This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace Overwatch\TestBundle\Controller; |
||
4 | |||
5 | use Nelmio\ApiDocBundle\Annotation\ApiDoc; |
||
6 | use Overwatch\ExpectationBundle\Exception\ExpectationNotFoundException; |
||
7 | use Overwatch\TestBundle\Entity\Test; |
||
8 | use Overwatch\TestBundle\Entity\TestGroup; |
||
9 | use Overwatch\TestBundle\Security\TestGroupVoter; |
||
10 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Method; |
||
11 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route; |
||
12 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security; |
||
13 | use Symfony\Bundle\FrameworkBundle\Controller\Controller; |
||
14 | use Symfony\Component\DependencyInjection\ContainerInterface; |
||
15 | use Symfony\Component\HttpFoundation\JsonResponse; |
||
16 | use Symfony\Component\HttpFoundation\Request; |
||
17 | |||
18 | /** |
||
19 | * ApiController |
||
20 | * Handles API requests made for Tests |
||
21 | * |
||
22 | * @Route("/api/tests") |
||
23 | */ |
||
24 | class TestApiController extends Controller |
||
0 ignored issues
–
show
|
|||
25 | { |
||
26 | private $_em; |
||
27 | private $expectationManager; |
||
28 | |||
29 | 19 | public function setContainer(ContainerInterface $container = null) |
|
30 | { |
||
31 | 19 | parent::setContainer($container); |
|
32 | 19 | $this->_em = $this->getDoctrine()->getManager(); |
|
33 | 19 | $this->expectationManager = $this->get('overwatch_expectation.expectation_manager'); |
|
34 | 19 | } |
|
35 | |||
36 | /** |
||
37 | * Returns the details of the given test |
||
38 | * |
||
39 | * @Route("/{id}") |
||
40 | * @Method({"GET"}) |
||
41 | * @ApiDoc( |
||
42 | * resource=true, |
||
43 | * requirements={ |
||
44 | * {"name"="id", "description"="The ID of the test to return", "dataType"="integer", "requirement"="\d+"} |
||
45 | * }, |
||
46 | * tags={ |
||
47 | * "Super Admin" = "#ff1919", |
||
48 | * "Admin" = "#ffff33", |
||
49 | * "User" = "#75ff47" |
||
50 | * } |
||
51 | * ) |
||
52 | */ |
||
53 | 2 | public function getTestAction(Test $test) |
|
54 | { |
||
55 | 2 | if (!$this->isGranted(TestGroupVoter::VIEW, $test->getGroup())) { |
|
56 | 1 | throw $this->createAccessDeniedException('You must be a member of this test\'s group to view it'); |
|
57 | } |
||
58 | |||
59 | 1 | return new JsonResponse($test); |
|
60 | } |
||
61 | |||
62 | /** |
||
63 | * Creates a test in the given group |
||
64 | * |
||
65 | * @Route("/group/{id}") |
||
66 | * @Method({"POST"}) |
||
67 | * @Security("is_granted('edit', group)") |
||
68 | * @ApiDoc( |
||
69 | * resource=true, |
||
70 | * parameters={ |
||
71 | * {"name"="name", "description"="A user-friendly name for the test", "required"=true, "format"="Github Status", "dataType"="string"}, |
||
72 | * {"name"="actual", "description"="The actual value to test against", "required"=true, "format"="status.github.com", "dataType"="string"}, |
||
73 | * {"name"="expectation", "description"="The expectation to test with", "required"=true, "format"="toResolveTo", "dataType"="string"}, |
||
74 | * {"name"="expected", "description"="The expected value to test against", "required"=false, "format"="octostatus-production.github.com", "dataType"="string"}, |
||
75 | * }, |
||
76 | * requirements={ |
||
77 | * {"name"="id", "description"="The ID of the group to create the test under", "dataType"="integer", "requirement"="\d+"} |
||
78 | * }, |
||
79 | * tags={ |
||
80 | * "Super Admin" = "#ff1919", |
||
81 | * "Admin" = "#ffff33" |
||
82 | * } |
||
83 | * ) |
||
84 | */ |
||
85 | 3 | public function createTestAction(Request $request, TestGroup $group) |
|
86 | { |
||
87 | 3 | $test = new Test(); |
|
88 | $test |
||
89 | 3 | ->setActual($request->request->get('actual')) |
|
90 | 3 | ->setExpectation($request->request->get('expectation')) |
|
91 | 3 | ->setExpected($request->request->get('expected')) |
|
92 | 3 | ->setName($request->request->get('name')) |
|
93 | 3 | ->setGroup($group) |
|
94 | ; |
||
95 | |||
96 | try { |
||
97 | 3 | $this->expectationManager->get($test->getExpectation()); |
|
98 | 3 | } catch (ExpectationNotFoundException $ex) { |
|
99 | 1 | return new JsonResponse("Expectation '" . $test->getExpectation() . "' could not be found", JsonResponse::HTTP_UNPROCESSABLE_ENTITY); |
|
100 | } |
||
101 | |||
102 | 2 | if ($test->getActual() === null) { |
|
103 | 1 | return new JsonResponse('An actual value to test against must be provided.', JsonResponse::HTTP_UNPROCESSABLE_ENTITY); |
|
104 | } |
||
105 | |||
106 | 1 | $this->_em->persist($test); |
|
107 | 1 | $this->_em->flush(); |
|
108 | |||
109 | 1 | return new JsonResponse($test, JsonResponse::HTTP_CREATED); |
|
110 | } |
||
111 | |||
