Issues in StubObject.php (master) - Issues in master - wikimedia/mediawiki - Measure and Improve Code Quality continuously with Scrutinizer

Issues (4122)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/StubObject.php (2 issues)

Labels

Coding Style 2

Severity

Minor 2

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/**
 * Delayed loading of global objects.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; if not, write to the Free Software Foundation, Inc.,
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 * http://www.gnu.org/copyleft/gpl.html
 *
 * @file
 */

/**
 * Class to implement stub globals, which are globals that delay loading the
 * their associated module code by deferring initialisation until the first
 * method call.
 *
 * Note on reference parameters:
 *
 * If the called method takes any parameters by reference, the __call magic
 * here won't work correctly. The solution is to unstub the object before
 * calling the method.
 *
 * Note on unstub loops:
 *
 * Unstub loops (infinite recursion) sometimes occur when a constructor calls
 * another function, and the other function calls some method of the stub. The
 * best way to avoid this is to make constructors as lightweight as possible,
 * deferring any initialisation which depends on other modules. As a last
 * resort, you can use StubObject::isRealObject() to break the loop, but as a
 * general rule, the stub object mechanism should be transparent, and code
 * which refers to it should be kept to a minimum.
 */
class StubObject {
	/** @var null|string */
	protected $global;

	/** @var null|string */
	protected $class;

	/** @var null|callable */
	protected $factory;

	/** @var array */
	protected $params;

	/**
	 * Constructor.
	 *
	 * @param string $global Name of the global variable.
	 * @param string|callable $class Name of the class of the real object
	 *                               or a factory function to call
	 * @param array $params Parameters to pass to constructor of the real object.
	 */
	public function __construct( $global = null, $class = null, $params = [] ) {
		$this->global = $global;
		if ( is_callable( $class ) ) {
			$this->factory = $class;
		} else {
			$this->class = $class;
		}
		$this->params = $params;
	}

	/**
	 * Returns a bool value whenever $obj is a stub object. Can be used to break
	 * a infinite loop when unstubbing an object.
	 *
	 * @param object $obj Object to check.
	 * @return bool True if $obj is not an instance of StubObject class.
	 */
	public static function isRealObject( $obj ) {
		return is_object( $obj ) && !$obj instanceof StubObject;
	}

	/**
	 * Unstubs an object, if it is a stub object. Can be used to break a
	 * infinite loop when unstubbing an object or to avoid reference parameter
	 * breakage.
	 *
	 * @param object $obj Object to check.
	 * @return void
	 */
	public static function unstub( &$obj ) {
		if ( $obj instanceof StubObject ) {
			$obj = $obj->_unstub( 'unstub', 3 );
		}
	}

	/**
	 * Function called if any function exists with that name in this object.
	 * It is used to unstub the object. Only used internally, PHP will call
	 * self::__call() function and that function will call this function.
	 * This function will also call the function with the same name in the real
	 * object.
	 *
	 * @param string $name Name of the function called
	 * @param array $args Arguments
	 * @return mixed
	 */
	public function _call( $name, $args ) {
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
		$this->_unstub( $name, 5 );
		return call_user_func_array( [ $GLOBALS[$this->global], $name ], $args );
	}

	/**
	 * Create a new object to replace this stub object.
	 * @return object
	 */
	public function _newObject() {
		$params = $this->factory
			? [ 'factory' => $this->factory ]
			: [ 'class' => $this->class ];
		return ObjectFactory::getObjectFromSpec( $params + [
			'args' => $this->params,
			'closure_expansion' => false,
		] );
	}

	/**
	 * Function called by PHP if no function with that name exists in this
	 * object.
	 *
	 * @param string $name Name of the function called
	 * @param array $args Arguments
	 * @return mixed
	 */
	public function __call( $name, $args ) {
		return $this->_call( $name, $args );
	}

	/**
	 * This function creates a new object of the real class and replace it in
	 * the global variable.
	 * This is public, for the convenience of external callers wishing to access
	 * properties, e.g. eval.php
	 *
	 * @param string $name Name of the method called in this object.
	 * @param int $level Level to go in the stack trace to get the function
	 *   who called this function.
	 * @return object The unstubbed version of itself
	 * @throws MWException
	 */
	public function _unstub( $name = '_unstub', $level = 2 ) {
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
		static $recursionLevel = 0;

		if ( !$GLOBALS[$this->global] instanceof StubObject ) {
			return $GLOBALS[$this->global]; // already unstubbed.
		}

		if ( get_class( $GLOBALS[$this->global] ) != $this->class ) {
			$caller = wfGetCaller( $level );
			if ( ++$recursionLevel > 2 ) {
				throw new MWException( "Unstub loop detected on call of "
					. "\${$this->global}->$name from $caller\n" );
			}
			wfDebug( "Unstubbing \${$this->global} on call of "
				. "\${$this->global}::$name from $caller\n" );
			$GLOBALS[$this->global] = $this->_newObject();
			--$recursionLevel;
			return $GLOBALS[$this->global];
		}
	}
}

