nextcloud/lib/private
Lukas Reschke 3d2600b039
Add Phan plugin to check for SQL injections
This adds a phan plugin which checks for SQL injections on code using our QueryBuilder, while it isn't perfect it should already catch most potential issues.

As always, static analysis will sometimes have false positives and this is also here the case. So in some cases the analyzer just doesn't know if something is potential user input or not, thus I had to add some `@suppress SqlInjectionChecker` in front of those potential injections.

The Phan plugin hasn't the most awesome code but it works and I also added a file with test cases.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-07-20 22:48:13 +02:00
..
Accounts Remove account data on user deletion 2017-05-15 13:31:31 +02:00
Activity Add a flag to allow checking if SVGs are okay 2017-06-20 12:40:45 +02:00
App Check the migration files for table, column and index length errors 2017-07-05 13:02:16 +02:00
AppFramework add new config switched for the global scale architecture 2017-05-29 18:19:28 +02:00
Archive replace close:// streamwrapper with CallBackWrapper 2017-01-06 15:33:32 +01:00
Authentication Merge pull request #4894 from nextcloud/generic-security-activities 2017-05-19 00:50:44 +02:00
BackgroundJob Add Phan plugin to check for SQL injections 2017-07-20 22:48:13 +02:00
Cache support pushing to CappedMemoryCache 2017-03-30 11:21:32 +02:00
Command
Comments Add Phan plugin to check for SQL injections 2017-07-20 22:48:13 +02:00
Console Fixed typo 2017-05-19 15:58:13 +02:00
Contacts/ContactsMenu Do not show an email action for contacts with emtpy email addresses 2017-05-02 14:12:04 +02:00
DB Add Phan plugin to check for SQL injections 2017-07-20 22:48:13 +02:00
Diagnostics Run phan over code base 2017-07-19 10:28:11 +02:00
Encryption only collect detailed access list if it is really needed 2017-07-06 11:33:08 +02:00
Federation Fix DI of the cloud id manager into apps 2017-02-14 12:47:46 +01:00
Files Add Phan plugin to check for SQL injections 2017-07-20 22:48:13 +02:00
GlobalScale add new config switched for the global scale architecture 2017-05-29 18:19:28 +02:00
Group filter missing groups in share provider 2017-06-12 15:46:19 +02:00
Hooks Add workaround for https://github.com/etsy/phan/issues/1033 2017-07-19 11:08:43 +02:00
Http/Client Rebrand to "Nextcloud" and add 100% coverage 2017-01-02 14:51:16 +01:00
IntegrityCheck Remove ownCloud Root Authority as per todo 2017-03-22 08:54:40 +01:00
L10N Allow to force a language and set it via the ocs api 2017-06-21 11:34:52 +02:00
legacy Merge pull request #5529 from michaelletzgus/optimize_js_order 2017-07-07 11:16:31 +02:00
Lock Add Phan plugin to check for SQL injections 2017-07-20 22:48:13 +02:00
Lockdown Remove unused use statements 2017-04-22 19:23:31 -05:00
Log Use constants 2017-04-13 12:04:32 -05:00
Mail Allow to overwrite the email template again 2017-06-06 14:23:03 +02:00
Memcache Do not scan for keys just get all the keys (with prefix) 2017-05-16 09:52:05 +02:00
Migration Start migrations 2017-07-05 13:01:19 +02:00
Notification @since 9.2.0 to @since 11.0.0 2016-11-15 18:51:52 +01:00
OCS add tests for discovery service 2017-04-11 15:04:01 +02:00
Preview Add PHPDoc 2017-05-02 13:43:47 +02:00
Repair Add Phan plugin to check for SQL injections 2017-07-20 22:48:13 +02:00
