HasSettings::setSettingsByRequest() - Code Metrics - Inspection of "New method: setSettingsByRequest" - zachleigh/laravel-property-bag - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Pull Request — master (#15)

unknown

created 2017-08-23 09:16 UTC

HasSettings::setSettingsByRequest() A

↳ Parent: HasSettings

Complexity

Conditions	1
Paths	1

Size

Total Lines	5
Code Lines	3

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
c	0
b	0
f	0
dl	0
loc	5
rs	9.4285
cc	1
eloc	3
nc	1
nop	0

<?php

namespace LaravelPropertyBag\Settings;

use LaravelPropertyBag\Helpers\NameResolver;
use LaravelPropertyBag\Exceptions\ResourceNotFound;

trait HasSettings
{
    /**
     * Instance of Settings.
     *
     * @var LaravelPropertyBag\Settings\Settings
     */
    protected $settings = null;

    /**
     * A resource has many settings in a property bag.
     *
     * @return \Illuminate\Database\Eloquent\Relations\MorphMany
     */
    public function propertyBag()
    {
        return $this->morphMany(PropertyBag::class, 'resource');
trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}
    }

    /**
     * If passed is string, get settings class for the resource or return value
     * for given key. If passed is array, set the key value pair.
     *
     * @param string|array $passed
     *
     * @return LaravelPropertyBag\Settings\Settings|mixed
     */
    public function settings($passed = null)
    {
        if (is_array($passed)) {
            return $this->setSettings($passed);
        } elseif (!is_null($passed)) {
            $settings = $this->getSettingsInstance();

            return $settings->get($passed);
        }

        return $this->getSettingsInstance();
    }

    /**
     * Get settings off this or create new instance.
     *
     * @return LaravelPropertyBag\Settings\Settings
     */
    protected function getSettingsInstance()
    {
        if (isset($this->settings)) {
            return $this->settings;
        }

        $settingsConfig = $this->getSettingsConfig();

        return $this->settings = new Settings($settingsConfig, $this);

    }

    /**
     * Get the settings class name.
     *
     * @throws ResourceNotFound
     *
     * @return LaravelPropertyBag\Settings\ResourceConfig
     */
    protected function getSettingsConfig()
    {
        if (isset($this->settingsConfig)) {
            $fullNamespace = $this->settingsConfig;

        } else {
            $className = $this->getShortClassName();

            $fullNamespace = NameResolver::makeConfigFileName($className);
        }

        if (class_exists($fullNamespace)) {
            return new $fullNamespace($this);
        }

        throw ResourceNotFound::resourceConfigNotFound($fullNamespace);
    }

    /**
     * Get the short name of the model.
     *
     * @return string
     */
    protected function getShortClassName()
    {
        $reflection = new \ReflectionClass($this);

        return $reflection->getShortName();
    }

    /**
     * Set settings.
     *
     * @param array $attributes
     *
     * @return LaravelPropertyBag\Settings\Settings
     */
    public function setSettings(array $attributes)
    {
        return $this->settings()->set($attributes);
    }

        /**
     * Set all allowed settings by Request.
     *
     * @return LaravelPropertyBag\Settings\Settings
     */
    public function setSettingsByRequest()
    {
        $allAllowedSettings = array_keys($this->allSettings()->toArray());
        return $this->settings()->set(request()->only($allAllowedSettings));
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
    }

    /**
     * Get all settings.
     *
     * @return \Illuminate\Support\Collection
     */
    public function allSettings()
    {
        return $this->settings()->all();
    }

