 | preg_replace_callback('/<(\w+)>/', function ($item) use (&$return) { |
||
161 | $return[] = end($item); |
||
162 | }, $this->path); |
||
163 | |||
164 | return $return; |
||
165 | } |
||
166 | |||
167 | |||
168 | /** |
||
169 | * Get required parameters from url mask |
||
170 | */ |
||
171 | public function getRequiredParams(): array |
||
172 | { |
||
173 | $regex = '/\[[^\[]+?\]/'; |
||
174 | $path = $this->getPath(); |
||
175 | |||
176 | while (preg_match($regex, $path)) { |
||
177 | $path = preg_replace($regex, '', $path); |
||
178 | } |
||
179 | |||
180 | $required = []; |
||
181 | |||
182 | preg_replace_callback('/<(\w+)>/', function ($item) use (&$required) { |
||
183 | $required[] = end($item); |
||
184 | }, $path); |
||
185 | |||
186 | return $required; |
||
187 | } |
||
188 | |||
189 | |||
190 | public function resolveFormat(Nette\Http\IRequest $httpRequest): void |
||
191 | { |
||
192 | if ($this->getFormat()) { |
||
193 | return; |
||
194 | } |
||
195 | |||
196 | $header = $httpRequest->getHeader('Accept'); |
||
197 | |||
198 | foreach ($this->formats as $format => $format_full) { |
||
199 | $format_full = Strings::replace($format_full, '/\//', '\/'); |
||
200 | |||
201 | if (Strings::match($header, "/{$format_full}/")) { |
||
202 | $this->setFormat($format); |
||
203 | } |
||
204 | } |
||
205 | |||
206 | $this->setFormat('json'); |
||
207 | } |
||
208 | |||
209 | |||
210 | public function getFormatFull(): string |
||
211 | { |
||
212 | return $this->formats[$this->getFormat()]; |
||
213 | } |
||
214 | |||
215 | |||
216 | public function setMethods(array $methods) |
||
217 | { |
||
218 | foreach ($methods as $method => $action) { |
||
219 | if (is_string($method)) { |
||
220 | $this->setAction($action, $method); |
||
221 | } else { |
||
222 | $m = $action; |
||
223 | |||
224 | if (isset($this->default_actions[$m])) { |
||
225 | $this->setAction($this->default_actions[$m], $m); |
||
226 | } |
||
227 | } |
||
228 | } |
||
229 | } |
||
230 | |||
231 | |||
232 | public function getMethods(): array |
||
233 | { |
||
234 | return array_keys(array_filter($this->actions)); |
||
235 | } |
||
236 | |||
237 | |||
238 | public function resolveMethod(Nette\Http\IRequest $request): string |
||
239 | { |
||
240 | if (!empty($request->getHeader('X-HTTP-Method-Override'))) { |
||
241 | return Strings::upper($request->getHeader('X-HTTP-Method-Override')); |
||
242 | } |
||
243 | |||
244 | if ($method = Strings::upper($request->getQuery('__apiRouteMethod'))) { |
||
245 | if (isset($this->actions[$method])) { |
||
246 | return $method; |
||
247 | } |
||
248 | } |
||
249 | |||
250 | return Strings::upper($request->getMethod()); |
||
251 | } |
||
252 | |||
253 | |||
254 | /******************************************************************************** |
||
255 | * Interface IRouter * |
||
256 | ********************************************************************************/ |
||
257 | |||
258 | |||
259 | /** |
||
260 | * Maps HTTP request to a Request object. |
||
261 | */ |
||
262 | public function match(Nette\Http\IRequest $httpRequest): ?Request |
||
263 | { |
||
264 | /** |
||
265 | * ApiRoute can be easily disabled |
||
266 | */ |
||
267 | if ($this->disable) { |
||
268 | return null; |
||
269 | } |
||
270 | |||
271 | $url = $httpRequest->getUrl(); |
||
272 | |||
273 | $path = $url->getPath(); |
||
274 | |||
275 | /** |
||
276 | * Build path mask |
||
277 | */ |
||
278 | $order = &$this->placeholder_order; |
||
279 | $parameters = $this->parameters; |
||
280 | |||
281 | $mask = preg_replace_callback('/(<(\w+)>)|\[|\]/', function ($item) use (&$order, $parameters) { |
||
282 | if ($item[0] == '[' || $item[0] == ']') { |
||
283 | if ($item[0] == '[') { |
||
284 | $order[] = null; |
||
285 | } |
||
286 | |||
287 | return $item[0]; |
||
288 | } |
||
289 | |||
290 | [, , $placeholder] = $item; |
||
0 ignored issues
–
show
|
|||
291 | |||
292 | $parameter = $parameters[$placeholder] ?? []; |
