Issues (35)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Debug.php (11 issues)

Labels
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php namespace nyx\diagnostics;
2
3
// Internal dependencies
4
use nyx\diagnostics\debug\handlers;
5
use nyx\diagnostics\debug\interfaces;
6
7
/**
8
 * Debug
9
 *
10
 * Registers the Error and Exception Handlers contained within this component and gives static access to them.
11
 * Please note that the Handler can only be enabled once using self::enable() during script execution. If they
12
 * get unregistered from PHP you'll have to manually register the exact same instances again in order to avoid
13
 * potentially weird behaviour due to this class being completely static.
14
 *
15
 * Important note: Neither this class nor any of the Handlers will fiddle with your php.ini settings with regards
16
 * to error reporting, displaying errors etc. Please consult the Error Handler's docs {@see handlers\Error} for
17
 * more information on what the threshold means and how not setting any ini directives here affects its behaviour.
18
 *
19
 * @package     Nyx\Diagnostics\Debug
20
 * @version     0.0.3
21
 * @author      Michal Chojnacki <[email protected]>
22
 * @copyright   2012-2016 Nyx Dev Team
23
 * @link        http://docs.muyo.io/nyx/diagnostics/index.html
24
 * @todo        Needs to seamlessly hook into already set error/exception handlers and handle less strict types
25
 *              than our handler interfaces just as well.
26
 * @todo        Move to Utils instead once properly abstracted?
27
 */
28
class Debug
29
{
30
    /**
31
     * @var bool                            Whether the Handlers already got registered (using this class) or not.
32
     */
33
    private static $enabled;
34
35
    /**
36
     * @var interfaces\handlers\Error       An Error Handler instance once registered.
37
     */
38
    private static $errorHandler;
39
40
    /**
41
     * @var interfaces\handlers\Exception   An Exception Handler instance once registered.
42
     */
43
    private static $exceptionHandler;
44
45
    /**
46
     * @var interfaces\Dumper               The Dumper in use.
47
     */
48
    private static $dumper;
49
50
    /**
51
     * Enables the bundled Error and Exception Handlers by registering them with PHP.
52
     *
53
     * Important note: The return values. When this method returns false, it merely means that the Handlers are
54
     * already registered and therefore could not be enabled again. This method will only return true for the call
55
     * that actually enables them. This is a little hack to make checking for certain conditions easier.
56
     *
57
     * @param   interfaces\handlers\Error       $error      An optional already instantiated Error Handler instance.
58
     *                                                      If none is given, a new one will be instantiated.
59
     * @param   interfaces\handlers\Exception   $exception  An optional already instantiated Exception Handler instance.
60
     *                                                      If none is given, a new one will be instantiated.
61
     * @param   int                             $threshold  {@see handlers\Error::setThreshold()}
62
     * @return  bool                                        True when Debug was not yet enabled, false otherwise.
63
     */
64
    public static function enable(interfaces\handlers\Error $error = null, interfaces\handlers\Exception $exception = null, $threshold = null) : bool
65
    {
66
        // Only enable the Handlers once. See the class description for more on this.
67
        if (static::$enabled) {
0 ignored issues
show
Since $enabled is declared private, accessing it with static will lead to errors in possible sub-classes; consider using self, or increasing the visibility of $enabled to at least protected.

Let’s assume you have a class which uses late-static binding:

class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

The code above will run fine in your PHP runtime. However, if you now create a sub-class and call the getSomeVariable() on that sub-class, you will receive a runtime error:

class YourSubClass extends YourClass { }

YourSubClass::getSomeVariable(); // Will cause an access error.

In the case above, it makes sense to update SomeClass to use self instead:

class SomeClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return self::$someVariable; // self works fine with private.
    }
}
Loading history...
68
            return false;
69
        }
70
71
        // Register the Handlers.
72
        static::$errorHandler     = handlers\Error::register($error, $threshold);
0 ignored issues
show
Since $errorHandler is declared private, accessing it with static will lead to errors in possible sub-classes; consider using self, or increasing the visibility of $errorHandler to at least protected.

Let’s assume you have a class which uses late-static binding:

class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

The code above will run fine in your PHP runtime. However, if you now create a sub-class and call the getSomeVariable() on that sub-class, you will receive a runtime error:

class YourSubClass extends YourClass { }

YourSubClass::getSomeVariable(); // Will cause an access error.

