Skip to content

Commit 512431f

Browse files
paulbalandanpaulbalandan
committed
Fix passing null to string|int only fields
1 parent 007d1e1 commit 512431f

File tree

18 files changed

+106
-182
lines changed

18 files changed

+106
-182
lines changed

‎app/Config/Mimes.php‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@
33
namespace Config;
44

55
/**
6-
* Mimes
7-
*
86
* This file contains an array of mime types. It is used by the
97
* Upload class to help identify allowed file types.
108
*
@@ -509,7 +507,7 @@ public static function guessExtensionFromType(string $type, ?string $proposedExt
509507
{
510508
$type = trim(strtolower($type), '. ');
511509

512-
$proposedExtension = trim(strtolower($proposedExtension));
510+
$proposedExtension = trim(strtolower($proposedExtension ?? ''));
513511

514512
if ($proposedExtension !== '') {
515513
if (array_key_exists($proposedExtension, static::$mimes) && in_array($type, is_string(static::$mimes[$proposedExtension]) ? [static::$mimes[$proposedExtension]] : static::$mimes[$proposedExtension], true)) {

‎system/CLI/CLI.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -826,11 +826,11 @@ public static function getOptionString(bool $useLongOpts = false, bool $trim = f
826826
$out .= "-{$name} ";
827827
}
828828

829-
// If there's a space, we need to group
830-
// so it will pass correctly.
831-
if (mb_strpos($value, ' ') !== false) {
832-
$out .= '"' . $value . '" ';
833-
} elseif ($value !== null) {
829+
if ($value === null) {
830+
$out .= '';
831+
} elseif (mb_strpos($value, ' ') !== false) {
832+
$out .= "\"{$value}\" ";
833+
} else {
834834
$out .= "{$value} ";
835835
}
836836
}

‎system/Filters/Filters.php‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -377,24 +377,22 @@ protected function processGlobals(?string $uri = null)
377377
return;
378378
}
379379

380-
$uri = strtolower(trim($uri, '/ '));
380+
$uri = strtolower(trim($uri ?? '', '/ '));
381381

382382
// Add any global filters, unless they are excluded for this URI
383-
$sets = [
384-
'before',
385-
'after',
386-
];
383+
$sets = ['before', 'after'];
387384

388385
foreach ($sets as $set) {
389386
if (isset($this->config->globals[$set])) {
387+
390388
// look at each alias in the group
391389
foreach ($this->config->globals[$set] as $alias => $rules) {
392390
$keep = true;
391+
393392
if (is_array($rules)) {
394-
// see if it should be excluded
395393
if (isset($rules['except'])) {
396-
// grab the exclusion rules
397394
$check = $rules['except'];
395+
398396
if ($this->pathApplies($uri, $check)) {
399397
$keep = false;
400398
}

‎system/HTTP/CLIRequest.php‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@
1515
use RuntimeException;
1616

1717
/**
18-
* Class CLIRequest
19-
*
2018
* Represents a request from the command-line. Provides additional
2119
* tools to interact with that request since CLI requests are not
2220
* static like HTTP requests might be.
@@ -141,11 +139,11 @@ public function getOptionString(bool $useLongOpts = false): string
141139
$out .= "-{$name} ";
142140
}
143141

144-
// If there's a space, we need to group
145-
// so it will pass correctly.
146-
if (mb_strpos($value, ' ') !== false) {
147-
$out .= '"' . $value . '" ';
148-
} elseif ($value !== null) {
142+
if ($value === null) {
143+
$out .= '';
144+
} elseif (mb_strpos($value, ' ') !== false) {
145+
$out .= "\"{$value}\" ";
146+
} else {
149147
$out .= "{$value} ";
150148
}
151149
}
@@ -172,17 +170,17 @@ protected function parseCommand()
172170
if ($optionValue) {
173171
$optionValue = false;
174172
} else {
175-
$this->segments[] = filter_var($arg, FILTER_SANITIZE_STRING);
173+
$this->segments[] = esc(strip_tags($arg));
176174
}
177175

178176
continue;
179177
}
180178

181-
$arg = filter_var(ltrim($arg, '-'), FILTER_SANITIZE_STRING);
179+
$arg = esc(strip_tags(ltrim($arg, '-')));
182180
$value = null;
183181

184182
if (isset($args[$i + 1]) && mb_strpos($args[$i + 1], '-') !== 0) {
185-
$value = filter_var($args[$i + 1], FILTER_SANITIZE_STRING);
183+
$value = esc(strip_tags($args[$i + 1]));
186184
$optionValue = true;
187185
}
188186

‎system/HTTP/CURLRequest.php‎

Lines changed: 7 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,7 @@
1616
use InvalidArgumentException;
1717

1818
/**
19-
* Class OutgoingRequest
20-
*
21-
* A lightweight HTTP client for sending synchronous HTTP requests
22-
* via cURL.
19+
* A lightweight HTTP client for sending synchronous HTTP requests via cURL.
2320
*/
2421
class CURLRequest extends Request
2522
{
@@ -84,10 +81,7 @@ class CURLRequest extends Request
8481
public function __construct(App $config, URI $uri, ?ResponseInterface $response = null, array $options = [])
8582
{
8683
if (! function_exists('curl_version')) {
87-
// we won't see this during travis-CI
88-
// @codeCoverageIgnoreStart
89-
throw HTTPException::forMissingCurl();
90-
// @codeCoverageIgnoreEnd
84+
throw HTTPException::forMissingCurl(); // @codeCoverageIgnore
9185
}
9286

9387
parent::__construct($config);
@@ -110,9 +104,7 @@ public function request($method, string $url, array $options = []): ResponseInte
110104

111105
$url = $this->prepareURL($url);
112106

113-
$method = filter_var($method, FILTER_SANITIZE_STRING);
114-
115-
$this->send($method, $url);
107+
$this->send(esc(strip_tags($method)), $url);
116108

117109
return $this->response;
118110
}
@@ -182,11 +174,7 @@ public function put(string $url, array $options = []): ResponseInterface
182174
*/
183175
public function setAuth(string $username, string $password, string $type = 'basic')
184176
{
185-
$this->config['auth'] = [
186-
$username,
187-
$password,
188-
$type,
189-
];
177+
$this->config['auth'] = [$username, $password, $type];
190178

191179
return $this;
192180
}
@@ -260,14 +248,12 @@ protected function parseOptions(array $options)
260248
*/
261249
protected function prepareURL(string $url): string
262250
{
263-
// If it's a full URI, then we have nothing to do here...
264251
if (strpos($url, '://') !== false) {
265252
return $url;
266253
}
267254

268255
$uri = $this->baseURI->resolveRelativeURI($url);
269256

270-
// Create the string instead of casting to prevent baseURL muddling
271257
return URI::createURIString($uri->getScheme(), $uri->getAuthority(), $uri->getPath(), $uri->getQuery(), $uri->getFragment());
272258
}
273259

@@ -279,7 +265,7 @@ protected function prepareURL(string $url): string
279265
*/
280266
public function getMethod(bool $upper = false): string
281267
{
282-
return ($upper) ? strtoupper($this->method) : strtolower($this->method);
268+
return $upper ? strtoupper($this->method) : strtolower($this->method);
283269
}
284270

285271
/**
@@ -386,10 +372,9 @@ protected function applyMethod(string $method, array $curlOptions): array
386372
{
387373
$method = strtoupper($method);
388374

389-
$this->method = $method;
390-
$curlOptions[CURLOPT_CUSTOMREQUEST] = $method;
375+
$this->method = $curlOptions[CURLOPT_CUSTOMREQUEST] = $method;
391376

392-
$size = strlen($this->body);
377+
$size = strlen($this->body ?? '');
393378

394379
// Have content?
395380
if ($size > 0) {

‎system/HTTP/ResponseTrait.php‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,6 @@
2222
use InvalidArgumentException;
2323

2424
/**
25-
* Request Trait
26-
*
2725
* Additional methods to make a PSR-7 Response class
2826
* compliant with the framework's own ResponseInterface.
2927
*
@@ -435,7 +433,7 @@ public function send()
435433
if ($this->CSPEnabled === true) {
436434
$this->CSP->finalize($this);
437435
} else {
438-
$this->body = str_replace(['{csp-style-nonce}', '{csp-script-nonce}'], '', $this->body);
436+
$this->body = str_replace(['{csp-style-nonce}', '{csp-script-nonce}'], '', $this->body ?? '');
439437
}
440438

441439
$this->sendHeaders();

‎system/Helpers/number_helper.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,14 @@
2424
*/
2525
function number_to_size($num, int $precision = 1, ?string $locale = null)
2626
{
27-
// Strip any formatting & ensure numeric input
2827
try {
2928
$num = 0 + str_replace(',', '', $num); // @phpstan-ignore-line
30-
} catch (ErrorException $ee) {
29+
} catch (ErrorException $e) {
3130
return false;
3231
}
3332

34-
// ignore sub part
3533
$generalLocale = $locale;
34+
3635
if (! empty($locale) && ($underscorePos = strpos($locale, '_'))) {
3736
$generalLocale = substr($locale, 0, $underscorePos);
3837
}
@@ -183,6 +182,7 @@ function format_number(float $num, int $precision = 1, ?string $locale = null, a
183182
function number_to_roman(string $num): ?string
184183
{
185184
$num = (int) $num;
185+
186186
if ($num < 1 || $num > 3999) {
187187
return null;
188188
}
@@ -248,8 +248,9 @@ function number_to_roman(string $num): ?string
248248
$return = $keyF; // @phpstan-ignore-line
249249
break;
250250
}
251+
251252
if ($num > 10) {
252-
$return = $_number_to_roman($num / 10, ++$th) . $return;
253+
$return = $_number_to_roman((int) floor($num / 10), ++$th) . $return;
253254
}
254255

255256
return $return;

‎system/I18n/Time.php‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -75,31 +75,27 @@ class Time extends DateTime
7575
*/
7676
public function __construct(?string $time = null, $timezone = null, ?string $locale = null)
7777
{
78-
// If no locale was provided, grab it from Locale (set by IncomingRequest for web requests)
79-
$this->locale = ! empty($locale) ? $locale : Locale::getDefault();
78+
$this->locale = $locale ?: Locale::getDefault();
8079