||
293 | |||
294 | $regex = $parameter['requirement'] ?? '\w+'; |
||
295 | $has_default = array_key_exists('default', $parameter); |
||
296 | $regex = preg_replace('~\(~', '(?:', $regex); |
||
297 | |||
298 | if ($has_default) { |
||
299 | $order[] = $placeholder; |
||
300 | |||
301 | return sprintf('(%s)?', $regex); |
||
302 | } |
||
303 | |||
304 | $order[] = $placeholder; |
||
305 | |||
306 | return sprintf('(%s)', $regex); |
||
307 | }, $this->path); |
||
308 | |||
309 | $mask = '^' . str_replace(['[', ']'], ['(', ')?'], $mask) . '$'; |
||
310 | |||
311 | /** |
||
312 | * Prepare paths for regex match (escape slashes) |
||
313 | */ |
||
314 | if (!preg_match_all($this->prepareForMatch($mask), $path, $matches)) { |
||
315 | return null; |
||
316 | } |
||
317 | |||
318 | /** |
||
319 | * Did some action to the request method exists? |
||
320 | */ |
||
321 | $this->resolveFormat($httpRequest); |
||
322 | $method = $this->resolveMethod($httpRequest); |
||
323 | $action = $this->actions[$method]; |
||
324 | |||
325 | if (!$action) { |
||
326 | return null; |
||
327 | } |
||
328 | |||
329 | /** |
||
330 | * Basic params |
||
331 | */ |
||
332 | $params = $httpRequest->getQuery(); |
||
333 | $params['action'] = $action; |
||
334 | $required_params = $this->getRequiredParams(); |
||
335 | |||
336 | /** |
||
337 | * Route mask parameters |
||
338 | */ |
||
339 | array_shift($matches); |
||
340 | |||
341 | foreach ($this->placeholder_order as $key => $name) { |
||
342 | if ($name !== null&& isset($matches[$key])) { |
||
343 | $params[$name] = reset($matches[$key]) ?: null; |
||
344 | |||
345 | /** |
||
346 | * Required parameters |
||
347 | */ |
||
348 | if (empty($params[$name]) && in_array($name, $required_params, true)) { |
||
349 | return null; |
||
350 | } |
||
351 | } |
||
352 | } |
||
353 | |||
354 | $request = new Request( |
||
355 | $this->presenter, |
||
356 | $method, |
||
357 | $params, |
||
358 | $httpRequest->getPost(), |
||
359 | $httpRequest->getFiles(), |
||
360 | [Request::SECURED => $httpRequest->isSecured()] |
||
361 | ); |
||
362 | |||
363 | /** |
||
364 | * Trigger event - route matches |
||
365 | */ |
||
366 | $this->onMatch($this, $request); |
||
367 | |||
368 | return $request; |
||
369 | } |
||
370 | |||
371 | |||
372 | /** |
||
373 | * Constructs absolute URL from Request object. |
||
374 | */ |
||
375 | public function constructUrl(Request $request, Nette\Http\Url $url): ?string |
||
376 | { |
||
377 | if ($this->presenter != $request->getPresenterName()) { |
||
378 | return null; |
||
379 | } |
||
380 | |||
381 | $base_url = $url->getBaseUrl(); |
||
382 | |||
383 | $action = $request->getParameter('action'); |
||
384 | $parameters = $request->getParameters(); |
||
385 | unset($parameters['action']); |
||
386 | $path = ltrim($this->getPath(), '/'); |
||
387 | |||
388 | if (array_search($action, $this->actions, true) === false) { |
||
389 | return null; |
||
390 | } |
||
391 | |||
392 | foreach ($parameters as $name => $value) { |
||
393 | if (strpos($path, "<{$name}>") !== false && $value !== null) { |
||
394 | $path = str_replace("<{$name}>", $value, $path); |
||
395 | |||
396 | unset($parameters[$name]); |
||
397 | } |
||
398 | } |
||
399 | |||
400 | $path = preg_replace_callback('/\[.+?\]/', function ($item) { |
||
401 | if (strpos(end($item), '<')) { |
||
402 | return ''; |
||
403 | } |
||
404 | |||
405 | return end($item); |
||
406 | }, $path); |
||
407 | |||
408 | /** |
||
409 | * There are still some required parameters in url mask |
||
410 | */ |
||
411 | if (preg_match('/<\w+>/', $path)) { |
||
412 | return null; |
||
413 | } |
||
414 | |||
415 | $path = str_replace(['[', ']'], '', $path); |
||
416 | |||
417 | $query = http_build_query($parameters); |
||
418 | |||
419 | return $base_url . $path . ($query ? '?' . $query : ''); |
||
420 | } |
||
421 | } |
||
422 |
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug.