Issues in Platform.php (master) - Issues in master - unyx/utils - Measure and Improve Code Quality continuously with Scrutinizer

Issues (94)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Platform.php (28 issues)

Labels

Bug 28

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php namespace nyx\utils;

/**
 * Platform
 *
 * Utilities related to the operating system PHP is running on, retrieving information about and executing
 * system processes etc.
 *
 * Requires:
 * - Function: shell_exec() (getting the shells available on this system)
 * - Function: exec() (checking whether TTY is available on this system)
 *
 * @package     Nyx\Utils\Platform
 * @version     0.1.0
 * @author      Michal Chojnacki <[email protected]>
 * @copyright   2012-2016 Nyx Dev Team
 * @link        http://docs.muyo.io/nyx/utils/platform.html
 */
class Platform
{
    /**
     * The traits of the Platform class.
     */
    use traits\StaticallyExtendable;

    /**
     * Platform type constants.
     */
    const TYPE_UNIX    = 1;
    const TYPE_WINDOWS = 2;
    const TYPE_BSD     = 3;
    const TYPE_CYGWIN  = 4;
    const TYPE_DARWIN  = 5;

    /**
     * @var int     The platform PHP is running on.
     */
    private static $type;

    /**
     * @var array   An array of shell names and the paths to their binaries once populated or false when PHP is
     *              running on a system that does not support them (Windows).
     */
    private static $shells;

    /**
     * @var bool    Whether this platform has the 'stty' binary (always false on Windows).
     */
    private static $hasStty;

    /**
     * Guesses and returns the platform PHP is running on. If it can't be determined, the default
     * of self::TYPE_UNIX will be returned.
     *
     * @return  int     One of the platform TYPE_ constants defined in this class.
     */
    public static function getType() : int
    {
        // Return the cached result if it's already available.
        if (null !== static::$type) {
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
            return static::$type;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        $os = strtolower(php_uname("s"));

        // Check in order of likeliness.
        if (false !== strpos($os, 'unix')) {
            return static::$type = self::TYPE_UNIX;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        if (0 === strpos($os, 'win')) {
            return static::$type = self::TYPE_WINDOWS;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        if (false !== strpos($os, 'bsd')) {
            return static::$type = self::TYPE_BSD;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        if (false !== strpos($os, 'darwin')) {
            return static::$type = self::TYPE_DARWIN;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        if (false !== strpos($os, 'cygwin')) {
            return static::$type = self::TYPE_CYGWIN;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        // Use the default otherwise.
        return static::$type = self::TYPE_UNIX;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
    }

    /**
     * Checks whether PHP is running on a Unix platform
     *
     * @return  bool    True when PHP is running on a Unix platform, false otherwise.
     */
    public static function isUnix() : bool
    {
        // Return the cached result if it's already available.
        if (null !== static::$type) {
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
            return static::$type === self::TYPE_UNIX;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        return static::getType() === self::TYPE_UNIX;
    }

    /**
     * Checks whether PHP is running on a Windows platform
     *
     * @return  bool    True when PHP is running on a Windows platform, false otherwise.
     */
    public static function isWindows() : bool
    {
        // Return the cached result if it's already available.
        if (null !== static::$type) {
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
            return static::$type === self::TYPE_WINDOWS;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        return static::getType() === self::TYPE_WINDOWS;
    }

    /**
     * Checks whether PHP is running on a BSD platform
     *
     * @return  bool    True when PHP is running on a BSD platform, false otherwise.
     */
    public static function isBsd() : bool
    {
        // Return the cached result if it's already available.
        if (null !== static::$type) {
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
            return static::$type === self::TYPE_BSD;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        return static::getType() === self::TYPE_BSD;
    }

    /**
     * Checks whether PHP is running on a Darwin platform
     *
     * @return  bool    True when PHP is running on a Darwin platform, false otherwise.
     */
    public static function isDarwin() : bool
    {
        // Return the cached result if it's already available.
        if (null !== static::$type) {
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
            return static::$type === self::TYPE_DARWIN;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        return static::getType() === self::TYPE_DARWIN;
    }