In the case above, it makes sense to update SomeClass to use self instead:

class SomeClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return self::$someVariable; // self works fine with private.
    }
}
Loading history...
73
        static::$exceptionHandler = handlers\Exception::register($exception);
0 ignored issues
show
Since $exceptionHandler is declared private, accessing it with static will lead to errors in possible sub-classes; consider using self, or increasing the visibility of $exceptionHandler to at least protected.

Let’s assume you have a class which uses late-static binding:

class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

The code above will run fine in your PHP runtime. However, if you now create a sub-class and call the getSomeVariable() on that sub-class, you will receive a runtime error:

class YourSubClass extends YourClass { }

YourSubClass::getSomeVariable(); // Will cause an access error.

In the case above, it makes sense to update SomeClass to use self instead:

class SomeClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return self::$someVariable; // self works fine with private.
    }
}
Loading history...
74
75
        return static::$enabled = true;
0 ignored issues
show
Since $enabled is declared private, accessing it with static will lead to errors in possible sub-classes; consider using self, or increasing the visibility of $enabled to at least protected.

Let’s assume you have a class which uses late-static binding:

class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

The code above will run fine in your PHP runtime. However, if you now create a sub-class and call the getSomeVariable() on that sub-class, you will receive a runtime error:

class YourSubClass extends YourClass { }

YourSubClass::getSomeVariable(); // Will cause an access error.

In the case above, it makes sense to update SomeClass to use self instead:

class SomeClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return self::$someVariable; // self works fine with private.
    }
}
Loading history...
76
    }
77
78
    /**
79
     * Dumps the given variable(s), providing information about their type, contents and others. Variadic, ie. accepts
80
     * multiple variables as parameters.
81
     *
82
     * @param   mixed[]     ...$vars    The variable(s) to dump info about.
83
     */
84
    public static function dump(...$vars)
85
    {
86
        // If we've got no Dumper specified, create the default one.
87
        if (null === static::$dumper) {
0 ignored issues
show
Since $dumper is declared private, accessing it with static will lead to errors in possible sub-classes; consider using self, or increasing the visibility of $dumper to at least protected.

Let’s assume you have a class which uses late-static binding:

class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

The code above will run fine in your PHP runtime. However, if you now create a sub-class and call the getSomeVariable() on that sub-class, you will receive a runtime error:

class YourSubClass extends YourClass { }

YourSubClass::getSomeVariable(); // Will cause an access error.

In the case above, it makes sense to update SomeClass to use self instead:

class SomeClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return self::$someVariable; // self works fine with private.
    }
}
Loading history...
88
            static::setDumper(static::createDefaultDumper());
89
        }
90
91
        echo call_user_func([static::$dumper, 'dump'], ...$vars);
0 ignored issues
show
Since $dumper is declared private, accessing it with static will lead to errors in possible sub-classes; consider using self, or increasing the visibility of $dumper to at least protected.

Let’s assume you have a class which uses late-static binding:

class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

The code above will run fine in your PHP runtime. However, if you now create a sub-class and call the getSomeVariable() on that sub-class, you will receive a runtime error:

class YourSubClass extends YourClass { }

YourSubClass::getSomeVariable(); // Will cause an access error.

In the case above, it makes sense to update SomeClass to use self instead:

class SomeClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return self::$someVariable; // self works fine with private.
    }
}
Loading history...
92
    }
93
94
    /**
95
     * Checks whether Debug is enabled.
96
     *
97
     * @return  bool    True when Debug is enabled, false otherwise.
98
     */
99
    public static function isEnabled() : bool
100
    {
101
        return true === static::$enabled;
0 ignored issues
show
Since $enabled is declared private, accessing it with static will lead to errors in possible sub-classes; consider using self, or increasing the visibility of $enabled to at least protected.

Let’s assume you have a class which uses late-static binding:

class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

The code above will run fine in your PHP runtime. However, if you now create a sub-class and call the getSomeVariable() on that sub-class, you will receive a runtime error:

class YourSubClass extends YourClass { }

YourSubClass::getSomeVariable(); // Will cause an access error.

In the case above, it makes sense to update SomeClass to use self instead:

class SomeClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return self::$someVariable; // self works fine with private.
    }
}
Loading history...
102
    }
103
104
    /**
105
     * Returns the Error Handler in use.
106
     *
107
     * @return  interfaces\handlers\Error       The Error Handler in use, otherwise null if it has not been
108
     *                                          registered using self::enable().
109
     */
110
    public static function getErrorHandler() : interfaces\handlers\Error
111
    {
112
        return static::$errorHandler;
0 ignored issues
show
Since $errorHandler is declared private, accessing it with static will lead to errors in possible sub-classes; consider using self, or increasing the visibility of $errorHandler to at least protected.

