This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||
2 | |||
3 | namespace App\Middleware; |
||
4 | |||
5 | use App\Models\Redirect; |
||
0 ignored issues
–
show
|
|||
6 | use Zend\Diactoros\Response\JsonResponse; |
||
7 | use Psr\Http\Message\ServerRequestInterface; |
||
8 | use Interop\Http\ServerMiddleware\DelegateInterface; |
||
9 | use Interop\Http\ServerMiddleware\MiddlewareInterface; |
||
10 | |||
11 | class Api implements MiddlewareInterface |
||
12 | { |
||
13 | /** |
||
14 | * The request object. |
||
15 | * |
||
16 | * @var Psr\Http\Message\ServerRequestInterface |
||
0 ignored issues
–
show
|
|||
17 | */ |
||
18 | protected $request; |
||
19 | /** |
||
20 | * Return the current request. |
||
21 | * |
||
22 | * @return Psr\Http\Message\ServerRequestInterface |
||
23 | */ |
||
24 | 2 | public function getRequest() |
|
25 | { |
||
26 | 2 | return $this->request; |
|
27 | } |
||
28 | |||
29 | /** |
||
30 | * Set the current request object. |
||
31 | * |
||
32 | * @return void |
||
33 | */ |
||
34 | 11 | public function setRequest(ServerRequestInterface $request) |
|
35 | { |
||
36 | 11 | $route = strtoupper($request->getMethod()) . ' ' . strtolower($request->getUri()->getPath()); |
|
37 | 11 | $this->request = $request->withAttribute('route', $route); |
|
0 ignored issues
–
show
It seems like
$request->withAttribute('route', $route) of type Psr\Http\Message\ServerRequestInterface is incompatible with the declared type App\Middleware\Psr\Http\...\ServerRequestInterface of property $request .
Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property. Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property.. ![]() |
|||
38 | 11 | } |
|
39 | |||
40 | /** |
||
41 | * Checks if the current request is an authorized api request. |
||
42 | * |
||
43 | * @return boolean |
||
44 | */ |
||
45 | 3 | public function isApi() |
|
46 | { |
||
47 | 3 | $this->request = $this->request->withAttribute('isApi', !!$this->request->getHeaderLine('Authorization')); |
|
48 | 3 | return $this->request->getAttribute('isApi'); |
|
49 | } |
||
50 | |||
51 | /** |
||
52 | * Check if the current request is authorized for api access. |
||
53 | * |
||
54 | * @return boolean |
||
55 | */ |
||
56 | 7 | public function isAuthorized() |
|
57 | { |
||
58 | 7 | $auth = substr($this->request->getHeaderLine('Authorization'), 7); |
|
59 | 7 | return $this->request->getAttribute('config')['api_secret'] === $auth; |
|
60 | } |
||
61 | |||
62 | /** |
||
63 | * List all redirects. |
||
64 | * |
||
65 | * @return void |
||
66 | */ |
||
67 | 1 | public function show() |
|
68 | { |
||
69 | 1 | return new JsonResponse(Redirect::orderBy('created_at', 'DESC')->get()); |
|
0 ignored issues
–
show
|
|||
70 | } |
||
71 | |||
72 | /** |
||
73 | * Create a new redirect. |
||
74 | * |
||
75 | * @return App\Models\Create |
||
0 ignored issues
–
show
The type
App\Middleware\App\Models\Create was not found. Maybe you did not declare it correctly or list all dependencies?
The issue could also be caused by a filter entry in the build configuration.
If the path has been excluded in your configuration, e.g. filter:
dependency_paths: ["lib/*"]
For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths ![]() |
|||
76 | */ |
||
77 | 2 | public function create() |
|
78 | { |
||
79 | 2 | $body = $this->request->getAttribute('body'); |
|
80 | 2 | if (isset($body['url'])) { |
|
81 | 1 | return new JsonResponse(Redirect::createUnique($body['url'])); |
|
0 ignored issues
–
show
|
|||
82 | } |
||
83 | 1 | return new JsonResponse([ |
|
0 ignored issues
–
show
|
|||
84 | 1 | 'message' => 'Request must include json body with url property.' |
|
85 | 1 | ], 400); |
|
86 | } |
||
87 | |||
88 | /** |
||
89 | * Respond to the api request. |
||
90 | * |
||
91 | * @return Zend\Diactoros\Response\JsonResponse |
||
0 ignored issues
–
show
|
|||
92 | */ |
||
93 | 5 | public function response() |
|
94 | { |
||
95 | 5 | if ($this->isAuthorized()) { |
|
96 | 4 | switch ($this->request->getAttribute('route')) { |
|
97 | 4 | case "GET /redirects": |
|
98 | 1 | return $this->show(); |
|
0 ignored issues
–
show
Are you sure the usage of
$this->show() targeting App\Middleware\Api::show() seems to always return null.
This check looks for function or method calls that always return null and whose return value is used. class A
{
function getObject()
{
return null;
}
}
$a = new A();
if ($a->getObject()) {
The method The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes. ![]() |
|||
99 | 3 | case "POST /redirects": |
|
100 | 2 | return $this->create(); |
|
101 | default: |
||
102 | 1 | return new JsonResponse(['status' => 'No such api endpoint'], 404); |
|
0 ignored issues
–
show
|
|||
103 | } |
||
104 | } |
||
105 | 1 | return new JsonResponse(['message' => 'Not authorized'], 403); |
|
0 ignored issues
–
show
|
|||
106 | } |
||
107 | |||
108 | /** |
||
109 | * PSR-15 middleware callback |
||
110 | * |
||
111 | * @param ServerRequestInterface $request |
||
112 | * @param DelegateInterface $delegate |
||
113 | * @return Psr\Http\Message\ServerRequestInterface |
||
114 | */ |
||
115 | 1 | public function process(ServerRequestInterface $request, DelegateInterface $delegate) |
|
116 | { |
||
117 | 1 | $this->setRequest($request); |
|
118 | 1 | return ($this->isApi()) ? $this->response() : $delegate->process($this->getRequest()); |
|
0 ignored issues
–
show
|
|||
119 | } |
||
120 | } |
||
121 |
Let?s assume that you have a directory layout like this:
and let?s assume the following content of
Bar.php
:If both files
OtherDir/Foo.php
andSomeDir/Foo.php
are loaded in the same runtime, you will see a PHP error such as the following:PHP Fatal error: Cannot use SomeDir\Foo as Foo because the name is already in use in OtherDir/Foo.php
However, as
OtherDir/Foo.php
does not necessarily have to be loaded and the error is only triggered if it is loaded beforeOtherDir/Bar.php
, this problem might go unnoticed for a while. In order to prevent this error from surfacing, you must import the namespace with a different alias: