This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /* |
||
4 | * This file is part of the Webmozart JSON package. |
||
5 | * |
||
6 | * (c) Bernhard Schussek <[email protected]> |
||
7 | * |
||
8 | * For the full copyright and license information, please view the LICENSE |
||
9 | * file that was distributed with this source code. |
||
10 | */ |
||
11 | |||
12 | namespace Webmozart\Json; |
||
13 | |||
14 | use Seld\JsonLint\JsonParser; |
||
15 | use Seld\JsonLint\ParsingException; |
||
16 | |||
17 | /** |
||
18 | * Decodes JSON strings/files and validates against a JSON schema. |
||
19 | * |
||
20 | * @since 1.0 |
||
21 | * |
||
22 | * @author Bernhard Schussek <[email protected]> |
||
23 | */ |
||
24 | class JsonDecoder |
||
25 | { |
||
26 | /** |
||
27 | * Decode a JSON value as PHP object. |
||
28 | */ |
||
29 | const OBJECT = 0; |
||
30 | |||
31 | /** |
||
32 | * Decode a JSON value as associative array. |
||
33 | */ |
||
34 | const ASSOC_ARRAY = 1; |
||
35 | |||
36 | /** |
||
37 | * Decode a JSON value as float. |
||
38 | */ |
||
39 | const FLOAT = 2; |
||
40 | |||
41 | /** |
||
42 | * Decode a JSON value as string. |
||
43 | */ |
||
44 | const STRING = 3; |
||
45 | |||
46 | /** |
||
47 | * @var JsonValidator |
||
48 | */ |
||
49 | private $validator; |
||
50 | |||
51 | /** |
||
52 | * @var int |
||
53 | */ |
||
54 | private $objectDecoding = self::OBJECT; |
||
55 | |||
56 | /** |
||
57 | * @var int |
||
58 | */ |
||
59 | private $bigIntDecoding = self::FLOAT; |
||
60 | |||
61 | /** |
||
62 | * @var int |
||
63 | */ |
||
64 | private $maxDepth = 512; |
||
65 | |||
66 | /** |
||
67 | * Creates a new decoder. |
||
68 | * |
||
69 | * @param null|JsonValidator $validator |
||
70 | */ |
||
71 | 36 | public function __construct(JsonValidator $validator = null) |
|
72 | { |
||
73 | 36 | $this->validator = $validator ?: new JsonValidator(); |
|
74 | 36 | } |
|
75 | |||
76 | /** |
||
77 | * Decodes and validates a JSON string. |
||
78 | * |
||
79 | * If a schema is passed, the decoded object is validated against that |
||
80 | * schema. The schema may be passed as file path or as object returned from |
||
81 | * `JsonDecoder::decodeFile($schemaFile)`. |
||
82 | * |
||
83 | * You can adjust the decoding with {@link setObjectDecoding()}, |
||
84 | * {@link setBigIntDecoding()} and {@link setMaxDepth()}. |
||
85 | * |
||
86 | * Schema validation is not supported when objects are decoded as |
||
87 | * associative arrays. |
||
88 | * |
||
89 | * @param string $json The JSON string |
||
90 | * @param string|object $schema The schema file or object |
||
0 ignored issues
–
show
|
|||
91 | * |
||
92 | * @return mixed The decoded value |
||
93 | * |
||
94 | * @throws DecodingFailedException If the JSON string could not be decoded |
||
95 | * @throws ValidationFailedException If the decoded string fails schema |
||
96 | * validation |
||
97 | * @throws InvalidSchemaException If the schema is invalid |
||
98 | */ |
||
99 | 26 | public function decode($json, $schema = null) |
|
100 | { |
||
101 | 26 | if (self::ASSOC_ARRAY === $this->objectDecoding && null !== $schema) { |
|
102 | 1 | throw new \InvalidArgumentException( |
|
103 | 'Schema validation is not supported when objects are decoded '. |
||
104 | 'as associative arrays. Call '. |
||
105 | 1 | 'JsonDecoder::setObjectDecoding(JsonDecoder::JSON_OBJECT) to fix.' |
|
106 | ); |
||
107 | } |
||
108 | |||
109 | 25 | $decoded = $this->decodeJson($json); |
|
110 | |||
111 | 21 | if (null !== $schema) { |
|
112 | 7 | $errors = $this->validator->validate($decoded, $schema); |
|
113 | |||
114 | 6 | if (count($errors) > 0) { |
|
115 | 4 | throw ValidationFailedException::fromErrors($errors); |
|
116 | } |
||
117 | } |
||
118 | |||
119 | 16 | return $decoded; |
|
120 | } |
||
121 | |||
122 | /** |
||
123 | * Decodes and validates a JSON file. |
||
124 | * |
||
125 | * @param string $path The path to the JSON file |
||
126 | * @param string|object $schema The schema file or object |
||
0 ignored issues
–
show
Should the type for parameter
$schema not be string|object|null ?