112 | /** |
||
113 | * Returns a list of tests in the given group |
||
114 | * |
||
115 | * @Route("/group/{id}") |
||
116 | * @Method({"GET"}) |
||
117 | * @Security("is_granted('view', group)") |
||
118 | * @ApiDoc( |
||
119 | * requirements={ |
||
120 | * {"name"="id", "description"="The ID of the group to return tests from", "dataType"="integer", "requirement"="\d+"} |
||
121 | * }, |
||
122 | * tags={ |
||
123 | * "Super Admin" = "#ff1919", |
||
124 | * "Admin" = "#ffff33", |
||
125 | * "User" = "#75ff47" |
||
126 | * } |
||
127 | * ) |
||
128 | */ |
||
129 | 1 | public function getTestsInGroupAction(TestGroup $group) |
|
130 | { |
||
131 | 1 | return new JsonResponse($group->getTests()->toArray()); |
|
132 | } |
||
133 | |||
134 | /** |
||
135 | * Updates the details of the given test |
||
136 | * |
||
137 | * @Route("/{id}") |
||
138 | * @Method({"PUT"}) |
||
139 | * @ApiDoc( |
||
140 | * parameters={ |
||
141 | * {"name"="name", "description"="A user-friendly name for the test", "required"=false, "format"="Github Status", "dataType"="string"}, |
||
142 | * {"name"="actual", "description"="The actual value to test against", "required"=false, "format"="status.github.com", "dataType"="string"}, |
||
143 | * {"name"="expectation", "description"="The expectation to test with", "required"=false, "format"="toResolveTo", "dataType"="string"}, |
||
144 | * {"name"="expected", "description"="The expected value to test against", "required"=false, "format"="octostatus-production.github.com", "dataType"="string"}, |
||
145 | * }, |
||
146 | * requirements={ |
||
147 | * {"name"="id", "description"="The ID of the test to edit the details of", "dataType"="integer", "requirement"="\d+"} |
||
148 | * }, |
||
149 | * tags={ |
||
150 | * "Super Admin" = "#ff1919", |
||
151 | * "Admin" = "#ffff33" |
||
152 | * } |
||
153 | * ) |
||
154 | */ |
||
155 | 2 | public function updateTestAction(Request $request, Test $test) |
|
156 | { |
||
157 | 2 | if (!$this->isGranted(TestGroupVoter::EDIT, $test->getGroup())) { |
|
158 | 1 | throw $this->createAccessDeniedException('You must be an admin in this test\'s group to edit it'); |
|
159 | } |
||
160 | |||
161 | 1 | foreach (['name', 'actual', 'expectation', 'expected'] as $field) { |
|
162 | 1 | if ($request->request->has($field)) { |
|
163 | 1 | $test->{'set' . ucfirst($field)}($request->request->get($field)); |
|
164 | 1 | } |
|
165 | 1 | } |
|
166 | |||
167 | 1 | $this->_em->flush(); |
|
168 | 1 | return new JsonResponse($test); |
|
169 | } |
||
170 | |||
171 | /** |
||
172 | * Deletes the given test |
||
173 | * |
||
174 | * @Route("/{id}") |
||
175 | * @Method({"DELETE"}) |
||
176 | * @ApiDoc( |
||
177 | * requirements={ |
||
178 | * {"name"="id", "description"="The ID of the test to delete", "dataType"="integer", "requirement"="\d+"} |
||
179 | * }, |
||
180 | * tags={ |
||
181 | * "Super Admin" = "#ff1919", |
||
182 | * "Admin" = "#ffff33" |
||
183 | * } |
||
184 | * ) |
||
185 | */ |
||
186 | 2 | public function deleteTestAction(Test $test) |
|
187 | { |
||
188 | 2 | if (!$this->isGranted(TestGroupVoter::EDIT, $test->getGroup())) { |
|
189 | 1 | throw $this->createAccessDeniedException('You must be an admin in this test\'s group to delete it'); |
|
190 | } |
||
191 | |||
192 | 1 | $this->_em->remove($test); |
|
193 | 1 | $this->_em->flush(); |
|
194 | |||
195 | 1 | return new JsonResponse(null, JsonResponse::HTTP_NO_CONTENT); |
|
196 | } |
||
197 | |||
198 | /** |
||
199 | * Runs a test |
||
200 | * |
||
201 | * @Route("/{id}") |
||
202 | * @Method({"POST"}) |
||
203 | * @ApiDoc( |
||
204 | * requirements={ |
||
205 | * {"name"="id", "description"="The ID of the test to run", "dataType"="integer", "requirement"="\d+"} |
||
206 | * }, |
||
207 | * tags={ |
||
208 | * "Super Admin" = "#ff1919", |
||
209 | * "Admin" = "#ffff33" |
||
210 | * } |
||
211 | * ) |
||
212 | */ |
||
213 | 2 | public function runTestAction(Test $test) |
|
214 | { |
||
215 | 2 | if (!$this->isGranted(TestGroupVoter::EDIT, $test->getGroup())) { |
|
216 | 1 | throw $this->createAccessDeniedException('You must be an admin in this test\'s group to run it'); |
|
217 | } |
||
218 | |||
219 | 1 | $result = $this->expectationManager->run($test); |
|
220 | |||
221 | 1 | $this->_em->persist($result); |
|
222 | 1 | $this->_em->flush(); |
|
223 | |||
224 | 1 | return new JsonResponse($result, JsonResponse::HTTP_CREATED); |
|
225 | } |
||
226 | } |
||
227 |
This check marks property names that have not been written in camelCase.
In camelCase names are written without any punctuation, the start of each new word being marked by a capital letter. Thus the name database connection string becomes
databaseConnectionString
.