    /**
     * Get all default settings or default setting for single key if given.
     *
     * @param string $key
     *
     * @return \Illuminate\Support\Collection|mixed
     */
    public function defaultSetting($key = null)
    {
        if (!is_null($key)) {
            return $this->settings()->getDefault($key);
        }

        return $this->settings()->allDefaults();
    }

    /**
     * Get all allowed settings or allowed settings for single ke if given.
     *
     * @param string $key
     *
     * @return \Illuminate\Support\Collection
     */
    public function allowedSetting($key = null)
    {
        if (!is_null($key)) {
            return $this->settings()->getAllowed($key);
        }

        return $this->settings()->allAllowed();
    }
}


1			<?php
2
3			namespace LaravelPropertyBag\Settings;
4
5			use LaravelPropertyBag\Helpers\NameResolver;
6			use LaravelPropertyBag\Exceptions\ResourceNotFound;
7
8			trait HasSettings
9			{
10			/**
11			* Instance of Settings.
12			*
13			* @var LaravelPropertyBag\Settings\Settings
14			*/
15			protected $settings = null;
16
17			/**
18			* A resource has many settings in a property bag.
19			*
20			* @return \Illuminate\Database\Eloquent\Relations\MorphMany
21			*/
22			public function propertyBag()
23			{
24			return $this->morphMany(PropertyBag::class, 'resource');
			0 ignored issues – show Bug introduced 2017-01-28 14:09 UTC by Report Bug Copy Issue Report It seems like `morphMany()` must be provided by classes using this trait. How about adding it as abstract method to this trait? This check looks for methods that are used by a trait but not required by it. To illustrate, let’s look at the following code example trait Idable { public function equalIds(Idable $other) { return $this->getId() === $other->getId(); } } The trait `Idable` provides a method `equalsId` that in turn relies on the method `getId()`. If this method does not exist on a class mixing in this trait, the method will fail. Adding the `getId()` as an abstract method to the trait will make sure it is available. Loading history...
25			}
26
27			/**
28			* If passed is string, get settings class for the resource or return value
29			* for given key. If passed is array, set the key value pair.
30			*
31			* @param string\|array $passed
32			*
33			* @return LaravelPropertyBag\Settings\Settings\|mixed
34			*/
35			public function settings($passed = null)
36			{
37			if (is_array($passed)) {
38			return $this->setSettings($passed);
39			} elseif (!is_null($passed)) {
40			$settings = $this->getSettingsInstance();
41
42			return $settings->get($passed);
43			}
44
45			return $this->getSettingsInstance();
46			}
47
48			/**
49			* Get settings off this or create new instance.
50			*
51			* @return LaravelPropertyBag\Settings\Settings
52			*/
53			protected function getSettingsInstance()
54			{
55			if (isset($this->settings)) {
56			return $this->settings;
57			}
58
59			$settingsConfig = $this->getSettingsConfig();
60
61			return $this->settings = new Settings($settingsConfig, $this);
			0 ignored issues – show Documentation Bug introduced 2017-01-28 14:09 UTC by Report Bug Copy Issue Report It seems like `new \LaravelPropertyBag\...$settingsConfig, $this)` of type `object<LaravelPropertyBag\Settings\Settings>` is incompatible with the declared type `object<LaravelPropertyBa...yBag\Settings\Settings>` of property `$settings`. Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property. Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property.. Loading history...
62			}
63
64			/**
65			* Get the settings class name.
66			*
67			* @throws ResourceNotFound
68			*
69			* @return LaravelPropertyBag\Settings\ResourceConfig
70			*/
71			protected function getSettingsConfig()
72			{
73			if (isset($this->settingsConfig)) {
74			$fullNamespace = $this->settingsConfig;
			0 ignored issues – show Bug introduced 2017-01-28 14:09 UTC by Report Bug Copy Issue Report The property `settingsConfig` does not seem to exist. Did you mean `settings`? An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name. If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading. Loading history...
75			} else {
76			$className = $this->getShortClassName();
77
78			$fullNamespace = NameResolver::makeConfigFileName($className);
79			}
80
81			if (class_exists($fullNamespace)) {
82			return new $fullNamespace($this);
83			}
84
85			throw ResourceNotFound::resourceConfigNotFound($fullNamespace);
86			}
87
88			/**
89			* Get the short name of the model.
90			*
91			* @return string
92			*/
93			protected function getShortClassName()
94			{
95			$reflection = new \ReflectionClass($this);
96
97			return $reflection->getShortName();
98			}
99
100			/**
101			* Set settings.
102			*
103			* @param array $attributes
104			*
105			* @return LaravelPropertyBag\Settings\Settings
106			*/
107			public function setSettings(array $attributes)
108			{
109			return $this->settings()->set($attributes);
110			}
111
112			/**
113			* Set all allowed settings by Request.
114			*
115			* @return LaravelPropertyBag\Settings\Settings
116			*/
117			public function setSettingsByRequest()
118			{
119			$allAllowedSettings = array_keys($this->allSettings()->toArray());
120			return $this->settings()->set(request()->only($allAllowedSettings));
