ComodoDecodeCSR::addWarning() - Code Metrics - Inspection of "Check again using https:// before saying a it will..." - XigenChris/ComodoDecodeCSR - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — develop ( e30e33...f509d5 )

by Chris

created 2016-09-13 11:42 UTC

ComodoDecodeCSR::addWarning() A

↳ Parent: ComodoDecodeCSR

Complexity

Conditions	1
Paths	1

Size

Total Lines	6
Code Lines	3

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	2
CRAP Score	1.216

Importance

Changes

Metric	Value
c	0
b	0
f	0
dl	0
loc	6
ccs	2
cts	5
cp	0.4
rs	9.4285
cc	1
eloc	3
nc	1
nop	2
crap	1.216

<?php
/**
 * @author     Chris Hilsdon <[email protected]>
 * @package    ComodoDecodeCSR
 * @copyright  2016 Xigen
 * @license    GNU General Public License v3
 * @link       https://github.com/XigenChris/ComodoDecodeCSR
 */

namespace Xigen;

use GuzzleHttp\Client;
use GuzzleHttp\Exception\ClientException;
use GuzzleHttp\Psr7\Response;

class ComodoDecodeCSR
{
    use Traits\GetSetUnset;

    protected $MD5;
    protected $SHA1;
    protected $Endpoint = "https://secure.comodo.net/products/!decodeCSR";
    protected $CSR;
    /**
     * An array of warnings that can be show after the test
     * @var array
     */
    protected $warnings = [];
    protected $Form = [
        'responseFormat' => 'N',
        'showErrorCodes' => 'N',
        'showErrorMessages' => 'N',
        'showFieldNames' => 'N',
        'showEmptyFields' => 'N',
        'showCN' => 'N',
        'showAddress' => 'N',
        'showPublicKey' => 'N',
        'showKeySize' => 'N',
        'showSANDNSNames' => 'Y',
        'showCSR' => 'N',
        'showCSRHashes' => 'Y',
        'showSignatureAlgorithm' => 'N',
        'product' => '',
        'countryNameType' => 'TWOCHAR'
    ];
    private $request;

    private $forceSSL = false;

    public function getCN()
    {
        $CSRInfo = $this->decodeCSR();
        return $CSRInfo['subject']['CN'];
    }

    public function setCSR($csr)
    {
        $this->CSR = $csr;
        //Check that this is a valid CSR
        $this->decodeCSR();
        $this->Form['csr'] = $csr;
    }

    protected function addWarning($code, $message)
    {
        $this->warnings[] = [
            $code => $message
        ];
    }

    public function fetchHashes()
    {
        $client = new Client();

        $this->request = $client->request('POST', $this->getEndpoint(), [
            'form_params' => $this->Form
        ]);

        return $this->processResponse();
    }

    public function checkInstalled()
    {

        try {
            $domain = $this->getCN();
        } catch (\Exception $e) {
            return false;
        }

        $response = $this->fetchDVCFile($domain);
        if ($response == false) {
            return false;
        }

        $check = $this->checkDVC($response);

        if ($check === true) {
            return $check;
        }

        //Try again but this time use https://
        $this->forceSSL = true;

        $response = $this->fetchDVCFile($domain);
        if ($response == false) {
            return false;
        }

        $check = $this->checkDVC($response);

        if ($check === true) {
            //TODO Add a message to say then you will need to select 'HTTPS CSR
            //Hash'
            return $check;
        }

        return false;
    }

    public function generateDVC()
    {
        $DVC = $this->getSHA1() . "\n";
        $DVC .= "comodoca.com\n";

        return $DVC;
    }

    /**
     *
     * @param  GuzzleHttp\Psr7\Response $response
     * @return bool
     */
    public function checkDVC(Response $response)
    {
        $body = $response->getBody() . '';
        $DVC = $this->generateDVC();

        //Check if we received a 301 or 302 redirect
        if ($response->getStatusCode() === 301 || $response->getStatusCode() == 302) {
            return false;
        }

        //If the response matches the DVC value return true
        if ($body === $DVC) {
            return true;
        }

        //Check if last 2 characters are new lines
        if (substr($body, -2) === "\n\n") {
            $body = substr($body, 0, -2) . "\n";
        }

        //Check if last character is not a new line
        if (substr($body, -1) !== "\n") {
            //Add said new line
            $body = $body . "\n";
        }

        var_dump($body, $DVC);


        //Check it again
        if ($body === $DVC) {
            return true;
        }

        return false;
    }

    private function decodeCSR()
    {
        try {
            $data = openssl_csr_get_public_key($this->getCSR());
            $details = openssl_pkey_get_details($data);
            $key = $details['key'];
            $subject = openssl_csr_get_subject($this->getCSR());
        } catch (\Exception $e) {
            throw new Exception("Invalid CSR");
        }

        return array(
            "subject" => $subject,
            "key" => $key
        );
    }

    private function processResponse()
    {
        $response = $this->request->getBody();
        $lines = explode("\n", $response);
        $data = array();
        //Remove the first array as we don't need the SAN and can cause problems
        //with a multi domain SAN
        unset($lines[0]);

        foreach ($lines as $v) {
            if (!empty($v)) {
                $value = explode("=", $v);
                $data[$value[0]] = $value[1];
            }
        }

        $this->setMD5($data["md5"]);
        $this->setSHA1($data["sha1"]);

        return $data ? $data : false;
    }

    private function fetchDVCFile($domain)
    {
        //We do most of our DVC over http:// unless the site is fully SSL
        $protocol = 'http://';

        if ($this->forceSSL) {
            $protocol = 'https://';
        }

        $url = $protocol . $domain . "/" . $this->getMD5() . '.txt';

