1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
<?php
/**
* Ensures that getRequestData() is used to access super globals.
*
* PHP version 5
*
* @category PHP
* @package PHP_CodeSniffer_MySource
* @author Greg Sherwood <gsherwood@squiz.net>
* @copyright 2006-2011 Squiz Pty Ltd (ABN 77 084 670 600)
* @license http://matrix.squiz.net/developer/tools/php_cs/licence BSD Licence
* @link http://pear.php.net/package/PHP_CodeSniffer
*/
/**
* Ensures that getRequestData() is used to access super globals.
*
* @category PHP
* @package PHP_CodeSniffer_MySource
* @author Greg Sherwood <gsherwood@squiz.net>
* @copyright 2006-2011 Squiz Pty Ltd (ABN 77 084 670 600)
* @license http://matrix.squiz.net/developer/tools/php_cs/licence BSD Licence
* @version Release: 1.3.3
* @link http://pear.php.net/package/PHP_CodeSniffer
*/
class MySource_Sniffs_PHP_GetRequestDataSniff implements PHP_CodeSniffer_Sniff
{
/**
* Returns an array of tokens this test wants to listen for.
*
* @return array
*/
public function register()
{
return array(T_VARIABLE);
}//end register()
/**
* Processes this sniff, when one of its tokens is encountered.
*
* @param PHP_CodeSniffer_File $phpcsFile The file being scanned.
* @param int $stackPtr The position of the current token in
* the stack passed in $tokens.
*
* @return void
*/
public function process(PHP_CodeSniffer_File $phpcsFile, $stackPtr)
{
$tokens = $phpcsFile->getTokens();
$varName = $tokens[$stackPtr]['content'];
if ($varName !== '$_REQUEST'
&& $varName !== '$_GET'
&& $varName !== '$_POST'
&& $varName !== '$_FILES'
) {
return;
}
// The only place these super globals can be accessed directly is
// in the getRequestData() method of the Security class.
$inClass = false;
foreach ($tokens[$stackPtr]['conditions'] as $i => $type) {
if ($tokens[$i]['code'] === T_CLASS) {
$className = $phpcsFile->findNext(T_STRING, $i);
$className = $tokens[$className]['content'];
if (strtolower($className) === 'security') {
$inClass = true;
} else {
// We don't have nested classes.
break;
}
} else if ($inClass === true && $tokens[$i]['code'] === T_FUNCTION) {
$funcName = $phpcsFile->findNext(T_STRING, $i);
$funcName = $tokens[$funcName]['content'];
if (strtolower($funcName) === 'getrequestdata') {
// This is valid.
return;
} else {
// We don't have nested functions.
break;
}
}//end if
}//end foreach
// If we get to here, the super global was used incorrectly.
// First find out how it is being used.
$globalName = strtolower(substr($varName, 2));
$usedVar = '';
$openBracket = $phpcsFile->findNext(T_WHITESPACE, ($stackPtr + 1), null, true);
if ($tokens[$openBracket]['code'] === T_OPEN_SQUARE_BRACKET) {
$closeBracket = $tokens[$openBracket]['bracket_closer'];
$usedVar = $phpcsFile->getTokensAsString(($openBracket + 1), ($closeBracket - $openBracket - 1));
}
$type = 'SuperglobalAccessed';
$error = 'The %s super global must not be accessed directly; use Security::getRequestData(';
$data = array($varName);
if ($usedVar !== '') {
$type .= 'WithVar';
$error .= '%s, \'%s\'';
$data[] = $usedVar;
$data[] = $globalName;
}
$error .= ') instead';
$phpcsFile->addError($error, $stackPtr, $type, $data);
}//end process()
}//end class
?>
|