Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Minor improvements to pass psecio-parse's scan #58

Open
scottconnerly opened this issue Aug 5, 2020 · 0 comments
Open

Minor improvements to pass psecio-parse's scan #58

scottconnerly opened this issue Aug 5, 2020 · 0 comments

Comments

@scottconnerly
Copy link

scottconnerly commented Aug 5, 2020

To run report:

composer global require psecio/parse
~/.composer/vendor/bin/psecio-parse scan c3.php

And its results:

  1. /var/www/html/tests/c3.php on line 45
    'header()' calls should not use concatenation directly
header('X-Codeception-CodeCoverage-Error: ' . str_replace("\n", ' ', $message), true, 500);

For more information execute 'psecio-parse rules SetHeaderWithInput'

  1. /var/www/html/tests/c3.php on line 69
    Avoid using AND, OR and XOR (in favor of || and &&) as they may cause subtle precedence bugs
if (!class_exists('PHP_CodeCoverage') and class_exists('SebastianBergmann\CodeCoverage\CodeCoverage')) {

For more information execute 'psecio-parse rules LogicalOperators'

  1. /var/www/html/tests/c3.php on line 137
    The third parameter should be set (and be true) on in_array to avoid type switching issues
if (in_array('GZ', Phar::getSupportedCompression())) {

For more information execute 'psecio-parse rules TypeSafeInArray'

  1. /var/www/html/tests/c3.php on line 184
    The third parameter should be set (and be true) on in_array to avoid type switching issues
if (in_array('GZ', Phar::getSupportedCompression())) {

For more information execute 'psecio-parse rules TypeSafeInArray'

  1. /var/www/html/tests/c3.php on line 204
    The readfile/readlink/readgzfile functions output content directly (possible injection)
readfile($filename);

For more information execute 'psecio-parse rules Readfile'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant