From 5e24be1a90e96c0dea510efbf4ff0bc0733153ba Mon Sep 17 00:00:00 2001 From: Denny Septian Panggabean Date: Fri, 20 Sep 2024 11:52:31 +0700 Subject: [PATCH 1/4] refactor: prevent using empty() on CURLRequest --- phpstan-baseline.php | 6 ------ system/HTTP/CURLRequest.php | 20 ++++++++++---------- 2 files changed, 10 insertions(+), 16 deletions(-) diff --git a/phpstan-baseline.php b/phpstan-baseline.php index e775d6b9f5ef..550cab20ac4c 100644 --- a/phpstan-baseline.php +++ b/phpstan-baseline.php @@ -5473,12 +5473,6 @@ 'count' => 1, 'path' => __DIR__ . '/system/HTTP/CLIRequest.php', ]; -$ignoreErrors[] = [ - // identifier: empty.notAllowed - 'message' => '#^Construct empty\\(\\) is not allowed\\. Use more strict comparison\\.$#', - 'count' => 10, - 'path' => __DIR__ . '/system/HTTP/CURLRequest.php', -]; $ignoreErrors[] = [ // identifier: missingType.iterableValue 'message' => '#^Method CodeIgniter\\\\HTTP\\\\CURLRequest\\:\\:applyBody\\(\\) has parameter \\$curlOptions with no value type specified in iterable type array\\.$#', diff --git a/system/HTTP/CURLRequest.php b/system/HTTP/CURLRequest.php index 90157e4e05d4..8b39305541e9 100644 --- a/system/HTTP/CURLRequest.php +++ b/system/HTTP/CURLRequest.php @@ -356,7 +356,7 @@ public function send(string $method, string $url) // Reset our curl options so we're on a fresh slate. $curlOptions = []; - if (! empty($this->config['query']) && is_array($this->config['query'])) { + if (array_key_exists('query', $this->config) && $this->config['query'] && is_array($this->config['query'])) { // This is likely too naive a solution. // Should look into handling when $url already // has query vars on it. @@ -422,7 +422,7 @@ public function send(string $method, string $url) */ protected function applyRequestHeaders(array $curlOptions = []): array { - if (empty($this->headers)) { + if ($this->headers === []) { return $curlOptions; } @@ -469,7 +469,7 @@ protected function applyMethod(string $method, array $curlOptions): array */ protected function applyBody(array $curlOptions = []): array { - if (! empty($this->body)) { + if ($this->body !== '' && $this->body !== null) { $curlOptions[CURLOPT_POSTFIELDS] = (string) $this->getBody(); } @@ -518,10 +518,10 @@ protected function setResponseHeaders(array $headers = []) protected function setCURLOptions(array $curlOptions = [], array $config = []) { // Auth Headers - if (! empty($config['auth'])) { + if (array_key_exists('auth', $config) && $config['auth']) { $curlOptions[CURLOPT_USERPWD] = $config['auth'][0] . ':' . $config['auth'][1]; - if (! empty($config['auth'][2]) && strtolower($config['auth'][2]) === 'digest') { + if (array_key_exists(2, $config['auth']) && $config['auth'][2] && strtolower($config['auth'][2]) === 'digest') { $curlOptions[CURLOPT_HTTPAUTH] = CURLAUTH_DIGEST; } else { $curlOptions[CURLOPT_HTTPAUTH] = CURLAUTH_BASIC; @@ -529,7 +529,7 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) } // Certificate - if (! empty($config['cert'])) { + if (array_key_exists('cert', $config) && $config['cert']) { $cert = $config['cert']; if (is_array($cert)) { @@ -575,7 +575,7 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) } // Decode Content - if (! empty($config['decode_content'])) { + if (array_key_exists('decode_content', $config) && $config['decode_content']) { $accept = $this->getHeaderLine('Accept-Encoding'); if ($accept !== '') { @@ -621,7 +621,7 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) $curlOptions[CURLOPT_CONNECTTIMEOUT_MS] = (float) $config['connect_timeout'] * 1000; // Post Data - application/x-www-form-urlencoded - if (! empty($config['form_params']) && is_array($config['form_params'])) { + if (array_key_exists('form_params', $config) && $config['form_params'] && is_array($config['form_params'])) { $postFields = http_build_query($config['form_params']); $curlOptions[CURLOPT_POSTFIELDS] = $postFields; @@ -632,7 +632,7 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) } // Post Data - multipart/form-data - if (! empty($config['multipart']) && is_array($config['multipart'])) { + if (array_key_exists('multipart', $config) && $config['multipart'] && is_array($config['multipart'])) { // setting the POSTFIELDS option automatically sets multipart $curlOptions[CURLOPT_POSTFIELDS] = $config['multipart']; } @@ -650,7 +650,7 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) } // version - if (! empty($config['version'])) { + if (array_key_exists('version', $config) && $config['version']) { $version = sprintf('%.1F', $config['version']); if ($version === '1.0') { $curlOptions[CURLOPT_HTTP_VERSION] = CURL_HTTP_VERSION_1_0; From f33d9e6462a84d27f2bf62361ffdb96a64087abe Mon Sep 17 00:00:00 2001 From: Denny Septian Panggabean Date: Fri, 20 Sep 2024 14:32:11 +0700 Subject: [PATCH 2/4] fix: specify checking againts --- system/HTTP/CURLRequest.php | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/system/HTTP/CURLRequest.php b/system/HTTP/CURLRequest.php index 8b39305541e9..c78f088ff7f3 100644 --- a/system/HTTP/CURLRequest.php +++ b/system/HTTP/CURLRequest.php @@ -356,7 +356,7 @@ public function send(string $method, string $url) // Reset our curl options so we're on a fresh slate. $curlOptions = []; - if (array_key_exists('query', $this->config) && $this->config['query'] && is_array($this->config['query'])) { + if (array_key_exists('query', $this->config) && is_array($this->config['query']) && $this->config['query'] !