			0 ignored issues – show Security File Exposure introduced 2017-08-23 09:23 UTC by Report Bug Copy Issue Report `$allAllowedSettings` can contain request data and is used in file inclusion context(s) leading to a potential security vulnerability. 9 paths for user data to reach this point 1. Path: `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in ServerBag.php on line 62 `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in vendor/ServerBag.php on line 62 ParameterBag::$parameters is assigned in vendor/ServerBag.php on line 77 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 2. Path: Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in Request.php on line 281 Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$request` is passed to Request::__construct() in vendor/Request.php on line 1963 `$request` is passed to Request::initialize() in vendor/Request.php on line 222 `$request` is passed to ParameterBag::__construct() in vendor/Request.php on line 240 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 3. Path: Read from `$_SERVER,` and `$server` is assigned in Request.php on line 271 Read from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 271 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 4. Path: Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in Request.php on line 274 Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 274 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 5. Path: Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in Request.php on line 277 Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 277 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 6. Path: `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in Request.php on line 347 `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in vendor/Request.php on line 347 `$server` is assigned in vendor/Request.php on line 395 `$server` is assigned in vendor/Request.php on line 396 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 398 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 7. Path: `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 43 `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 43 `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1733 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1764 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 8. Path: `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 44 `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1733 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1764 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 9. Path: Read from `$_SERVER` in src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 19 Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 19 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1954 `\Illuminate\Http\Request::create($app->make('config')->get('app.url', 'http://localhost'), 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 18 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 356 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 556 Container::make() returns tainted data in vendor/src/Illuminate/Container/Container.php on line 1070 Container::offsetGet() returns tainted data, and `$table` is assigned in vendor/src/Illuminate/Session/SessionManager.php on line 74 `$table` is passed to DatabaseSessionHandler::__construct() in vendor/src/Illuminate/Session/SessionManager.php on line 79 DatabaseSessionHandler::$table is assigned in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 61 Tainted property DatabaseSessionHandler::$table is read, and `$this->table` is passed to Connection::table() in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 274 `$table` is passed to Builder::from() in vendor/src/Illuminate/Database/Connection.php on line 258 Builder::$from is assigned in vendor/src/Illuminate/Database/Query/Builder.php on line 324 Tainted property Builder::$from is read, and `$query->from` is passed to Grammar::wrapTable() in vendor/src/Illuminate/Database/Query/Grammars/Grammar.php on line 772 `$this->tablePrefix . $table` is passed to Grammar::wrap() in vendor/src/Illuminate/Database/Grammar.php on line 36 `$value` is passed through explode(), and `explode('.', $value)` is passed to Grammar::wrapSegments() in vendor/src/Illuminate/Database/Grammar.php on line 62 `$segments` is passed to collect() in vendor/src/Illuminate/Database/Grammar.php on line 96 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 Used in path-read context InteractsWithInput::only() uses data_get() ($key) in vendor/src/Illuminate/Http/Concerns/InteractsWithInput.php on line 153 data_get() uses Arr::exists() ($key) in vendor/src/Illuminate/Support/helpers.php on line 427 Arr::exists() uses Repository::offsetExists() ($key) in vendor/src/Illuminate/Support/Arr.php on line 120 Repository::offsetExists() uses Repository::has() ($key) in vendor/src/Illuminate/Cache/Repository.php on line 444 Repository::has() uses Repository::get() ($key) in vendor/src/Illuminate/Cache/Repository.php on line 65 Repository::get() uses FileStore::get() ($key) in vendor/src/Illuminate/Cache/Repository.php on line 83 FileStore::get() uses FileStore::getPayload() ($key) in vendor/src/Illuminate/Cache/FileStore.php on line 50 FileStore::getPayload() uses Filesystem::get() ($path) in vendor/src/Illuminate/Cache/FileStore.php on line 173 Filesystem::get() uses file_get_contents() ($filename) in vendor/src/Illuminate/Filesystem/Filesystem.php on line 38 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history... Security File Manipulation introduced 2017-08-23 09:23 UTC by Report Bug Copy Issue Report `$allAllowedSettings` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. 