Issues (1236)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/psalm-refactor.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
require_once('command_functions.php');
3
4
use Psalm\Internal\Analyzer\ProjectAnalyzer;
5
use Psalm\Internal\IncludeCollector;
6
use Psalm\IssueBuffer;
7
use Psalm\Progress\DebugProgress;
8
use Psalm\Progress\DefaultProgress;
9
10
// show all errors
11
error_reporting(-1);
12
ini_set('display_errors', '1');
13
ini_set('display_startup_errors', '1');
14
ini_set('memory_limit', '8192M');
15
16
gc_collect_cycles();
17
gc_disable();
18
19
require_once __DIR__ . '/Psalm/Internal/exception_handler.php';
20
21
$args = array_slice($argv, 1);
22
23
$valid_short_options = ['f:', 'm', 'h', 'r:', 'c:'];
24
$valid_long_options = [
25
    'help', 'debug', 'debug-by-line', 'debug-emitted-issues', 'config:', 'root:',
26
    'threads:', 'move:', 'into:', 'rename:', 'to:',
27
];
28
29
// get options from command line
30
$options = getopt(implode('', $valid_short_options), $valid_long_options);
31
32
array_map(
33
    /**
34
     * @param string $arg
35
     *
36
     * @return void
37
     */
38 View Code Duplication
    function ($arg) use ($valid_long_options, $valid_short_options) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
39
        if (substr($arg, 0, 2) === '--' && $arg !== '--') {
40
            $arg_name = preg_replace('/=.*$/', '', substr($arg, 2));
41
42
            if ($arg_name === 'refactor') {
43
                // valid option for psalm, ignored by psalter
44
                return;
45
            }
46
47
            if (!in_array($arg_name, $valid_long_options)
48
                && !in_array($arg_name . ':', $valid_long_options)
49
                && !in_array($arg_name . '::', $valid_long_options)
50
            ) {
51
                fwrite(
52
                    STDERR,
53
                    'Unrecognised argument "--' . $arg_name . '"' . PHP_EOL
54
                    . 'Type --help to see a list of supported arguments'. PHP_EOL
55
                );
56
                exit(1);
57
            }
58
        } elseif (substr($arg, 0, 2) === '-' && $arg !== '-' && $arg !== '--') {
59
            $arg_name = preg_replace('/=.*$/', '', substr($arg, 1));
60
61
            if (!in_array($arg_name, $valid_short_options) && !in_array($arg_name . ':', $valid_short_options)) {
62
                fwrite(
63
                    STDERR,
64
                    'Unrecognised argument "-' . $arg_name . '"' . PHP_EOL
65
                    . 'Type --help to see a list of supported arguments'. PHP_EOL
66
                );
67
                exit(1);
68
            }
69
        }
70
    },
71
    $args
72
);
73
74
if (array_key_exists('help', $options)) {
75
    $options['h'] = false;
76
}
77
78
if (isset($options['config'])) {
79
    $options['c'] = $options['config'];
80
}
81
82 View Code Duplication
if (isset($options['c']) && is_array($options['c'])) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
83
    die('Too many config files provided' . PHP_EOL);
84
}
85
86
if (array_key_exists('h', $options)) {
87
    echo <<<HELP
88
Usage:
89
    psalm-refactor [options] [symbol1] into [symbol2]
90
91
Options:
92
    -h, --help
93
        Display this help message
94
95
    --debug, --debug-by-line, --debug-emitted-issues
96
        Debug information
97
98
    -c, --config=psalm.xml
99
        Path to a psalm.xml configuration file. Run psalm --init to create one.
100
101
    -r, --root
102
        If running Psalm globally you'll need to specify a project root. Defaults to cwd
103
104
    --threads=auto
105
        If greater than one, Psalm will run analysis on multiple threads, speeding things up.
106
        By default
107
108
    --move "[Identifier]" --into "[Class]"
109
        Moves the specified item into the class. More than one item can be moved into a class
110
        by passing a comma-separated list of values e.g.
111
112
        --move "Ns\Foo::bar,Ns\Foo::baz" --into "Biz\Bang\DestinationClass"
113
114
    --rename "[Identifier]" --to "[NewIdentifier]"
115
        Renames a specified item (e.g. method) and updates all references to it that Psalm can
116
        identify.
