Issues (35)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

debug/Handler.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php namespace nyx\diagnostics\debug;
2
3
// External dependencies
4
use nyx\events;
5
6
// Internal dependencies
7
use nyx\diagnostics\definitions;
8
9
/**
10
 * Abstract Handler
11
 *
12
 * Provides means for concrete Handlers to deal with Conditions and debug Events. Does not actually allow for
13
 * the implementation of a specific handler interface on its own as it does not implement either of the handle()
14
 * methods.
15
 *
16
 * @package     Nyx\Diagnostics\Debug
17
 * @version     0.1.0
18
 * @author      Michal Chojnacki <[email protected]>
19
 * @copyright   2012-2016 Nyx Dev Team
20
 * @link        http://docs.muyo.io/nyx/diagnostics/debug.html
21
 */
22
abstract class Handler implements events\interfaces\EmitterAware
23
{
24
    /**
25
     * The traits of a Handler instance.
26
     */
27
    use events\traits\EmitterAware;
28
29
    /**
30
     * @var Condition[]         An array of Condition instances that will be checked before handling the
31
     *                          Error/Exception or arrays containing 'matcher' and 'onMatch' keys with callables
32
     *                          as values. See {@see self::apply()} for more information.
33
     */
34
    private $conditions = [];
35
36
    /**
37
     * @var bool    Whether Conditions/Delegates are allowed to arbitrarily end script execution by returning
38
     *              definitions/Signals::QUIT.
39
     */
40
    private $allowQuit = true;
41
42
    /**
43
     * Applies a Condition to this Handler.
44
     *
45
     * @param   Condition|callable  $condition  Either a Condition instance or a 'matcher' callable accepting one
46
     *                                          two arguments - an Exception and a Handler instance, and
47
     *                                          returning true/false when the given Exception is a match or not.
48
     *                                          When a callable is given, the second argument to this method must
49
     *                                          also be given.
50
     * @param   callable            $onMatch    A callable containing the code that should be executed when the
51
     *                                          'matcher' callable given as first argument returns true. This
52
     *                                          argument is ignored when a concrete Condition instance is given
53
     *                                          as the first argument instead of a callable.
54
     * @return  $this
55
     * @throws  \InvalidArgumentException       When a callable is given as first argument but the second is
56
     *                                          missing or when neither a Condition instance nor a callable are
57
     *                                          given as the first argument.
58
     */
59
    public function apply($condition, callable $onMatch = null) : self
60
    {
61
        $callable = is_callable($condition);
62
63
        if (!$callable && !$condition instanceof Condition) {
64
            throw new \InvalidArgumentException('The first parameter given must be a \nyx\diagnostics\Condition instance or a callable. ['.gettype($condition).'] given.');
65
        }
66
67
        // Condition instances.
68
        if (!$callable) {
69
            $this->conditions[] = $condition;
70
        }
71
        // Both parameters are callables.
72
        else {
73
            if (null === $onMatch) {
74
                throw new \InvalidArgumentException('A callable must be given as second parameter when the first is also a callable.');
75
            }
76
77
            $this->conditions[] = [
78
                'matcher' => $condition,
79
                'onMatch' => $onMatch
80
            ];
81
        }
82
83
        return $this;
84
    }
85
86
    /**
87
     * Sets whether Conditions/Delegates are allowed to arbitrarily end script execution by returning
88
     * definitions/Signals::QUIT.
89
     *
90
     * @param   bool    $bool   True to allow Conditions/Delegates to end script execution, false otherwise.
91
     */
92
    public function setAllowQuit(bool $bool)
93
    {
94
        $this->allowQuit = $bool;
95
    }
96
97
    /**
98
     * Checks whether Conditions/Delegates are allowed to arbitrarily end script execution by returning
99
     * definitions/Signals::QUIT.
100
     *
101
     * @return  bool    True when Conditions/Delegates are allowed to end script execution, false otherwise.
102
     */
103
    public function doesAllowQuit() : bool
104
    {
105
        return $this->allowQuit;
106
    }
107
108
    /**
109
     * Runs through the registered Conditions and invokes their callbacks when they match the given Exception.
110
     *
111
     * @param   \Exception  $exception  The Exception conditions should match
112
     * @return  bool                    True when any Condition returns the PREVENT signal, false otherwise.
113
     */
114
    protected function runConditions(\Exception $exception) : bool
115
    {
116
        $prevent = false;
117
118
        foreach ($this->conditions as $condition) {
119
            // We can call the methods on a Condition instance directly.
120
            if ($condition instanceof Condition) {
121
                if (true === $condition->matches($exception, $this)) {
122
                    $response = $condition->onMatch($exception, $this);
123
                } else {
124
                    continue;
125
                }
126
            }
127
            // Otherwise we're dealing with our little 'array' condition, ie. two callables. Run the match straight
128
            // away.
129
            elseif (true === call_user_func($condition['matcher'], $exception, $this)) {
130
                $response = call_user_func($condition['onMatch'], $exception, $this);
131
            } else {
132
                continue;
133
            }
134
135
            // Now let's check what onMatch() returned and see if it's a QUIT and we may exit.
136
            if (($response & definitions\Signals::QUIT) === definitions\Signals::QUIT and $this->allowQuit) {
0 ignored issues
show
Comprehensibility Best Practice introduced by
Using logical operators such as and instead of && is generally not recommended.