This check looks for It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. ![]() |
|||
127 | * |
||
128 | * @return mixed The decoded file |
||
129 | * |
||
130 | * @throws FileNotFoundException If the file was not found |
||
131 | * @throws DecodingFailedException If the file could not be decoded |
||
132 | * @throws ValidationFailedException If the decoded file fails schema |
||
133 | * validation |
||
134 | * @throws InvalidSchemaException If the schema is invalid |
||
135 | * |
||
136 | * @see decode |
||
137 | */ |
||
138 | 7 | public function decodeFile($path, $schema = null) |
|
139 | { |
||
140 | 7 | if (!file_exists($path)) { |
|
141 | 1 | throw new FileNotFoundException(sprintf( |
|
142 | 1 | 'The file %s does not exist.', |
|
143 | $path |
||
144 | )); |
||
145 | } |
||
146 | |||
147 | 6 | $errorMessage = null; |
|
148 | 6 | $errorCode = 0; |
|
149 | |||
150 | 6 | set_error_handler(function ($errno, $errstr) use (&$errorMessage, &$errorCode) { |
|
151 | 1 | $errorMessage = $errstr; |
|
152 | 1 | $errorCode = $errno; |
|
153 | 6 | }); |
|
154 | |||
155 | 6 | $content = file_get_contents($path); |
|
156 | |||
157 | 6 | restore_error_handler(); |
|
158 | |||
159 | 6 | View Code Duplication | if (null !== $errorMessage) { |
160 | 1 | if (false !== $pos = strpos($errorMessage, '): ')) { |
|
161 | // cut "file_get_contents(%path%):" to make message more readable |
||
162 | 1 | $errorMessage = substr($errorMessage, $pos + 3); |
|
163 | } |
||
164 | |||
165 | 1 | throw new IOException(sprintf( |
|
166 | 1 | 'Could not read %s: %s (%s)', |
|
167 | $path, |
||
168 | $errorMessage, |
||
169 | $errorCode |
||
170 | ), $errorCode); |
||
171 | } |
||
172 | |||
173 | try { |
||
174 | 5 | return $this->decode($content, $schema); |
|
175 | 4 | } catch (DecodingFailedException $e) { |
|
176 | // Add the file name to the exception |
||
177 | 1 | throw new DecodingFailedException(sprintf( |
|
178 | 1 | 'An error happened while decoding %s: %s', |
|
179 | $path, |
||
180 | 1 | $e->getMessage() |
|
181 | 1 | ), $e->getCode(), $e); |
|
182 | 3 | } catch (ValidationFailedException $e) { |
|
183 | // Add the file name to the exception |
||
184 | 2 | throw new ValidationFailedException(sprintf( |
|
185 | 2 | "Validation of %s failed:\n%s", |
|
186 | $path, |
||
187 | 2 | $e->getErrorsAsString() |
|
188 | 2 | ), $e->getErrors(), $e->getCode(), $e); |
|
189 | 1 | } catch (InvalidSchemaException $e) { |
|
190 | // Add the file name to the exception |
||
191 | 1 | throw new InvalidSchemaException(sprintf( |
|
192 | 1 | 'An error happened while decoding %s: %s', |
|
193 | $path, |
||
194 | 1 | $e->getMessage() |
|
195 | 1 | ), $e->getCode(), $e); |
|
196 | } |
||
197 | } |
||
198 | |||
199 | /** |
||
200 | * Returns the maximum recursion depth. |
||
201 | * |
||
202 | * A depth of zero means that objects are not allowed. A depth of one means |
||
203 | * only one level of objects or arrays is allowed. |
||
204 | * |
||
205 | * @return int The maximum recursion depth |
||
206 | */ |
||
207 | public function getMaxDepth() |
||
208 | { |
||
209 | return $this->maxDepth; |
||
210 | } |
||
211 | |||
212 | /** |
||
213 | * Sets the maximum recursion depth. |
||
214 | * |
||
215 | * If the depth is exceeded during decoding, an {@link DecodingnFailedException} |
||
216 | * will be thrown. |
||
217 | * |
||
218 | * A depth of zero means that objects are not allowed. A depth of one means |
||
219 | * only one level of objects or arrays is allowed. |
||
220 | * |
||
221 | * @param int $maxDepth The maximum recursion depth |
||
222 | * |
||
223 | * @throws \InvalidArgumentException If the depth is not an integer greater |
||
224 | * than or equal to zero |
||
225 | */ |
||
226 | 6 | View Code Duplication | public function setMaxDepth($maxDepth) |
227 | { |
||
228 | 6 | if (!is_int($maxDepth)) { |
|
229 | 1 | throw new \InvalidArgumentException(sprintf( |
|
230 | 1 | 'The maximum depth should be an integer. Got: %s', |
|
231 | 1 | is_object($maxDepth) ? get_class($maxDepth) : gettype($maxDepth) |
|
232 | )); |
||
233 | } |
||
234 | |||
235 | 5 | if ($maxDepth < 1) { |
|
236 | 1 | throw new \InvalidArgumentException(sprintf( |
|
237 | 1 | 'The maximum depth should 1 or greater. Got: %s', |
|
238 | $maxDepth |
||
239 | )); |
||
240 | } |
||
241 | |||
242 | 4 | $this->maxDepth = $maxDepth; |
|
243 | 4 | } |
|
244 | |||
245 | /** |
||
246 | * Returns the decoding of JSON objects. |
||
247 | * |
||
248 | * @return int One of the constants {@link JSON_OBJECT} and {@link ASSOC_ARRAY} |
||
249 | */ |
||
250 | public function getObjectDecoding() |
||
251 | { |
||
252 | return $this->objectDecoding; |
||
253 | } |
||
254 | |||
255 | /** |
||
256 | * Sets the decoding of JSON objects. |
||
257 | * |
||
258 | * By default, JSON objects are decoded as instances of {@link \stdClass}. |
||
259 | * |
||
260 | * @param int $decoding One of the constants {@link JSON_OBJECT} and {@link ASSOC_ARRAY} |
||
261 | * |
||
262 | * @throws \InvalidArgumentException If the passed decoding is invalid |
||
263 | */ |
||
264 | 7 | View Code Duplication | public function setObjectDecoding($decoding) |
265 | { |
||
266 | 7 | if (self::OBJECT !== $decoding && self::ASSOC_ARRAY !== $decoding) { |
|
267 | 3 | throw new \InvalidArgumentException(sprintf( |
|
268 | 'Expected JsonDecoder::JSON_OBJECT or JsonDecoder::ASSOC_ARRAY. '. |
||
269 | 3 | 'Got: %s', |
|
270 | $decoding |
||
271 | )); |
||
272 | } |
||
273 | |||
274 | 4 | $this->objectDecoding = $decoding; |
|
275 | 4 | } |
|
276 | |||
277 | /** |
||
278 | * Returns the decoding of big integers. |
||
279 | * |
||
280 | * @return int One of the constants {@link FLOAT} and {@link JSON_STRING} |
||
281 | */ |
||
282 | public function getBigIntDecoding() |
||
283 | { |
||
284 | return $this->bigIntDecoding; |
||
285 | } |
||
286 | |||
287 | /** |
||
288 | * Sets the decoding of big integers. |
||
289 | * |
||
290 | * By default, big integers are decoded as floats. |
||
291 | * |
||
292 | * @param int $decoding One of the constants {@link FLOAT} and {@link JSON_STRING} |
||
293 | * |
||
294 | * @throws \InvalidArgumentException If the passed decoding is invalid |
||
295 | */ |
||
296 | 5 | View Code Duplication | public function setBigIntDecoding($decoding) |
297 | { |
||
298 | 5 | if (self::FLOAT !== $decoding && self::STRING !== $decoding) { |
|
299 | 3 | throw new \InvalidArgumentException(sprintf( |
|
300 | 'Expected JsonDecoder::FLOAT or JsonDecoder::JSON_STRING. '. |
||
301 | 3 | 'Got: %s', |
|
302 | $decoding |
||
303 | )); |
||
304 | } |
||
305 | |||
306 | 2 | $this->bigIntDecoding = $decoding; |
|
307 | 2 | } |
|
308 | |||
309 | 25 | private function decodeJson($json) |
|
310 | { |
||
311 | 25 | $assoc = self::ASSOC_ARRAY === $this->objectDecoding; |
|
312 | |||
313 | 25 | if (PHP_VERSION_ID >= 50400 && !defined('JSON_C_VERSION')) { |
|
314 | 25 | $options = self::STRING === $this->bigIntDecoding ? JSON_BIGINT_AS_STRING : 0; |
|
315 | |||
316 | 25 | $decoded = json_decode($json, $assoc, $this->maxDepth, $options); |
|
317 | } else { |
||
318 | $decoded = json_decode($json, $assoc, $this->maxDepth); |
||
319 | } |
||
320 | |||
321 | // Data could not be decoded |
||
322 | 25 | if (null === $decoded && 'null' !== $json) { |
|
323 | 4 | $parser = new JsonParser(); |
|
324 | 4 | $e = $parser->lint($json); |
|
325 | |||
326 | 4 | if ($e instanceof ParsingException) { |
|
327 | throw new DecodingFailedException(sprintf( |
||
328 | 'The JSON data could not be decoded: %s.', |
||
329 | $e->getMessage() |
||
330 | ), 0, $e); |
||
331 | } |
||
332 | |||
333 | // $e is null if json_decode() failed, but the linter did not find |
||
334 | // any problems. Happens for example when the max depth is exceeded. |
||
335 | 4 | throw new DecodingFailedException(sprintf( |
|
336 | 4 | 'The JSON data could not be decoded: %s.', |
|
337 | 4 | JsonError::getLastErrorMessage() |
|
338 | ), json_last_error()); |
||
339 | } |
||
340 | |||
341 | 21 | return $decoded; |
|
342 | } |
||
343 | } |
||
344 |
This check looks for
@param
annotations where the type inferred by our type inference engine differs from the declared type.It makes a suggestion as to what type it considers more descriptive.
Most often this is a case of a parameter that can be null in addition to its declared types.