/**
 * Stub object for the user language. Assigned to the $wgLang global.
 */
class StubUserLang extends StubObject {

	public function __construct() {
		parent::__construct( 'wgLang' );
	}

	/**
	 * Call Language::findVariantLink after unstubbing $wgLang.
	 *
	 * This method is implemented with a full signature rather than relying on
	 * __call so that the pass-by-reference signature of the proxied method is
	 * honored.
	 *
	 * @param string &$link The name of the link
	 * @param Title &$nt The title object of the link
	 * @param bool $ignoreOtherCond To disable other conditions when
	 *   we need to transclude a template or update a category's link
	 */
	public function findVariantLink( &$link, &$nt, $ignoreOtherCond = false ) {
		global $wgLang;
		$this->_unstub( 'findVariantLink', 3 );
		$wgLang->findVariantLink( $link, $nt, $ignoreOtherCond );
	}

	/**
	 * @return Language
	 */
	public function _newObject() {
		return RequestContext::getMain()->getLanguage();
	}
}


1			<?php
2			/**
3			* Delayed loading of global objects.
4			*
5			* This program is free software; you can redistribute it and/or modify
6			* it under the terms of the GNU General Public License as published by
7			* the Free Software Foundation; either version 2 of the License, or
8			* (at your option) any later version.
9			*
10			* This program is distributed in the hope that it will be useful,
11			* but WITHOUT ANY WARRANTY; without even the implied warranty of
12			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13			* GNU General Public License for more details.
14			*
15			* You should have received a copy of the GNU General Public License along
16			* with this program; if not, write to the Free Software Foundation, Inc.,
17			* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18			* http://www.gnu.org/copyleft/gpl.html
19			*
20			* @file
21			*/
22
23			/**
24			* Class to implement stub globals, which are globals that delay loading the
25			* their associated module code by deferring initialisation until the first
26			* method call.
27			*
28			* Note on reference parameters:
29			*
30			* If the called method takes any parameters by reference, the __call magic
31			* here won't work correctly. The solution is to unstub the object before
32			* calling the method.
33			*
34			* Note on unstub loops:
35			*
36			* Unstub loops (infinite recursion) sometimes occur when a constructor calls
37			* another function, and the other function calls some method of the stub. The
38			* best way to avoid this is to make constructors as lightweight as possible,
39			* deferring any initialisation which depends on other modules. As a last
40			* resort, you can use StubObject::isRealObject() to break the loop, but as a
41			* general rule, the stub object mechanism should be transparent, and code
42			* which refers to it should be kept to a minimum.
43			*/
44			class StubObject {
45			/** @var null\|string */
46			protected $global;
47
48			/** @var null\|string */
49			protected $class;
50
51			/** @var null\|callable */
52			protected $factory;
53
54			/** @var array */
55			protected $params;
56
57			/**
58			* Constructor.
59			*
60			* @param string $global Name of the global variable.
61			* @param string\|callable $class Name of the class of the real object
62			* or a factory function to call
63			* @param array $params Parameters to pass to constructor of the real object.
64			*/
65			public function __construct( $global = null, $class = null, $params = [] ) {
66			$this->global = $global;
67			if ( is_callable( $class ) ) {
68			$this->factory = $class;
69			} else {
70			$this->class = $class;
71			}
72			$this->params = $params;
73			}
74
75			/**
76			* Returns a bool value whenever $obj is a stub object. Can be used to break
77			* a infinite loop when unstubbing an object.
78			*
79			* @param object $obj Object to check.
80			* @return bool True if $obj is not an instance of StubObject class.
81			*/
82			public static function isRealObject( $obj ) {
83			return is_object( $obj ) && !$obj instanceof StubObject;
84			}
85
86			/**
87			* Unstubs an object, if it is a stub object. Can be used to break a
88			* infinite loop when unstubbing an object or to avoid reference parameter
89			* breakage.
90			*
91			* @param object $obj Object to check.
92			* @return void
93			*/
94			public static function unstub( &$obj ) {
95			if ( $obj instanceof StubObject ) {
96			$obj = $obj->_unstub( 'unstub', 3 );
97			}
98			}
99
100			/**
101			* Function called if any function exists with that name in this object.
102			* It is used to unstub the object. Only used internally, PHP will call
103			* self::__call() function and that function will call this function.
104			* This function will also call the function with the same name in the real
105			* object.
106			*
107			* @param string $name Name of the function called
108			* @param array $args Arguments
109			* @return mixed
110			*/