PHP has two types of connecting operators (logical operators, and boolean operators):

  Logical Operators Boolean Operator
AND - meaning and &&
OR - meaning or ||

The difference between these is the order in which they are executed. In most cases, you would want to use a boolean operator like &&, or ||.

Let’s take a look at a few examples:

// Logical operators have lower precedence:
$f = false or true;

// is executed like this:
($f = false) or true;


// Boolean operators have higher precedence:
$f = false || true;

// is executed like this:
$f = (false || true);

Logical Operators are used for Control-Flow

One case where you explicitly want to use logical operators is for control-flow such as this:

$x === 5
    or die('$x must be 5.');

// Instead of
if ($x !== 5) {
    die('$x must be 5.');
}

Since die introduces problems of its own, f.e. it makes our code hardly testable, and prevents any kind of more sophisticated error handling; you probably do not want to use this in real-world code. Unfortunately, logical operators cannot be combined with throw at this point:

// The following is currently a parse error.
$x === 5
    or throw new RuntimeException('$x must be 5.');

These limitations lead to logical operators rarely being of use in current PHP code.

Loading history...
137
                exit;
138
            }
139
140
            // Using the PREVENT signal on its own will not break the loop but we will need to pass it to the Handler
141
            // afterwards so it knows that it shouldn't proceed with its own code.
142
            if (($response & definitions\Signals::PREVENT) === definitions\Signals::PREVENT) {
143
                $prevent = true;
144
            }
145
146
            // QUIT includes STOP so this will catch both situations.
147
            if (($response & definitions\Signals::STOP) === definitions\Signals::STOP) {
148
                break;
149
            }
150
        }
151
152
        return $prevent;
153
    }
154
155
    /**
156
     * Helper method which emits a diagnostics\events\Debug event with the given name and the given initial
157
     * Exception and returns the Exception set in the Event after emission is done. All of it assuming an Emitter
158
     * is set for the Handler. False will be returned if that is not the case.
159
     *
160
     * @param   string          $name       The name of the Event to emit {@see definitions/Events}.
161
     * @param   \Exception      $exception  The initial Exception to be passed to listeners.
162
     * @return  \Exception|null             Either an Exception when event emission occurred or null if no Emitter
163
     *                                      is set and therefore no events were emitted.
164
     */
165
    protected function emitDebugEvent($name, \Exception $exception)
166
    {
167
        // Don't proceed when we've got no Emitter.
168
        if (null === $this->emitter) {
169
            return null;
170
        }
171
172
        $this->emitter->emit($name, $event = new Event($exception, $this));
173
174
        // Event Listeners may override the Exception. Need to account for that.
175
        return $event->getException();
176
    }
177
}
178