RichObjectStrings @since 9.2.0 to @since 11.0.0 2016-11-15 18:51:52 +01:00
Route Check whether the $_SERVER['REQUEST_*'] vars exist before using them 2017-05-15 14:33:27 +02:00
Search
Security Add Phan plugin to check for SQL injections 2017-07-20 22:48:13 +02:00
Session Forward port of #5190 to master 2017-06-15 11:20:49 +02:00
Settings Add Phan plugin to check for SQL injections 2017-07-20 22:48:13 +02:00
Setup Add Phan plugin to check for SQL injections 2017-07-20 22:48:13 +02:00
Share Only use readable chars in Share Tokens 2017-07-18 15:44:34 +02:00
Share20 Merge pull request #5734 from nextcloud/only-readable-chars-in-share-tokens 2017-07-19 16:40:18 +02:00
SystemTag Remove unused use statements 2017-04-22 19:23:31 -05:00
Tagging
Template Properly handle if the deps file if for some reason empty 2017-07-19 00:10:46 +02:00
Updater Remove unused use statements 2017-04-22 19:23:31 -05:00
User null users dont exist 2017-07-13 15:53:14 +02:00
AllConfig.php Merge pull request #3023 from nextcloud/issue-2915-filter-out-sensitive-appconfigs 2017-01-17 11:01:42 +01:00
AppConfig.php Make sure the spreed TURN server secret stays a secret 2017-01-17 11:29:10 +01:00
AppHelper.php
Avatar.php Add message to NotSquareException thrown from Avatar 2016-10-24 11:27:27 +02:00
AvatarManager.php avatar to appdata 2016-10-05 11:00:16 +02:00
CapabilitiesManager.php Simplify if condition for public capabilities 2017-06-30 14:18:16 +02:00
Config.php Fix escaped HTML on error pages 2017-05-08 21:16:08 -05:00
ContactsManager.php
DatabaseException.php
DatabaseSetupException.php
DateTimeFormatter.php
DateTimeZone.php
ForbiddenException.php
HintException.php add missing phpdoc to HintException 2016-11-28 11:34:23 +01:00
HTTPHelper.php
Installer.php Register autoloading before running migrations 2017-07-07 12:01:11 +02:00
LargeFileHelper.php Merge pull request #1890 from nextcloud/downstream-25428 2016-10-25 14:44:27 +02:00
Log.php Don't log passwords on dav exceptions 2017-06-29 17:20:10 +02:00
NaturalSort.php
NaturalSort_DefaultCollator.php
NavigationManager.php Don't load navigation entries of restricted apps 2017-07-05 13:52:51 +02:00
NeedsUpdateException.php
NotSquareException.php
PreviewManager.php Add PHPDoc 2017-05-02 13:43:47 +02:00
PreviewNotAvailableException.php Opening the trashbin causes errors in log for files without preview 2016-09-09 13:53:06 +02:00
RedisFactory.php no ternary 2017-03-25 21:25:38 -06:00
Repair.php adjust to moved repair step 2017-06-29 14:45:08 +02:00
RepairException.php
Search.php
Server.php Add bruteforce capabilities 2017-07-13 11:23:08 +02:00
ServerContainer.php Fix missing argument 2 for Settings classes 2017-05-19 22:32:50 +02:00
ServerNotAvailableException.php
ServiceUnavailableException.php
Setup.php Start migrations 2017-07-05 13:01:19 +02:00
Streamer.php Revert "Always enable Zip64 extension for zipstreamer" 2017-06-09 10:21:26 +02:00
SubAdmin.php Fix CamelCasing 2017-01-18 11:45:26 +01:00
SystemConfig.php Don't show mail domain and from in config report 2017-07-07 09:53:55 +02:00
TagManager.php
Tags.php
TemplateLayout.php Properly handle if the deps file if for some reason empty 2017-07-19 00:10:46 +02:00
TempManager.php
Updater.php Add migration for personal settings stuff 2017-07-05 14:58:20 +02:00
URLGenerator.php Prefer custom theme over theming app 2017-07-12 11:42:15 +02:00