wearebraid /
shorten
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||
| 2 | |||
| 3 | namespace App\Middleware; |
||
| 4 | |||
| 5 | use App\Models\Redirect; |
||
|
0 ignored issues
–
show
|
|||
| 6 | use Zend\Diactoros\Response\JsonResponse; |
||
| 7 | use Psr\Http\Message\ServerRequestInterface; |
||
| 8 | use Interop\Http\ServerMiddleware\DelegateInterface; |
||
| 9 | use Interop\Http\ServerMiddleware\MiddlewareInterface; |
||
| 10 | |||
| 11 | class Api implements MiddlewareInterface |
||
| 12 | { |
||
| 13 | /** |
||
| 14 | * The request object. |
||
| 15 | * |
||
| 16 | * @var Psr\Http\Message\ServerRequestInterface |
||
|
0 ignored issues
–
show
|
|||
| 17 | */ |
||
| 18 | protected $request; |
||
| 19 | /** |
||
| 20 | * Return the current request. |
||
| 21 | * |
||
| 22 | * @return Psr\Http\Message\ServerRequestInterface |
||
| 23 | */ |
||
| 24 | 2 | public function getRequest() |
|
| 25 | { |
||
| 26 | 2 | return $this->request; |
|
| 27 | } |
||
| 28 | |||
| 29 | /** |
||
| 30 | * Set the current request object. |
||
| 31 | * |
||
| 32 | * @return void |
||
| 33 | */ |
||
| 34 | 11 | public function setRequest(ServerRequestInterface $request) |
|
| 35 | { |
||
| 36 | 11 | $route = strtoupper($request->getMethod()) . ' ' . strtolower($request->getUri()->getPath()); |
|
| 37 | 11 | $this->request = $request->withAttribute('route', $route); |
|
|
0 ignored issues
–
show
It seems like
$request->withAttribute('route', $route) of type Psr\Http\Message\ServerRequestInterface is incompatible with the declared type App\Middleware\Psr\Http\...\ServerRequestInterface of property $request.
Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property. Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property.. Loading history...
|
|||
| 38 | 11 | } |
|
| 39 | |||
| 40 | /** |
||
| 41 | * Checks if the current request is an authorized api request. |
||
| 42 | * |
||
| 43 | * @return boolean |
||
| 44 | */ |
||
| 45 | 3 | public function isApi() |
|
| 46 | { |
||
| 47 | 3 | $this->request = $this->request->withAttribute('isApi', !!$this->request->getHeaderLine('Authorization')); |
|
| 48 | 3 | return $this->request->getAttribute('isApi'); |
|
| 49 | } |
||
| 50 | |||
| 51 | /** |
||
| 52 | * Check if the current request is authorized for api access. |
||
| 53 | * |
||
| 54 | * @return boolean |
||
| 55 | */ |
||
| 56 | 7 | public function isAuthorized() |
|
| 57 | { |
||
| 58 | 7 | $auth = substr($this->request->getHeaderLine('Authorization'), 7); |
|
| 59 | 7 | return $this->request->getAttribute('config')['api_secret'] === $auth; |
|
| 60 | } |
||
| 61 | |||
| 62 | /** |
||
| 63 | * List all redirects. |
||
| 64 | * |
||
| 65 | * @return void |
||
| 66 | */ |
||
| 67 | 1 | public function show() |
|
| 68 | { |
||
| 69 | 1 | return new JsonResponse(Redirect::orderBy('created_at', 'DESC')->get()); |
|
|
0 ignored issues
–
show
|
|||
| 70 | } |
||
| 71 | |||
| 72 | /** |
||
| 73 | * Create a new redirect. |
||
| 74 | * |
||
| 75 | * @return App\Models\Create |
||
|
0 ignored issues
–
show
The type
App\Middleware\App\Models\Create was not found. Maybe you did not declare it correctly or list all dependencies?
The issue could also be caused by a filter entry in the build configuration.
If the path has been excluded in your configuration, e.g. filter:
dependency_paths: ["lib/*"]
For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths Loading history...
|
|||
| 76 | */ |
||
| 77 | 2 | public function create() |
|
| 78 | { |
||
| 79 | 2 | $body = $this->request->getAttribute('body'); |
|
| 80 | 2 | if (isset($body['url'])) { |
|
| 81 | 1 | return new JsonResponse(Redirect::createUnique($body['url'])); |
|
|
0 ignored issues
–
show
|
|||
| 82 | } |
||
| 83 | 1 | return new JsonResponse([ |
|
|
0 ignored issues
–
show
|
|||
| 84 | 1 | 'message' => 'Request must include json body with url property.' |
|
| 85 | 1 | ], 400); |
|
| 86 | } |
||
| 87 | |||
| 88 | /** |
||
| 89 | * Respond to the api request. |
||
| 90 | * |
||
| 91 | * @return Zend\Diactoros\Response\JsonResponse |
||
|
0 ignored issues
–
show
|
|||
| 92 | */ |
||
| 93 | 5 | public function response() |
|
| 94 | { |
||
| 95 | 5 | if ($this->isAuthorized()) { |
|
| 96 | 4 | switch ($this->request->getAttribute('route')) { |
|
| 97 | 4 | case "GET /redirects": |
|
| 98 | 1 | return $this->show(); |
|
|
0 ignored issues
–
show
Are you sure the usage of
$this->show() targeting App\Middleware\Api::show() seems to always return null.
This check looks for function or method calls that always return null and whose return value is used. class A
{
function getObject()
{
return null;
}
}
$a = new A();
if ($a->getObject()) {
The method The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes. Loading history...
|
|||
| 99 | 3 | case "POST /redirects": |
|
| 100 | 2 | return $this->create(); |
|
| 101 | default: |
||
| 102 | 1 | return new JsonResponse(['status' => 'No such api endpoint'], 404); |
|
|
0 ignored issues
–
show
|
|||
| 103 | } |
||
| 104 | } |
||
| 105 | 1 | return new JsonResponse(['message' => 'Not authorized'], 403); |
|
|
0 ignored issues
–
show
|
|||
| 106 | } |
||
| 107 | |||
| 108 | /** |
||
| 109 | * PSR-15 middleware callback |
||
| 110 | * |
||
| 111 | * @param ServerRequestInterface $request |
||
| 112 | * @param DelegateInterface $delegate |
||
| 113 | * @return Psr\Http\Message\ServerRequestInterface |
||
| 114 | */ |
||
| 115 | 1 | public function process(ServerRequestInterface $request, DelegateInterface $delegate) |
|
| 116 | { |
||
| 117 | 1 | $this->setRequest($request); |
|
| 118 | 1 | return ($this->isApi()) ? $this->response() : $delegate->process($this->getRequest()); |
|
|
0 ignored issues
–
show
|
|||
| 119 | } |
||
| 120 | } |
||
| 121 |
Let?s assume that you have a directory layout like this:
. |-- OtherDir | |-- Bar.php | `-- Foo.php `-- SomeDir `-- Foo.phpand let?s assume the following content of
Bar.php:If both files
OtherDir/Foo.phpandSomeDir/Foo.phpare loaded in the same runtime, you will see a PHP error such as the following:PHP Fatal error: Cannot use SomeDir\Foo as Foo because the name is already in use in OtherDir/Foo.phpHowever, as
OtherDir/Foo.phpdoes not necessarily have to be loaded and the error is only triggered if it is loaded beforeOtherDir/Bar.php, this problem might go unnoticed for a while. In order to prevent this error from surfacing, you must import the namespace with a different alias: