SpiUtils

Complexity

Total Complexity

45

Size/Duplication

Total Lines	215
Duplicated Lines	0 %

Importance

Changes	1
Bugs	0	Features	0

15 Methods

Rating	Name	Duplication	Size	Complexity
A	getParamStrFromMap()	0	12	3
A	sign()	0	10	2
A	startsWith()	0	2	2
A	getQueryMap()	0	18	4
A	getFormMap()	0	6	2
B	getHeaderMap()	0	23	7
A	checkSign4FormRequest()	0	2	1
A	checkTimestamp()	0	8	2
A	checkRemoteIp()	0	11	5
A	clear_blank()	0	3	1
A	checkSign4FileRequest()	0	2	1
B	checkSign()	0	38	10
A	checkSign4TextRequest()	0	2	1
A	logCommunicationError()	0	14	2
A	endWith()	0	7	2

<?php
class SpiUtils{
	private static $top_sign_list = "HTTP_TOP_SIGN_LIST";

The private property $top_sign_list is not used, and could be removed.

	private static $timestamp = "timestamp";

The private property $timestamp is not used, and could be removed.

	private static $header_real_ip = array("X_Real_IP", "X_Forwarded_For", "Proxy_Client_IP",

The private property $header_real_ip is not used, and could be removed.

											"WL_Proxy_Client_IP", "HTTP_CLIENT_IP", "HTTP_X_FORWARDED_FOR");
	/**
	 * 校验SPI请求签名，适用于所有GET请求，及不包含文件参数的POST请求。
	 * 
	 * @param request 请求对象

The doc comment 请求对象 at position 0 could not be parsed: Unknown type name '请求对象' at position 0 in 请求对象.

	 * @param secret app对应的secret
	 * @return true：校验通过；false：校验不通过

The doc comment true：校验通过；false：校验不通过 at position 0 could not be parsed: Unknown type name 'true：校验通过；false：校验不通过' at position 0 in true：校验通过；false：校验不通过.

	 */
	public static function checkSign4FormRequest($secret){
		return self::checkSign(null,null,$secret);
	}

	/**
	 * 校验SPI请求签名，适用于请求体是xml/json等可用文本表示的POST请求。
	 * 
	 * @param request 请求对象

The doc comment 请求对象 at position 0 could not be parsed: Unknown type name '请求对象' at position 0 in 请求对象.

	 * @param body 请求体的文本内容
	 * @param secret app对应的secret
	 * @return true：校验通过；false：校验不通过

The doc comment true：校验通过；false：校验不通过 at position 0 could not be parsed: Unknown type name 'true：校验通过；false：校验不通过' at position 0 in true：校验通过；false：校验不通过.

	 */
	public static function checkSign4TextRequest($body,$secret){
		return self::checkSign(null,$body,$secret);
	}
	
	/**
	 * 校验SPI请求签名，适用于带文件上传的POST请求。
	 * 
	 * @param request 请求对象

The doc comment 请求对象 at position 0 could not be parsed: Unknown type name '请求对象' at position 0 in 请求对象.

	 * @param form 除了文件参数以外的所有普通文本参数的map集合
	 * @param secret app对应的secret
	 * @return true：校验通过；false：校验不通过

The doc comment true：校验通过；false：校验不通过 at position 0 could not be parsed: Unknown type name 'true：校验通过；false：校验不通过' at position 0 in true：校验通过；false：校验不通过.

	 */
	public static function checkSign4FileRequest($form, $secret){
		return self::checkSign($form, null, $secret);
	}

	private static function checkSign($form, $body, $secret) {
		$params = array();
		// 1. 获取header参数
		$headerMap = self::getHeaderMap();
		foreach ($headerMap as $k => $v){
			$params[$k] = $v ;
		}

		// 2. 获取url参数
		$queryMap = self::getQueryMap();
		foreach ($queryMap as $k => $v){
			$params[$k] = $v ;
		}

		// 3. 获取form参数
		if ($form == null && $body == null) {
			$formMap = self::getFormMap();
			foreach ($formMap as $k => $v){
				$params[$k] = $v ;
			}
		} else if ($form != null) {
			foreach ($form as $k => $v){
				$params[$k] = $v ;
			}
		}

		if($body == null){
			$body = file_get_contents('php://input');
		}

		$remoteSign = $queryMap["sign"];
		$localSign = self::sign($params, $body, $secret);
		if (strcmp($remoteSign, $localSign) == 0) {
			return true;
		} else {
			$paramStr = self::getParamStrFromMap($params);
			self::logCommunicationError($remoteSign,$localSign,$paramStr,$body);
			return false;
		}
	}

	private static function getHeaderMap() {
		$headerMap = array();
		$signList = $_SERVER['HTTP_TOP_SIGN_LIST']; // 只获取参与签名的头部字段

		if(!$signList) {
			return $headerMap;
		}

		$signList = trim($signList);
		if (strlen($signList) > 0){
			$params = split(",", $signList);