111			public function _call( $name, $args ) {
			0 ignored issues – show Coding Style introduced 2016-01-16 18:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this `_call` uses the super-global variable `$GLOBALS` which is generally not recommended. Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad class Router { public function generate($path) { return $_SERVER['HOST'].$path; } } // Better class Router { private $host; public function __construct($host) { $this->host = $host; } public function generate($path) { return $this->host.$path; } } class Controller { public function myAction(Request $request) { // Instead of $page = isset($_GET['page']) ? intval($_GET['page']) : 1; // Better (assuming you use the Symfony2 request) $page = $request->query->get('page', 1); } } Loading history...
112			$this->_unstub( $name, 5 );
113			return call_user_func_array( [ $GLOBALS[$this->global], $name ], $args );
114			}
115
116			/**
117			* Create a new object to replace this stub object.
118			* @return object
119			*/
120			public function _newObject() {
121			$params = $this->factory
122			? [ 'factory' => $this->factory ]
123			: [ 'class' => $this->class ];
124			return ObjectFactory::getObjectFromSpec( $params + [
125			'args' => $this->params,
126			'closure_expansion' => false,
127			] );
128			}
129
130			/**
131			* Function called by PHP if no function with that name exists in this
132			* object.
133			*
134			* @param string $name Name of the function called
135			* @param array $args Arguments
136			* @return mixed
137			*/
138			public function __call( $name, $args ) {
139			return $this->_call( $name, $args );
140			}
141
142			/**
143			* This function creates a new object of the real class and replace it in
144			* the global variable.
145			* This is public, for the convenience of external callers wishing to access
146			* properties, e.g. eval.php
147			*
148			* @param string $name Name of the method called in this object.
149			* @param int $level Level to go in the stack trace to get the function
150			* who called this function.
151			* @return object The unstubbed version of itself
152			* @throws MWException
153			*/
154			public function _unstub( $name = '_unstub', $level = 2 ) {
			0 ignored issues – show Coding Style introduced 2016-01-16 18:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this `_unstub` uses the super-global variable `$GLOBALS` which is generally not recommended. Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad class Router { public function generate($path) { return $_SERVER['HOST'].$path; } } // Better class Router { private $host; public function __construct($host) { $this->host = $host; } public function generate($path) { return $this->host.$path; } } class Controller { public function myAction(Request $request) { // Instead of $page = isset($_GET['page']) ? intval($_GET['page']) : 1; // Better (assuming you use the Symfony2 request) $page = $request->query->get('page', 1); } } Loading history...
155			static $recursionLevel = 0;
156
157			if ( !$GLOBALS[$this->global] instanceof StubObject ) {
158			return $GLOBALS[$this->global]; // already unstubbed.
159			}
160
161			if ( get_class( $GLOBALS[$this->global] ) != $this->class ) {
162			$caller = wfGetCaller( $level );
163			if ( ++$recursionLevel > 2 ) {
164			throw new MWException( "Unstub loop detected on call of "
165			. "\${$this->global}->$name from $caller\n" );
166			}
167			wfDebug( "Unstubbing \${$this->global} on call of "
168			. "\${$this->global}::$name from $caller\n" );
169			$GLOBALS[$this->global] = $this->_newObject();
170			--$recursionLevel;
171			return $GLOBALS[$this->global];
172			}
173			}
174			}
175
176			/**
177			* Stub object for the user language. Assigned to the $wgLang global.
178			*/
179			class StubUserLang extends StubObject {
180
181			public function __construct() {
182			parent::__construct( 'wgLang' );
183			}
184
185			/**
186			* Call Language::findVariantLink after unstubbing $wgLang.
187			*
188			* This method is implemented with a full signature rather than relying on
189			* __call so that the pass-by-reference signature of the proxied method is
190			* honored.
191			*
192			* @param string &$link The name of the link
193			* @param Title &$nt The title object of the link
194			* @param bool $ignoreOtherCond To disable other conditions when
195			* we need to transclude a template or update a category's link
196			*/
197			public function findVariantLink( &$link, &$nt, $ignoreOtherCond = false ) {
198			global $wgLang;
199			$this->_unstub( 'findVariantLink', 3 );
200			$wgLang->findVariantLink( $link, $nt, $ignoreOtherCond );
201			}
202
203			/**
204			* @return Language
205			*/
206			public function _newObject() {
207			return RequestContext::getMain()->getLanguage();
208			}
209			}
210

wikimedia / mediawiki

Issues (4122)

Security Analysis not enabled

includes/StubObject.php (2 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like