9 paths for user data to reach this point 1. Path: `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in ServerBag.php on line 62 `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in vendor/ServerBag.php on line 62 ParameterBag::$parameters is assigned in vendor/ServerBag.php on line 77 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 2. Path: Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in Request.php on line 281 Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$request` is passed to Request::__construct() in vendor/Request.php on line 1963 `$request` is passed to Request::initialize() in vendor/Request.php on line 222 `$request` is passed to ParameterBag::__construct() in vendor/Request.php on line 240 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 3. Path: Read from `$_SERVER,` and `$server` is assigned in Request.php on line 271 Read from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 271 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 4. Path: Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in Request.php on line 274 Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 274 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 5. Path: Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in Request.php on line 277 Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 277 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 6. Path: `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in Request.php on line 347 `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in vendor/Request.php on line 347 `$server` is assigned in vendor/Request.php on line 395 `$server` is assigned in vendor/Request.php on line 396 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 398 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 7. Path: `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 43 `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 43 `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1733 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1764 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 8. Path: `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 44 `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1733 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1764 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 9. Path: Read from `$_SERVER` in src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 19 Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 19 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1954 `\Illuminate\Http\Request::create($app->make('config')->get('app.url', 'http://localhost'), 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 18 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 356 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 556 Container::make() returns tainted data in vendor/src/Illuminate/Container/Container.php on line 1070 Container::offsetGet() returns tainted data, and `$table` is assigned in vendor/src/Illuminate/Session/SessionManager.php on line 74 `$table` is passed to DatabaseSessionHandler::__construct() in vendor/src/Illuminate/Session/SessionManager.php on line 79 DatabaseSessionHandler::$table is assigned in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 61 Tainted property DatabaseSessionHandler::$table is read, and `$this->table` is passed to Connection::table() in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 274 `$table` is passed to Builder::from() in vendor/src/Illuminate/Database/Connection.php on line 258 Builder::$from is assigned in vendor/src/Illuminate/Database/Query/Builder.php on line 324 Tainted property Builder::$from is read, and `$query->from` is passed to Grammar::wrapTable() in vendor/src/Illuminate/Database/Query/Grammars/Grammar.php on line 772 `$this->tablePrefix . $table` is passed to Grammar::wrap() in vendor/src/Illuminate/Database/Grammar.php on line 36 `$value` is passed through explode(), and `explode('.', $value)` is passed to Grammar::wrapSegments() in vendor/src/Illuminate/Database/Grammar.php on line 62 `$segments` is passed to collect() in vendor/src/Illuminate/Database/Grammar.php on line 96 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 Used in path-write context InteractsWithInput::only() uses data_get() ($key) in vendor/src/Illuminate/Http/Concerns/InteractsWithInput.php on line 153 data_get() uses Arr::exists() ($key) in vendor/src/Illuminate/Support/helpers.php on line 427 Arr::exists() uses Repository::offsetExists() ($key) in vendor/src/Illuminate/Support/Arr.php on line 120 Repository::offsetExists() uses Repository::has() ($key) in vendor/src/Illuminate/Cache/Repository.php on line 444 Repository::has() uses Repository::get() ($key) in vendor/src/Illuminate/Cache/Repository.php on line 65 Repository::get() uses FileStore::get() ($key) in vendor/src/Illuminate/Cache/Repository.php on line 83 FileStore::get() uses FileStore::getPayload() ($key) in vendor/src/Illuminate/Cache/FileStore.php on line 50 FileStore::getPayload() uses FileStore::forget() ($key) in vendor/src/Illuminate/Cache/FileStore.php on line 183 FileStore::forget() uses Filesystem::delete() ($paths) in vendor/src/Illuminate/Cache/FileStore.php on line 132 Filesystem::delete() uses unlink() ($filename) in vendor/src/Illuminate/Filesystem/Filesystem.php on line 172 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history... Security Object Injection introduced 2017-08-23 09:23 UTC by Report Bug Copy Issue Report `$allAllowedSettings` can contain request data and is used in unserialized context(s) leading to a potential security vulnerability. 