Let’s assume you have a class which uses late-static binding:

class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

The code above will run fine in your PHP runtime. However, if you now create a sub-class and call the getSomeVariable() on that sub-class, you will receive a runtime error:

class YourSubClass extends YourClass { }

YourSubClass::getSomeVariable(); // Will cause an access error.

In the case above, it makes sense to update SomeClass to use self instead:

class SomeClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return self::$someVariable; // self works fine with private.
    }
}
Loading history...
113
    }
114
115
    /**
116
     * Returns the Exception Handler in use.
117
     *
118
     * @return  interfaces\handlers\Exception   The Exception Handler in use, otherwise null if it has not been
119
     *                                          registered using self::enable().
120
     */
121
    public static function getExceptionHandler() : interfaces\handlers\Exception
122
    {
123
        return static::$exceptionHandler;
0 ignored issues
show
Since $exceptionHandler is declared private, accessing it with static will lead to errors in possible sub-classes; consider using self, or increasing the visibility of $exceptionHandler to at least protected.

Let’s assume you have a class which uses late-static binding:

class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

The code above will run fine in your PHP runtime. However, if you now create a sub-class and call the getSomeVariable() on that sub-class, you will receive a runtime error:

class YourSubClass extends YourClass { }

YourSubClass::getSomeVariable(); // Will cause an access error.

In the case above, it makes sense to update SomeClass to use self instead:

class SomeClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return self::$someVariable; // self works fine with private.
    }
}
Loading history...
124
    }
125
126
    /**
127
     * Returns the Dumper in use.
128
     *
129
     * @return  interfaces\Dumper   The Dumper in use.
130
     */
131
    public static function getDumper() : interfaces\Dumper
132
    {
133
        return static::$dumper;
0 ignored issues
show
Since $dumper is declared private, accessing it with static will lead to errors in possible sub-classes; consider using self, or increasing the visibility of $dumper to at least protected.

Let’s assume you have a class which uses late-static binding:

class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

The code above will run fine in your PHP runtime. However, if you now create a sub-class and call the getSomeVariable() on that sub-class, you will receive a runtime error:

class YourSubClass extends YourClass { }

YourSubClass::getSomeVariable(); // Will cause an access error.

In the case above, it makes sense to update SomeClass to use self instead:

class SomeClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return self::$someVariable; // self works fine with private.
    }
}
Loading history...
134
    }
135
136
    /**
137
     * Sets the Dumper to be used.
138
     *
139
     * @param   interfaces\Dumper   $dumper     The Dumper to be used.
140
     */
141
    public static function setDumper(interfaces\Dumper $dumper)
142
    {
143
        static::$dumper = $dumper;
0 ignored issues
show
Since $dumper is declared private, accessing it with static will lead to errors in possible sub-classes; consider using self, or increasing the visibility of $dumper to at least protected.

Let’s assume you have a class which uses late-static binding:

class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

The code above will run fine in your PHP runtime. However, if you now create a sub-class and call the getSomeVariable() on that sub-class, you will receive a runtime error:

class YourSubClass extends YourClass { }

YourSubClass::getSomeVariable(); // Will cause an access error.

In the case above, it makes sense to update SomeClass to use self instead:

class SomeClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return self::$someVariable; // self works fine with private.
    }
}
Loading history...
144
    }
145
146
    /**
147
     * Returns the type of the given value - the class name for objects or the
148
     * type for all other types.
149
     *
150
     * @param   mixed   $value
151
     * @return  string
152
     */
153
    public static function getTypeName($value) : string
154
    {
155
        return is_object($value) ? get_class($value) : gettype($value);
156
    }
157
158
    /**
159
     * Converts an Exception to an array in the format as returned by \Exception::getTrace().
160
     *
161
     * @param   \Exception  $exception  The Exception to convert.
162
     * @return  array
163
     */
164
    public static function exceptionToArray(\Exception $exception) : array
165
    {
166
        return [
167
            'type'  => $exception->getCode(),
168
            'file'  => $exception->getFile(),
169
            'line'  => $exception->getLine(),
170
            'class' => get_class($exception),
171
            'args'  => [$exception->getMessage()]
172
        ];
173
    }
174
175
    /**
176
     * Creates a default variable dumper to be used by self::dump() if no other has been set before the method
177
     * call to self::dump().
178
     *
179
     * @return  interfaces\Dumper|callable  $dumper     The created dumper.
180
     */
181
    protected static function createDefaultDumper()
182
    {
183
        return new debug\dumpers\Native;
184
    }
185
}
186