This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||||
2 | |||||||
3 | namespace Tests; |
||||||
4 | |||||||
5 | use App\Middleware\Api; |
||||||
6 | use Zend\Diactoros\Uri; |
||||||
7 | use tests\mocks\Delegate; |
||||||
8 | use App\Middleware\Database; |
||||||
9 | use PHPUnit\Framework\TestCase; |
||||||
10 | use Zend\Diactoros\CallbackStream; |
||||||
11 | use Zend\Diactoros\ServerRequestFactory; |
||||||
12 | use Zend\Diactoros\Response\JsonResponse; |
||||||
13 | |||||||
14 | class ApiTest extends TestCase |
||||||
15 | { |
||||||
16 | /** |
||||||
17 | * HTTP Api Request |
||||||
18 | * |
||||||
19 | * @return void |
||||||
20 | */ |
||||||
21 | protected $request; |
||||||
22 | |||||||
23 | /** |
||||||
24 | * The API middleware. |
||||||
25 | * |
||||||
26 | * @var App\Middleware\Api |
||||||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||||||
27 | */ |
||||||
28 | protected $api; |
||||||
29 | |||||||
30 | /** |
||||||
31 | * The PDO isntance from Eloquent. |
||||||
32 | * |
||||||
33 | * @var \PDO |
||||||
34 | */ |
||||||
35 | protected $db; |
||||||
36 | |||||||
37 | /** |
||||||
38 | * Initialize our api and request. |
||||||
39 | * |
||||||
40 | * @return void |
||||||
41 | */ |
||||||
42 | public function setUp(): void |
||||||
43 | { |
||||||
44 | require_once __DIR__ . "/../app/helpers.php"; |
||||||
45 | $config = config('tests/samples/config.php'); |
||||||
46 | $this->api = new Api(); |
||||||
0 ignored issues
–
show
It seems like
new App\Middleware\Api() of type App\Middleware\Api is incompatible with the declared type Tests\App\Middleware\Api of property $api .
Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property. Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property.. ![]() |
|||||||
47 | $this->request = ServerRequestFactory::fromGlobals( |
||||||
48 | $server = [ |
||||||
49 | 'REQUEST_METHOD' => 'GET', |
||||||
50 | 'REQUEST_URI' => '/redirects' |
||||||
51 | ], |
||||||
52 | $query = [], |
||||||
53 | $body = [ |
||||||
54 | '' |
||||||
55 | ], |
||||||
56 | $cookies = [], |
||||||
57 | $files = [] |
||||||
58 | ); |
||||||
59 | $request = $this->request->withAttribute('config', config()); |
||||||
60 | |||||||
61 | // Setup the database connection |
||||||
62 | touch($config['database']['database']); |
||||||
63 | $delegate = new Delegate(); |
||||||
64 | $database = new Database(); |
||||||
65 | $database->process($request, $delegate); |
||||||
66 | $this->request = $delegate->getRequest(); |
||||||
0 ignored issues
–
show
Are you sure the assignment to
$this->request is correct as $delegate->getRequest() targeting tests\mocks\Delegate::getRequest() seems to always return null.
