Codeception / Codeception/c3

Minor improvements to pass psecio-parse's scan

未关闭
#58 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
PHP
星标
73
派生
46
PR 合并指标
30 天内没有已合并 PR

描述

### To run report:
```
composer global require psecio/parse
~/.composer/vendor/bin/psecio-parse scan c3.php
```

### And its results:

1) /var/www/html/tests/c3.php on line 45
'header()' calls should not use concatenation directly
```
header('X-Codeception-CodeCoverage-Error: ' . str_replace("\n", ' ', $message), true, 500);
```
For more information execute 'psecio-parse rules SetHeaderWithInput'

2) /var/www/html/tests/c3.php on line 69
Avoid using AND, OR and XOR (in favor of || and &&) as they may cause subtle precedence bugs
```
if (!class_exists('PHP_CodeCoverage') and class_exists('SebastianBergmann\CodeCoverage\CodeCoverage')) {
```
For more information execute 'psecio-parse rules LogicalOperators'

3) /var/www/html/tests/c3.php on line 137
The third parameter should be set (and be true) on in_array to avoid type switching issues
```
if (in_array('GZ', Phar::getSupportedCompression())) {
```
For more information execute 'psecio-parse rules TypeSafeInArray'

4) /var/www/html/tests/c3.php on line 184
The third parameter should be set (and be true) on in_array to avoid type switching issues
```
if (in_array('GZ', Phar::getSupportedCompression())) {
```
For more information execute 'psecio-parse rules TypeSafeInArray'

5) /var/www/html/tests/c3.php on line 204
The readfile/readlink/readgzfile functions output content directly (possible injection)
```
readfile($filename);
```
For more information execute 'psecio-parse rules Readfile'

贡献指南

这个仓库没有索引到贡献指南

调研方向

对 c3.php 运行 psecio-parse scan,并检查 tests/c3.php 中报告的行。处理与 header 拼接、逻辑运算符、in_array 类型检查和 readfile 相关的五个发现,然后重新运行 scan,以确认这些发现已消失。

由索引模型根据 Issue 内容生成。

评估

技术栈
php
领域
testing
Issue 类型
重构
难度
2/5
预计耗时
1-3 小时
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。