GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

VerifyReCaptcha   A
last analyzed

Complexity

Total Complexity 10

Size/Duplication

Total Lines 53
Duplicated Lines 0 %

Coupling/Cohesion

Components 0
Dependencies 5

Importance

Changes 2
Bugs 0 Features 0
Metric Value
wmc 10
c 2
b 0
f 0
lcom 0
cbo 5
dl 0
loc 53
rs 10

1 Method

Rating   Name   Duplication   Size   Complexity  
D handle() 0 43 10
1
<?php
2
3
namespace Pterodactyl\Http\Middleware;
4
5
use Closure;
6
use Pterodactyl\Events\Auth\FailedCaptcha;
7
8
class VerifyReCaptcha
9
{
10
    /**
11
     * Handle an incoming request.
12
     *
13
     * @param  \Illuminate\Http\Request  $request
14
     * @param  \Closure  $next
15
     * @return \Illuminate\Http\RediectResponse
16
     */
17
    public function handle($request, Closure $next)
18
    {
19
        if (! config('recaptcha.enabled')) {
20
            return $next($request);
21
        }
22
23
        if ($request->has('g-recaptcha-response')) {
24
            $client = new \GuzzleHttp\Client();
25
            $res = $client->post(config('recaptcha.domain'), [
26
                'form_params' => [
27
                    'secret' => config('recaptcha.secret_key'),
28
                    'response' => $request->input('g-recaptcha-response'),
29
                ],
30
            ]);
31
32
            if ($res->getStatusCode() === 200) {
33
                $result = json_decode($res->getBody());
34
35
                $verified = function ($result, $request) {
36
                    if (! config('recaptcha.verify_domain')) {
37
                        return false;
38
                    }
39
40
                    $url = parse_url($request->url());
41
42
                    if (! array_key_exists('host', $url)) {
43
                        return false;
44
                    }
45
46
                    return $result->hostname === $url['host'];
47
                };
48
49
                if ($result->success && (! config('recaptcha.verify_domain') || $verified($result, $request))) {
50
                    return $next($request);
51
                }
52
            }
53
        }
54
55
        // Emit an event and return to the previous view with an error (only the captcha error will be shown!)
56
        event(new FailedCaptcha($request->ip(), (! isset($result->hostname) ?: $result->hostname)));
0 ignored issues
show
Bug introduced by
The variable $result does not seem to be defined for all execution paths leading up to this point.

If you define a variable conditionally, it can happen that it is not defined for all execution paths.

Let’s take a look at an example:

function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}

In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined.

Available Fixes

  1. Check for existence of the variable explicitly:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        if (isset($x)) { // Make sure it's always set.
            echo $x;
        }
    }
    
  2. Define a default value for the variable:

    function myFunction($a) {
        $x = ''; // Set a default which gets overridden for certain paths.
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        echo $x;
    }
    
  3. Add a value for the missing path:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
    
            // We add support for the missing case.
            default:
                $x = '';
                break;
        }
    
        echo $x;
    }
    
Loading history...
57
58
        return back()->withErrors(['g-recaptcha-response' => trans('strings.captcha_invalid')])->withInput();
0 ignored issues
show
Bug Best Practice introduced by
The return type of return back()->withError...valid')))->withInput(); (Illuminate\Http\RedirectResponse) is incompatible with the return type documented by Pterodactyl\Http\Middlew...VerifyReCaptcha::handle of type Illuminate\Http\RediectResponse.

If you return a value from a function or method, it should be a sub-type of the type that is given by the parent type f.e. an interface, or abstract method. This is more formally defined by the Lizkov substitution principle, and guarantees that classes that depend on the parent type can use any instance of a child type interchangably. This principle also belongs to the SOLID principles for object oriented design.

Let’s take a look at an example:

class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}

Our function my_function expects a Post object, and outputs the author of the post. The base class Post returns a simple string and outputting a simple string will work just fine. However, the child class BlogPost which is a sub-type of Post instead decided to return an object, and is therefore violating the SOLID principles. If a BlogPost were passed to my_function, PHP would not complain, but ultimately fail when executing the strtoupper call in its body.

Loading history...
59
    }
60
}
61