This check looks for function or method calls that always return null and whose return value is assigned to a variable. class A
{
function getObject()
{
return null;
}
}
$a = new A();
$object = $a->getObject();
The method The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes. ![]() |
|||||||
67 | $this->db = $this->request->getAttribute('capsule')->getConnection()->getPdo(); |
||||||
68 | $this->db->query("CREATE TABLE `redirects` ( |
||||||
69 | `id` INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, |
||||||
70 | `hash` TEXT NOT NULL, |
||||||
71 | `redirect_to` TEXT NOT NULL, |
||||||
72 | `count` INTEGER NOT NULL DEFAULT 0, |
||||||
73 | `created_at` TEXT NOT NULL, |
||||||
74 | `updated_at` TEXT NOT NULL |
||||||
75 | );"); |
||||||
76 | $this->api->setRequest($this->request); |
||||||
0 ignored issues
–
show
$this->request of type void is incompatible with the type Psr\Http\Message\ServerRequestInterface expected by parameter $request of App\Middleware\Api::setRequest() .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
77 | } |
||||||
78 | |||||||
79 | /** |
||||||
80 | * Set up and tear down the database. |
||||||
81 | * |
||||||
82 | * @return void |
||||||
83 | */ |
||||||
84 | public function tearDown(): void |
||||||
85 | { |
||||||
86 | unlink($this->request->getAttribute('config')['database']['database']); |
||||||
87 | } |
||||||
88 | |||||||
89 | /** |
||||||
90 | * Tests the view importer. |
||||||
91 | * |
||||||
92 | * @return void |
||||||
93 | */ |
||||||
94 | public function testRoute(): void |
||||||
95 | { |
||||||
96 | $path = $this->api->getRequest()->getAttribute('route'); |
||||||
97 | $this->assertEquals('GET /redirects', $path); |
||||||
98 | } |
||||||
99 | |||||||
100 | /** |
||||||
101 | * Tests requests dont pass if they are not apis. |
||||||
102 | * |
||||||
103 | * @return void |
||||||
104 | */ |
||||||
105 | public function testNotApi(): void |
||||||
106 | { |
||||||
107 | $this->assertFalse($this->api->isApi()); |
||||||
108 | } |
||||||
109 | |||||||
110 | /** |
||||||
111 | * Tests requests that are apis pass the test. |
||||||
112 | * |
||||||
113 | * @return void |
||||||
114 | */ |
||||||
115 | public function testIsApi(): void |
||||||
116 | { |
||||||
117 | $request = $this->request->withHeader('Authorization', 'testing'); |
||||||
118 | $this->api->setRequest($request); |
||||||
119 | $this->assertTrue($this->api->isApi()); |
||||||
120 | } |
||||||
121 | |||||||
122 | /** |
||||||
123 | * Test the authorization method fails. |
||||||
124 | * |
||||||
125 | * @return void |
||||||
126 | */ |
||||||
127 | public function testNotAuthorized(): void |
||||||
128 | { |
||||||
129 | $this->assertFalse($this->api->isAuthorized()); |
||||||
130 | } |
||||||
131 | |||||||
132 | /** |
||||||
133 | * Test the authorization method succeeds. |
||||||
134 | * |
||||||
135 | * @return void |
||||||
136 | */ |
||||||
137 | public function testIsAuthorized(): void |
||||||
138 | { |
||||||
139 | $request = $this->request |
||||||
140 | ->withHeader('Authorization', 'Bearer 9575d687c61ce66fc190cd2bed464cef'); |
||||||
141 | $this->api->setRequest($request); |
||||||
142 | $this->assertTrue($this->api->isAuthorized()); |
||||||
143 | } |
||||||
144 | |||||||
145 | /** |
||||||
146 | * Test for failed authorization codes. |
||||||
147 | * |
||||||
148 | * @return void |
||||||
149 | */ |
||||||
150 | View Code Duplication | public function testFailedAuthorization(): void |
|||||
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||||||
151 | { |
||||||
152 | $request = $this->request->withHeader('Authorization', 'this-should-fail'); |
||||||
153 | $this->api->setRequest($request); |
||||||
154 | $response = $this->api->response(); |
||||||
155 | $this->assertInstanceOf(JsonResponse::class, $response); |
||||||
156 | $this->assertEquals(403, $response->getStatusCode()); |
||||||
157 | } |
||||||
158 | |||||||
159 | /** |
||||||
160 | * Test that the show method returns json |
||||||
161 | * |
||||||
162 | * @return void |
||||||
163 | */ |
||||||