== []) { // This is likely too naive a solution. // Should look into handling when $url already // has query vars on it. @@ -518,10 +518,10 @@ protected function setResponseHeaders(array $headers = []) protected function setCURLOptions(array $curlOptions = [], array $config = []) { // Auth Headers - if (array_key_exists('auth', $config) && $config['auth']) { + if (array_key_exists('auth', $config) && is_array($config['auth']) && $config['auth'] !== []) { $curlOptions[CURLOPT_USERPWD] = $config['auth'][0] . ':' . $config['auth'][1]; - if (array_key_exists(2, $config['auth']) && $config['auth'][2] && strtolower($config['auth'][2]) === 'digest') { + if (isset($this->config['auth'][2]) && $this->config['auth'][2] === 'digest') { $curlOptions[CURLOPT_HTTPAUTH] = CURLAUTH_DIGEST; } else { $curlOptions[CURLOPT_HTTPAUTH] = CURLAUTH_BASIC; @@ -621,7 +621,7 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) $curlOptions[CURLOPT_CONNECTTIMEOUT_MS] = (float) $config['connect_timeout'] * 1000; // Post Data - application/x-www-form-urlencoded - if (array_key_exists('form_params', $config) && $config['form_params'] && is_array($config['form_params'])) { + if (array_key_exists('form_params', $config) && is_array($config['form_params']) && $config['form_params'] !== []) { $postFields = http_build_query($config['form_params']); $curlOptions[CURLOPT_POSTFIELDS] = $postFields; @@ -632,7 +632,7 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) } // Post Data - multipart/form-data - if (array_key_exists('multipart', $config) && $config['multipart'] && is_array($config['multipart'])) { + if (array_key_exists('multipart', $config) && is_array($config['multipart']) && $config['multipart'] !== []) { // setting the POSTFIELDS option automatically sets multipart $curlOptions[CURLOPT_POSTFIELDS] = $config['multipart']; } From 7b8e2f6f9f47423320fa4041730763831f890edc Mon Sep 17 00:00:00 2001 From: Denny Septian Panggabean Date: Fri, 6 Dec 2024 15:54:09 +0700 Subject: [PATCH 3/4] refactor: applied recommendation changes --- system/HTTP/CURLRequest.php | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/system/HTTP/CURLRequest.php b/system/HTTP/CURLRequest.php index c78f088ff7f3..5bb4ffbe859c 100644 --- a/system/HTTP/CURLRequest.php +++ b/system/HTTP/CURLRequest.php @@ -469,8 +469,10 @@ protected function applyMethod(string $method, array $curlOptions): array */ protected function applyBody(array $curlOptions = []): array { - if ($this->body !== '' && $this->body !== null) { - $curlOptions[CURLOPT_POSTFIELDS] = (string) $this->getBody(); + $requestBody = (string) $this->getBody(); + + if ($requestBody !== '') { + $curlOptions[CURLOPT_POSTFIELDS] = $requestBody; } return $curlOptions; @@ -529,7 +531,7 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) } // Certificate - if (array_key_exists('cert', $config) && $config['cert']) { + if (array_key_exists('cert', $config) && $config['cert'] !== '' || $config['cert'] !== []) { $cert = $config['cert']; if (is_array($cert)) { @@ -650,7 +652,7 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) } // version - if (array_key_exists('version', $config) && $config['version']) { + if (array_key_exists('version', $config) && ((is_string($config['version']) && $config['version'] !== '') || (is_numeric($config['version']) && $config['version'] !== 0))) { $version = sprintf('%.1F', $config['version']); if ($version === '1.0') { $curlOptions[CURLOPT_HTTP_VERSION] = CURL_HTTP_VERSION_1_0; From c606b1a642f8316204e6dcd1b29b74873e1f057c Mon Sep 17 00:00:00 2001 From: Denny Septian Panggabean Date: Fri, 6 Dec 2024 16:17:40 +0700 Subject: [PATCH 4/4] revert option cert --- system/HTTP/CURLRequest.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/system/HTTP/CURLRequest.php b/system/HTTP/CURLRequest.php index 5bb4ffbe859c..e3b19a59aa19 100644 --- a/system/HTTP/CURLRequest.php +++ b/system/HTTP/CURLRequest.php @@ -531,7 +531,7 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) } // Certificate - if (array_key_exists('cert', $config) && $config['cert'] !== '' || $config['cert'] !== []) { + if (array_key_exists('cert', $config) && $config['cert']) { $cert = $config['cert']; if (is_array($cert)) {