    /**
     * Checks whether PHP is running on a Cygwin platform
     *
     * @return  bool    True when PHP is running on a Cygwin platform, false otherwise.
     */
    public static function isCygwin() : bool
    {
        // Return the cached result if it's already available.
        if (null !== static::$type) {
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
            return static::$type === self::TYPE_CYGWIN;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        return static::getType() === self::TYPE_CYGWIN;
    }

    /**
     * Returns the path to the given shell's binary or null when it is not available.
     *
     * @param   string          $name
     * @return  string|null
     */
    public static function getShell(string $name)
    {
        return static::getShells()[$name] ?? null;
    }

    /**
     * Checks whether a shell of the given name is available in the system.
     *
     * @param   string  $name
     * @return  bool
     */
    public static function hasShell(string $name) : bool
    {
        return isset(static::getShells()[$name]);
    }

    /**
     * Returns an array of shell names and the paths to their binaries once populated. Will return an empty
     * array on unsupported platforms (Windows).
     *
     * @return  array
     */
    public static function getShells() : array
    {
        // Return the cached result if it's already available.
        if (static::$shells !== null) {
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
            return static::$shells;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        // Ensure this method will be ran once at most.
        static::$shells = [];
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}

        // Can't easily check on Windows even if Cygwin or the likes are available.
        if (static::isWindows()) {
            return static::$shells;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        if (file_exists($file = '/etc/shells')) {
            $cat = trim(shell_exec('cat '.$file.' 2> /dev/null'));

            foreach (explode(PHP_EOL, $cat) as $path) {
                // Ignore this line if it doesn't begin with a filepath.
                if ($path[0] != '/') {
                    continue;
                }

                $name = substr($path, strrpos($path, '/') + 1);

                static::$shells[$name] = $path;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
            }
        }

        return static::$shells;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
    }

    /**
     * Checks whether this platform has the 'stty' binary.
     *
     * @return  bool    True when 'stty' is available on this platform, false otherwise (always false on Windows).
     */
    public static function hasStty() : bool
    {
        // Return the cached result if it's already available.
        if (static::$hasStty !== null) {
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
            return static::$hasStty;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        // Definitely no Stty on Windows.
        if (static::isWindows()) {
            return static::$hasStty = false;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
        }

        // Run a simple exec() call and check whether it returned with an error code.
        exec('/usr/bin/env stty', $output, $exitCode);

        return static::$hasStty = $exitCode === 0;
class YourClass
{
    private static $someVariable;

    public static function getSomeVariable()
    {
        return static::$someVariable;
    }
}
    }
}


1			<?php namespace nyx\utils;
2
3			/**
4			* Platform
5			*
6			* Utilities related to the operating system PHP is running on, retrieving information about and executing
7			* system processes etc.
8			*
9			* Requires:
10			* - Function: shell_exec() (getting the shells available on this system)
11			* - Function: exec() (checking whether TTY is available on this system)
12			*
13			* @package Nyx\Utils\Platform
14			* @version 0.1.0
15			* @author Michal Chojnacki <[email protected]>
16			* @copyright 2012-2016 Nyx Dev Team
17			* @link http://docs.muyo.io/nyx/utils/platform.html
18			*/
19			class Platform
20			{
21			/**
22			* The traits of the Platform class.
23			*/
24			use traits\StaticallyExtendable;
25
26			/**
27			* Platform type constants.
28			*/
29			const TYPE_UNIX = 1;
30			const TYPE_WINDOWS = 2;
31			const TYPE_BSD = 3;
32			const TYPE_CYGWIN = 4;
33			const TYPE_DARWIN = 5;
34
35			/**
36			* @var int The platform PHP is running on.
37			*/
38			private static $type;
39
40			/**

unyx / utils

Issues (94)

Security Analysis no request data

Platform.php (28 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like