164 | View Code Duplication | public function testFailedCreate(): void |
|||||
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||||||
165 | { |
||||||
166 | $request = $this->request |
||||||
167 | ->withMethod('POST') |
||||||
168 | ->withHeader('Authorization', 'Bearer 9575d687c61ce66fc190cd2bed464cef'); |
||||||
169 | $this->api->setRequest($request); |
||||||
170 | $response = $this->api->response(); |
||||||
171 | $this->assertInstanceOf(JsonResponse::class, $response); |
||||||
172 | $this->assertEquals(400, $response->getStatusCode()); |
||||||
173 | } |
||||||
174 | |||||||
175 | /** |
||||||
176 | * Test that the show method returns json |
||||||
177 | * |
||||||
178 | * @return void |
||||||
179 | */ |
||||||
180 | public function testSuccessCreate(): void |
||||||
181 | { |
||||||
182 | $request = $this->request |
||||||
183 | ->withMethod('POST') |
||||||
184 | ->withHeader('Authorization', 'Bearer 9575d687c61ce66fc190cd2bed464cef') |
||||||
185 | ->withAttribute('body', ['url' => 'http://example.com']); |
||||||
186 | $this->api->setRequest($request); |
||||||
187 | $response = $this->api->response(); |
||||||
188 | $results = $this->db->query( |
||||||
189 | 'SELECT * FROM `redirects` WHERE `redirect_to`="http://example.com"', |
||||||
190 | \PDO::FETCH_ASSOC |
||||||
0 ignored issues
–
show
The call to
PDO::query() has too many arguments starting with PDO::FETCH_ASSOC .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above. ![]() |
|||||||
191 | ); |
||||||
192 | $this->assertInstanceOf(JsonResponse::class, $response); |
||||||
193 | $this->assertEquals(200, $response->getStatusCode()); |
||||||
194 | $this->assertEquals(1, count($results)); |
||||||
195 | } |
||||||
196 | |||||||
197 | /** |
||||||
198 | * Test retrieving a list of all |
||||||
199 | * |
||||||
200 | * @return void |
||||||
201 | */ |
||||||
202 | public function testShow(): void |
||||||
203 | { |
||||||
204 | $request = $this->request |
||||||
205 | ->withMethod('GET') |
||||||
206 | ->withHeader('Authorization', 'Bearer 9575d687c61ce66fc190cd2bed464cef'); |
||||||
207 | $this->api->setRequest($request); |
||||||
208 | $response = $this->api->response(); |
||||||
209 | $this->assertInstanceOf(JsonResponse::class, $response); |
||||||
210 | $this->assertEquals(200, $response->getStatusCode()); |
||||||
211 | $this->assertTrue(is_array(json_decode($response->getBody(), true))); |
||||||
212 | } |
||||||
213 | |||||||
214 | /** |
||||||
215 | * Test for 404 responses. |
||||||
216 | * |
||||||
217 | * @return void |
||||||
218 | */ |
||||||
219 | View Code Duplication | public function testNotFound(): void |
|||||
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||||||
220 | { |
||||||
221 | $request = $this->request |
||||||
222 | ->withMethod('GET') |
||||||
223 | ->withUri(new Uri('http://www.example.com/pizza')) |
||||||
224 | ->withHeader('Authorization', 'Bearer 9575d687c61ce66fc190cd2bed464cef'); |
||||||
225 | $this->api->setRequest($request); |
||||||
226 | $response = $this->api->response(); |
||||||
227 | $this->assertEquals(404, $response->getStatusCode()); |
||||||
228 | } |
||||||
229 | |||||||
230 | /** |
||||||
231 | * Test the middleware delegate. |
||||||
232 | * |
||||||
233 | * @return void |
||||||
234 | */ |
||||||
235 | public function testMiddlewareDelegate(): void |
||||||
236 | { |
||||||
237 | $request = $this->request->withoutHeader('Authorization'); |
||||||
238 | $delegate = new Delegate(); |
||||||
239 | $this->api->process($request, $delegate); |
||||||
240 | |||||||
241 | $this->assertEquals($this->api->getRequest(), $delegate->getRequest()); |
||||||
0 ignored issues
–
show
Are you sure the usage of
$delegate->getRequest() targeting tests\mocks\Delegate::getRequest() seems to always return null.
This check looks for function or method calls that always return null and whose return value is used. class A
{
function getObject()
{
return null;
}
}
$a = new A();
if ($a->getObject()) {
The method The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes. ![]() |
|||||||
242 | } |
||||||
243 | } |
||||||
244 |