9 paths for user data to reach this point 1. Path: `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in ServerBag.php on line 62 `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in vendor/ServerBag.php on line 62 ParameterBag::$parameters is assigned in vendor/ServerBag.php on line 77 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 2. Path: Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in Request.php on line 281 Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$request` is passed to Request::__construct() in vendor/Request.php on line 1963 `$request` is passed to Request::initialize() in vendor/Request.php on line 222 `$request` is passed to ParameterBag::__construct() in vendor/Request.php on line 240 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 3. Path: Read from `$_SERVER,` and `$server` is assigned in Request.php on line 271 Read from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 271 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 4. Path: Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in Request.php on line 274 Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 274 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 5. Path: Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in Request.php on line 277 Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 277 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 6. Path: `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in Request.php on line 347 `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in vendor/Request.php on line 347 `$server` is assigned in vendor/Request.php on line 395 `$server` is assigned in vendor/Request.php on line 396 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 398 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 7. Path: `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 43 `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 43 `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1733 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1764 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 8. Path: `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 44 `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1733 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1764 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 9. Path: Read from `$_SERVER` in src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 19 Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 19 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1954 `\Illuminate\Http\Request::create($app->make('config')->get('app.url', 'http://localhost'), 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 18 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 356 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 556 Container::make() returns tainted data in vendor/src/Illuminate/Container/Container.php on line 1070 Container::offsetGet() returns tainted data, and `$table` is assigned in vendor/src/Illuminate/Session/SessionManager.php on line 74 `$table` is passed to DatabaseSessionHandler::__construct() in vendor/src/Illuminate/Session/SessionManager.php on line 79 DatabaseSessionHandler::$table is assigned in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 61 Tainted property DatabaseSessionHandler::$table is read, and `$this->table` is passed to Connection::table() in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 274 `$table` is passed to Builder::from() in vendor/src/Illuminate/Database/Connection.php on line 258 Builder::$from is assigned in vendor/src/Illuminate/Database/Query/Builder.php on line 324 Tainted property Builder::$from is read, and `$query->from` is passed to Grammar::wrapTable() in vendor/src/Illuminate/Database/Query/Grammars/Grammar.php on line 772 `$this->tablePrefix . $table` is passed to Grammar::wrap() in vendor/src/Illuminate/Database/Grammar.php on line 36 `$value` is passed through explode(), and `explode('.', $value)` is passed to Grammar::wrapSegments() in vendor/src/Illuminate/Database/Grammar.php on line 62 `$segments` is passed to collect() in vendor/src/Illuminate/Database/Grammar.php on line 96 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 Used in unserialized context InteractsWithInput::only() uses data_get() ($key) in vendor/src/Illuminate/Http/Concerns/InteractsWithInput.php on line 153 data_get() uses Arr::exists() ($key) in vendor/src/Illuminate/Support/helpers.php on line 427 Arr::exists() uses Repository::offsetExists() ($key) in vendor/src/Illuminate/Support/Arr.php on line 120 Repository::offsetExists() uses Repository::has() ($key) in vendor/src/Illuminate/Cache/Repository.php on line 444 