8180
// If a test instance has been provided, use it instead.
8281
if ($time === null && static::$testNow instanceof self) {
83-
if (empty($timezone)) {
84-
$timezone = static::$testNow->getTimezone();
85-
}
86-
87-
$time = static::$testNow->toDateTimeString();
82+
$timezone = $timezone ?: static::$testNow->getTimezone();
83+
$time = static::$testNow->toDateTimeString();
8884
}
8985

90-
$timezone = ! empty($timezone) ? $timezone : date_default_timezone_get();
86+
$timezone = $timezone ?: date_default_timezone_get();
9187
$this->timezone = $timezone instanceof DateTimeZone ? $timezone : new DateTimeZone($timezone);
9288

9389
// If the time string was a relative string (i.e. 'next Tuesday')
9490
// then we need to adjust the time going in so that we have a current
9591
// timezone to work with.
96-
if (! empty($time) && (is_string($time) && static::hasRelativeKeywords($time))) {
92+
if (! empty($time) && is_string($time) && static::hasRelativeKeywords($time)) {
9793
$instance = new DateTime('now', $this->timezone);
9894
$instance->modify($time);
9995
$time = $instance->format('Y-m-d H:i:s');
10096
}
10197

102-
parent::__construct($time, $this->timezone);
98+
parent::__construct($time ?? '', $this->timezone);
10399
}
104100

105101
/**
@@ -113,7 +109,7 @@ public function __construct(?string $time = null, $timezone = null, ?string $loc
113109
*/
114110
public static function now($timezone = null, ?string $locale = null)
115111
{
116-
return new self(null, $timezone, $locale);
112+
return new self('', $timezone, $locale);
117113
}
118114

119115
/**

‎system/Images/Handlers/GDHandler.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ protected function process(string $action)
188188
imagesavealpha($dest, true);
189189
}
190190

191-
$copy($dest, $src, 0, 0, $this->xAxis, $this->yAxis, $this->width, $this->height, $origWidth, $origHeight);
191+
$copy($dest, $src, 0, 0, $this->xAxis ?? 0, $this->yAxis ?? 0, $this->width, $this->height, $origWidth, $origHeight);
192192

193193
imagedestroy($src);
194194
$this->resource = $dest;
@@ -474,7 +474,7 @@ protected function textOverlay(string $text, array $options = [], bool $isShadow
474474
// We have to add fontheight because imagettftext locates the bottom left corner, not top-left corner.
475475
imagettftext($src, $options['fontSize'], 0, $xAxis, $yAxis + $options['fontheight'], $color, $options['fontPath'], $text);
476476
} else {
477-
imagestring($src, $options['fontSize'], $xAxis, $yAxis, $text, $color);
477+
imagestring($src, (int) $options['fontSize'], $xAxis, $yAxis, $text, $color);
478478
}
479479

480480
$this->resource = $src;

‎system/Router/RouteCollection.php‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,6 @@
1919
use InvalidArgumentException;
2020

2121
/**
22-
* Class RouteCollection
23-
*
2422
* @todo Implement nested resource routing (See CakePHP)
2523
*/
2624
class RouteCollection implements RouteCollectionInterface
@@ -663,17 +661,17 @@ public function resource(string $name, ?array $options = null): RouteCollectionI
663661
// resources are sent to, we need to have a new name
664662
// to store the values in.
665663
$newName = implode('\\', array_map('ucfirst', explode('/', $name)));
664+
666665
// If a new controller is specified, then we replace the
667666
// $name value with the name of the new controller.
668667
if (isset($options['controller'])) {
669-
$newName = ucfirst(filter_var($options['controller'], FILTER_SANITIZE_STRING));
668+
$newName = ucfirst(esc(strip_tags($options['controller'])));
670669
}
671670

672671
// In order to allow customization of allowed id values
673672
// we need someplace to store them.
674-
$id = $options['placeholder'] ?? $this->placeholders[$this->defaultPlaceholder] ?? '(:segment)';
675-
676673
// Make sure we capture back-references
674+
$id = $options['placeholder'] ?? $this->placeholders[$this->defaultPlaceholder] ?? '(:segment)';
677675
$id = '(' . trim($id, '()') . ')';
678676

679677
$methods = isset($options['only']) ? (is_string($options['only']) ? explode(',', $options['only']) : $options['only']) : ['index', 'show', 'create', 'update', 'delete', 'new', 'edit'];
@@ -759,7 +757,7 @@ public function presenter(string $name, ?array $options = null): RouteCollection
759757
// If a new controller is specified, then we replace the
760758
// $name value with the name of the new controller.
761759
if (isset($options['controller'])) {
762-
$newName = ucfirst(filter_var($options['controller'], FILTER_SANITIZE_STRING));
760+
$newName = ucfirst(esc(strip_tags($options['controller'])));
763761
}
764762

765763
// In order to allow customization of allowed id values

0 commit comments

Comments
 (0)