The function split() has been deprecated: 5.3.0 Use preg_split() instead

			foreach ($_SERVER as $k => $v){
				if (substr($k, 0, 5) == 'HTTP_'){
					foreach($params as $kk){
						$upperkey = strtoupper($kk);
						if(self::endWith($k,$upperkey)){
							$headerMap[$kk] = $v;
						}
					}
				}
			}
		}
		return $headerMap;
	}

	private static function getQueryMap(){
		$queryStr = $_SERVER["QUERY_STRING"];
		$resultArray = array();
		foreach (explode('&', $queryStr) as $pair) {
		    list($key, $value) = explode('=', $pair);
		    if (strpos($key, '.') !== false) {
		        list($subKey, $subVal) = explode('.', $key);

		        if (preg_match('/(?P<name>\w+)\[(?P<index>\w+)\]/', $subKey, $matches)) {
		            $resultArray[$matches['name']][$matches['index']][$subVal] = $value;
		        } else {
		            $resultArray[$subKey][$subVal] = urldecode($value);
		        }
		    } else {
		        $resultArray[$key] = urldecode($value);
		    }
		}
		return $resultArray;
	}

	private static function checkRemoteIp(){

The method checkRemoteIp() is not used, and could be removed.

		$remoteIp = $_SERVER["REMOTE_ADDR"];
		foreach ($header_real_ip as $k){

The variable $header_real_ip seems to be never defined.

			$realIp = $_SERVER[$k];
			$realIp = trim($realIp);
			if(strlen($realIp) > 0 && strcasecmp("unknown",$realIp)){
				$remoteIp = $realIp;
				break;
			}
		}
		return self::startsWith($remoteIp,"140.205.144.") || self::startsWith($remoteIp,"40.205.145.");
	}

	private static function getFormMap(){
		$resultArray = array();
		foreach($_POST as $key=>$v) { 
			$resultArray[$key] = $v ;
		}
		return $resultArray ;	
	}

	private static function startsWith($haystack, $needle) {
    	return $needle === "" || strpos($haystack, $needle) === 0;
	}

	private static function endWith($haystack, $needle) {   
	    $length = strlen($needle);  
	    if($length == 0)
	    {    
	        return true;  
	    }  
	    return (substr($haystack, -$length) === $needle);
 	}

	private static function checkTimestamp(){

The method checkTimestamp() is not used, and could be removed.

		$ts = $_POST['timestamp'];
		if($ts){
			$clientTimestamp = strtotime($ts);
			$current = $_SERVER['REQUEST_TIME'];
			return ($current - $clientTimestamp) <= 5*60*1000;
		}else{
			return false;
		}
	}

	private static function getParamStrFromMap($params){
		ksort($params);
		$stringToBeSigned = "";
		foreach ($params as $k => $v)
		{
			if(strcmp("sign", $k) != 0)
			{
				$stringToBeSigned .= "$k$v";
			}
		}
		unset($k, $v);
		return $stringToBeSigned;
	}

	private static function sign($params,$body,$secret){
		ksort($params);

		$stringToBeSigned = $secret;
		$stringToBeSigned .= self::getParamStrFromMap($params);

		if($body)
			$stringToBeSigned .= $body;
		$stringToBeSigned .= $secret;
		return strtoupper(md5($stringToBeSigned));
	}

	protected static function logCommunicationError($remoteSign, $localSign, $paramStr, $body)
	{
		$localIp = isset($_SERVER["SERVER_ADDR"]) ? $_SERVER["SERVER_ADDR"] : "CLI";

The assignment to $localIp is dead and can be removed.

		$logger = new TopLogger;
		$logger->conf["log_file"] = rtrim(TOP_SDK_WORK_DIR, '\\/') . '/' . "logs/top_comm_err_". date("Y-m-d") . ".log";
		$logger->conf["separator"] = "^_^";
		$logData = array(
		"checkTopSign error" ,
		"remoteSign=".$remoteSign ,
		"localSign=".$localSign ,
		"paramStr=".$paramStr ,
		"body=".$body
		);
		$logger->log($logData);
	}
	private static function clear_blank($str, $glue='')

The method clear_blank() is not used, and could be removed.

	{
		$replace = array(" ", "\r", "\n", "\t"); return str_replace($replace, $glue, $str);
	}
}
?>

It is not recommended to use PHP's closing tag ?> in files other than templates.