Repository::has() uses Repository::get() ($key) in vendor/src/Illuminate/Cache/Repository.php on line 65 Repository::get() uses FileStore::get() ($key) in vendor/src/Illuminate/Cache/Repository.php on line 83 FileStore::get() uses FileStore::getPayload() ($key) in vendor/src/Illuminate/Cache/FileStore.php on line 50 FileStore::getPayload() uses unserialize() ($str) in vendor/src/Illuminate/Cache/FileStore.php on line 188 Preventing Object Injection Attacks If you pass raw user-data to `unserialize()` for example, this can be used to create an object of any class that is available in your local filesystem. For an attacker, classes that have magic methods like `__destruct` or `__wakeup` are particularly interesting in such a case, as they can be exploited very easily. We recommend to not pass user data to such a function. In case of `unserialize`, better use `JSON` to transfer data. General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history... Security Code Execution introduced 2017-08-23 09:23 UTC by Report Bug Copy Issue Report `$allAllowedSettings` can contain request data and is used in code execution context(s) leading to a potential security vulnerability. 9 paths for user data to reach this point 1. Path: `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in ServerBag.php on line 62 `$this->parameters['HTTP_AUTHORIZATION']` seems to return tainted data, and `$authorizationHeader` is assigned in vendor/ServerBag.php on line 62 ParameterBag::$parameters is assigned in vendor/ServerBag.php on line 77 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 2. Path: Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in Request.php on line 281 Read from `$_POST,` and `$_POST` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$request` is passed to Request::__construct() in vendor/Request.php on line 1963 `$request` is passed to Request::initialize() in vendor/Request.php on line 222 `$request` is passed to ParameterBag::__construct() in vendor/Request.php on line 240 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 3. Path: Read from `$_SERVER,` and `$server` is assigned in Request.php on line 271 Read from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 271 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 4. Path: Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in Request.php on line 274 Fetching key `HTTP_CONTENT_LENGTH` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 274 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 5. Path: Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in Request.php on line 277 Fetching key `HTTP_CONTENT_TYPE` from `$_SERVER,` and `$server` is assigned in vendor/Request.php on line 277 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 281 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 6. Path: `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in Request.php on line 347 `$server['HTTP_HOST']` seems to return tainted data, and `$server` is assigned in vendor/Request.php on line 347 `$server` is assigned in vendor/Request.php on line 395 `$server` is assigned in vendor/Request.php on line 396 `$server` is passed to Request::createRequestFromFactory() in vendor/Request.php on line 398 `$server` is passed to Request::__construct() in vendor/Request.php on line 1963 `$server` is passed to Request::initialize() in vendor/Request.php on line 222 `$server` is passed to ParameterBag::__construct() in vendor/Request.php on line 245 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 35 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 7. Path: `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 43 `$this->parameters['PHP_AUTH_USER']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 43 `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1733 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1764 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 8. Path: `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in ServerBag.php on line 44 `$this->parameters['PHP_AUTH_PW']` seems to return tainted data, and `$headers` is assigned in vendor/ServerBag.php on line 44 ServerBag::getHeaders() returns tainted data, and `$this->server->getHeaders()` is passed to HeaderBag::__construct() in vendor/Request.php on line 246 `$values` is assigned in vendor/HeaderBag.php on line 31 `$values` is passed to HeaderBag::set() in vendor/HeaderBag.php on line 32 `(array) $values` is passed through array_values(), and `$values` is assigned in vendor/HeaderBag.php on line 142 HeaderBag::$headers is assigned in vendor/HeaderBag.php on line 145 Tainted property HeaderBag::$headers is read in vendor/HeaderBag.php on line 125 HeaderBag::get() returns tainted data, and `$requestUri` is assigned in vendor/Request.php on line 1733 `$requestUri` is passed to ParameterBag::set() in vendor/Request.php on line 1764 ParameterBag::$parameters is assigned in vendor/ParameterBag.php on line 99 Tainted property ParameterBag::$parameters is read in vendor/ParameterBag.php on line 45 ParameterBag::all() returns tainted data, and `$bag->all()` is passed to TransformsRequest::cleanArray() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58 `$data` is passed to collect() in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 9. Path: Read from `$_SERVER` in src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 