117
118
HELP;
119
120
    exit;
121
}
122
123
if (isset($options['root'])) {
124
    $options['r'] = $options['root'];
125
}
126
127
$current_dir = (string)getcwd() . DIRECTORY_SEPARATOR;
128
129 View Code Duplication
if (isset($options['r']) && is_string($options['r'])) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
130
    $root_path = realpath($options['r']);
131
132
    if (!$root_path) {
133
        die('Could not locate root directory ' . $current_dir . DIRECTORY_SEPARATOR . $options['r'] . PHP_EOL);
134
    }
135
136
    $current_dir = $root_path . DIRECTORY_SEPARATOR;
137
}
138
139
$vendor_dir = getVendorDir($current_dir);
140
141
require_once __DIR__ . '/Psalm/Internal/IncludeCollector.php';
142
$include_collector = new IncludeCollector();
143
$first_autoloader = $include_collector->runAndCollect(
144
    function () use ($current_dir, $options, $vendor_dir) {
145
        return requireAutoloaders($current_dir, isset($options['r']), $vendor_dir);
146
    }
147
);
148
149
// If Xdebug is enabled, restart without it
150
(new \Composer\XdebugHandler\XdebugHandler('PSALTER'))->check();
151
152
$path_to_config = get_path_to_config($options);
153
154
$args = getArguments();
155
156
$operation = null;
157
$last_arg = null;
158
159
$to_refactor = [];
160
161
foreach ($args as $arg) {
162
    if ($arg === '--move') {
163
        $operation = 'move';
164
        continue;
165
    }
166
167
    if ($arg === '--into') {
168
        if ($operation !== 'move' || !$last_arg) {
169
            die('--into is not expected here' . PHP_EOL);
170
        }
171
172
        $operation = 'move_into';
173
        continue;
174
    }
175
176
    if ($arg === '--rename') {
177
        $operation = 'rename';
178
        continue;
179
    }
180
181
    if ($arg === '--to') {
182
        if ($operation !== 'rename' || !$last_arg) {
183
            die('--to is not expected here' . PHP_EOL);
184
        }
185
186
        $operation = 'rename_to';
187
188
        continue;
189
    }
190
191
    if ($arg[0] === '-') {
192
        $operation = null;
193
        continue;
194
    }
195
196
    if ($operation === 'move_into' || $operation === 'rename_to') {
197
        if (!$last_arg) {
198
            die('Expecting a previous argument' . PHP_EOL);
199
        }
200
201
        if ($operation === 'move_into') {
202
            $last_arg_parts = preg_split('/, ?/', $last_arg);
203
204
            foreach ($last_arg_parts as $last_arg_part) {
205
                if (strpos($last_arg_part, '::')) {
206
                    list(, $identifier_name) = explode('::', $last_arg_part);
207
                    $to_refactor[$last_arg_part] = $arg . '::' . $identifier_name;
208
                } else {
209
                    $namespace_parts = explode('\\', $last_arg_part);
210
                    $class_name = end($namespace_parts);
211
                    $to_refactor[$last_arg_part] = $arg . '\\' . $class_name;
212
                }
213
            }
214
        } else {
215
            $to_refactor[$last_arg] = $arg;
216
        }
217
218
        $last_arg = null;
219
        $operation = null;
220
        continue;
221
    }
222
223
    if ($operation === 'move' || $operation === 'rename') {
224
        $last_arg = $arg;
225
226
        continue;
227
    }
228
229
    die('Unexpected argument "' . $arg . '"' . PHP_EOL);
230
}
231
232
if (!$to_refactor) {
233
    die('No --move or --rename arguments supplied' . PHP_EOL);
234
}
235
236
$config = initialiseConfig($path_to_config, $current_dir, \Psalm\Report::TYPE_CONSOLE, $first_autoloader);
237
$config->setIncludeCollector($include_collector);
238
239
if ($config->resolve_from_config_file) {
240
    $current_dir = $config->base_dir;
241
    chdir($current_dir);
242
}
243
244
$threads = isset($options['threads'])
245
    ? (int)$options['threads']
246
    : max(1, ProjectAnalyzer::getCpuCount() - 2);
247
248
$providers = new Psalm\Internal\Provider\Providers(
249
    new Psalm\Internal\Provider\FileProvider(),
250
    new Psalm\Internal\Provider\ParserCacheProvider($config, false),
251
    new Psalm\Internal\Provider\FileStorageCacheProvider($config),
252
    new Psalm\Internal\Provider\ClassLikeStorageCacheProvider($config),
253
    null,
254
    new Psalm\Internal\Provider\ProjectCacheProvider($current_dir . DIRECTORY_SEPARATOR . 'composer.lock')
255
);
256
257
$debug = array_key_exists('debug', $options) || array_key_exists('debug-by-line', $options);
258
$progress = $debug
259
    ? new DebugProgress()
260
    : new DefaultProgress();
261
262
if (array_key_exists('debug-emitted-issues', $options)) {
263
    $config->debug_emitted_issues = true;
264
}
265
266
$project_analyzer = new ProjectAnalyzer(
267
    $config,
268
    $providers,
269
    new \Psalm\Report\ReportOptions(),
270
    [],
271
    $threads,
272
    $progress
273
);
274
275
if (array_key_exists('debug-by-line', $options)) {
276
    $project_analyzer->debug_lines = true;
277
}
278
279
$config->visitComposerAutoloadFiles($project_analyzer);
280
281
$project_analyzer->refactorCodeAfterCompletion($to_refactor);
282
283
$start_time = microtime(true);
284
285
$project_analyzer->check($current_dir);
286
287
IssueBuffer::finish($project_analyzer, false, $start_time);
288