19 Read from `$_SERVER` in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 19 Data is passed through array_replace() in vendor/Request.php on line 324 Data is passed through call_user_func() in vendor/Request.php on line 1954 `\Illuminate\Http\Request::create($app->make('config')->get('app.url', 'http://localhost'), 'GET', array(), array(), array(), $_SERVER)` is passed to Container::instance() in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 18 Container::$instances is assigned in vendor/src/Illuminate/Container/Container.php on line 356 Tainted property Container::$instances is read in vendor/src/Illuminate/Container/Container.php on line 556 Container::make() returns tainted data in vendor/src/Illuminate/Container/Container.php on line 1070 Container::offsetGet() returns tainted data, and `$table` is assigned in vendor/src/Illuminate/Session/SessionManager.php on line 74 `$table` is passed to DatabaseSessionHandler::__construct() in vendor/src/Illuminate/Session/SessionManager.php on line 79 DatabaseSessionHandler::$table is assigned in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 61 Tainted property DatabaseSessionHandler::$table is read, and `$this->table` is passed to Connection::table() in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 274 `$table` is passed to Builder::from() in vendor/src/Illuminate/Database/Connection.php on line 258 Builder::$from is assigned in vendor/src/Illuminate/Database/Query/Builder.php on line 324 Tainted property Builder::$from is read, and `$query->from` is passed to Grammar::wrapTable() in vendor/src/Illuminate/Database/Query/Grammars/Grammar.php on line 772 `$this->tablePrefix . $table` is passed to Grammar::wrap() in vendor/src/Illuminate/Database/Grammar.php on line 36 `$value` is passed through explode(), and `explode('.', $value)` is passed to Grammar::wrapSegments() in vendor/src/Illuminate/Database/Grammar.php on line 62 `$segments` is passed to collect() in vendor/src/Illuminate/Database/Grammar.php on line 96 `$value` is passed to Collection::__construct() in vendor/src/Illuminate/Support/helpers.php on line 378 Collection::$items is assigned in vendor/src/Illuminate/Support/Collection.php on line 47 Tainted property Collection::$items is read, and `$this->items` is passed through array_map() in vendor/src/Illuminate/Support/Collection.php on line 1285 Collection::toArray() returns tainted data, and `$this->allSettings()->toArray()` is passed through array_keys(), and `$allAllowedSettings` is assigned in src/Settings/HasSettings.php on line 119 Used in code-execution context InteractsWithInput::only() uses data_get() ($key) in vendor/src/Illuminate/Http/Concerns/InteractsWithInput.php on line 153 data_get() uses Arr::exists() ($key) in vendor/src/Illuminate/Support/helpers.php on line 427 Arr::exists() uses Model::offsetExists() ($offset) in vendor/src/Illuminate/Support/Arr.php on line 120 Model::offsetExists() uses Model::__get() ($key) in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1244 Model::__get() uses HasAttributes::getAttribute() ($key) in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1221 HasAttributes::getAttribute() uses HasAttributes::getRelationValue() ($key) in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 315 HasAttributes::getRelationValue() uses HasAttributes::getRelationshipFromMethod() ($method) in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 385 HasAttributes::getRelationshipFromMethod() uses dynamic method call in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 399 General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
121			}
122
123			/**
124			* Get all settings.
125			*
126			* @return \Illuminate\Support\Collection
127			*/
128			public function allSettings()
129			{
130			return $this->settings()->all();
131			}
132
133			/**
134			* Get all default settings or default setting for single key if given.
135			*
136			* @param string $key
137			*
138			* @return \Illuminate\Support\Collection\|mixed
139			*/
140			public function defaultSetting($key = null)
141			{
142			if (!is_null($key)) {
143			return $this->settings()->getDefault($key);
144			}
145
146			return $this->settings()->allDefaults();
147			}
148
149			/**
150			* Get all allowed settings or allowed settings for single ke if given.
151			*
152			* @param string $key
153			*
154			* @return \Illuminate\Support\Collection
155			*/
156			public function allowedSetting($key = null)
157			{
158			if (!is_null($key)) {
159			return $this->settings()->getAllowed($key);
160			}
161
162			return $this->settings()->allAllowed();
163			}
164			}
165

zachleigh / laravel-property-bag

Pull Request — master (#15)

HasSettings::setSettingsByRequest() A

Complexity

Size

Duplication

Importance

9 paths for user data to reach this point

Used in path-read context

General Strategies to prevent injection

9 paths for user data to reach this point

Used in path-write context

General Strategies to prevent injection

9 paths for user data to reach this point

Used in unserialized context

Preventing Object Injection Attacks

General Strategies to prevent injection

9 paths for user data to reach this point

Used in code-execution context

General Strategies to prevent injection

Duplication Side-by-Side

Filter issues like