        $client = new Client(['allow_redirects' => false, 'verify' => false]);

        try {
            $response = $client->request('GET', $url);
        } catch (ClientException $e) {
            var_dump('te', $e);

            return false;
        }

        return $response;
    }
}


1		<?php
2		/**
3		* @author Chris Hilsdon <[email protected]>
4		* @package ComodoDecodeCSR
5		* @copyright 2016 Xigen
6		* @license GNU General Public License v3
7		* @link https://github.com/XigenChris/ComodoDecodeCSR
8		*/
9
10		namespace Xigen;
11
12		use GuzzleHttp\Client;
13		use GuzzleHttp\Exception\ClientException;
14		use GuzzleHttp\Psr7\Response;
15
16		class ComodoDecodeCSR
17		{
18		use Traits\GetSetUnset;
19
20		protected $MD5;
21		protected $SHA1;
22		protected $Endpoint = "https://secure.comodo.net/products/!decodeCSR";
23		protected $CSR;
24		/**
25		* An array of warnings that can be show after the test
26		* @var array
27		*/
28		protected $warnings = [];
29		protected $Form = [
30		'responseFormat' => 'N',
31		'showErrorCodes' => 'N',
32		'showErrorMessages' => 'N',
33		'showFieldNames' => 'N',
34		'showEmptyFields' => 'N',
35		'showCN' => 'N',
36		'showAddress' => 'N',
37		'showPublicKey' => 'N',
38		'showKeySize' => 'N',
39		'showSANDNSNames' => 'Y',
40		'showCSR' => 'N',
41		'showCSRHashes' => 'Y',
42		'showSignatureAlgorithm' => 'N',
43		'product' => '',
44		'countryNameType' => 'TWOCHAR'
45		];
46		private $request;
47
48		private $forceSSL = false;
49
50	4	public function getCN()
51		{
52	4	$CSRInfo = $this->decodeCSR();
53	4	return $CSRInfo['subject']['CN'];
54		}
55
56	15	public function setCSR($csr)
57		{
58	15	$this->CSR = $csr;
59		//Check that this is a valid CSR
60	15	$this->decodeCSR();
61	12	$this->Form['csr'] = $csr;
62	12	}
63
64	12	protected function addWarning($code, $message)
65	12	{
66		$this->warnings[] = [
67		$code => $message
68		];
69		}
70
71	12	public function fetchHashes()
72		{
73	12	$client = new Client();
74
75	12	$this->request = $client->request('POST', $this->getEndpoint(), [
76	12	'form_params' => $this->Form
77	12	]);
78
79	12	return $this->processResponse();
80		}
81
82	3	public function checkInstalled()
83		{
84
85		try {
86	3	$domain = $this->getCN();
87	3	} catch (\Exception $e) {
88		return false;
89		}
90
91	3	$response = $this->fetchDVCFile($domain);
92	3	if ($response == false) {
93	1	return false;
94		}
95
96	2	$check = $this->checkDVC($response);
		0 ignored issues – show Compatibility introduced 2016-09-13 11:46 UTC by Report Bug Copy Issue Report `$response` of type `object<Psr\Http\Message\ResponseInterface>` is not a sub-type of `object<GuzzleHttp\Psr7\Response>`. It seems like you assume a concrete implementation of the interface `Psr\Http\Message\ResponseInterface` to be always present. This check looks for parameters that are defined as one type in their type hint or doc comment but seem to be used as a narrower type, i.e an implementation of an interface or a subclass. Consider changing the type of the parameter or doing an instanceof check before assuming your parameter is of the expected type. Loading history...
97	2	if ($check === true) {
98	2	return $check;
99		}
100
101		//Try again but this time use https://
102		$this->forceSSL = true;
103
104		$response = $this->fetchDVCFile($domain);
105		if ($response == false) {
106		return false;
107		}
108
109		$check = $this->checkDVC($response);
		0 ignored issues – show Compatibility introduced 2016-08-17 12:56 UTC by Report Bug Copy Issue Report `$response` of type `object<Psr\Http\Message\ResponseInterface>` is not a sub-type of `object<GuzzleHttp\Psr7\Response>`. It seems like you assume a concrete implementation of the interface `Psr\Http\Message\ResponseInterface` to be always present. This check looks for parameters that are defined as one type in their type hint or doc comment but seem to be used as a narrower type, i.e an implementation of an interface or a subclass. Consider changing the type of the parameter or doing an instanceof check before assuming your parameter is of the expected type. Loading history...
110		if ($check === true) {
111		//TODO Add a message to say then you will need to select 'HTTPS CSR
112		//Hash'
113		return $check;
114		}
115
116		return false;
117		}
118
119	11	public function generateDVC()
120		{
121	11	$DVC = $this->getSHA1() . "\n";
122	11	$DVC .= "comodoca.com\n";
123
124	11	return $DVC;
125		}
126
127		/**
128		*
129		* @param GuzzleHttp\Psr7\Response $response
130		* @return bool
131		*/
132	10	public function checkDVC(Response $response)
133		{
134	10	$body = $response->getBody() . '';
135	10	$DVC = $this->generateDVC();
136
137		//Check if we received a 301 or 302 redirect
138	10	if ($response->getStatusCode() === 301 \|\| $response->getStatusCode() == 302) {
139	2	return false;
140		}
141
142		//If the response matches the DVC value return true
143	8	if ($body === $DVC) {
144	3	return true;
145		}
146
147		//Check if last 2 characters are new lines
148	5	if (substr($body, -2) === "\n\n") {
149	1	$body = substr($body, 0, -2) . "\n";
150	1	}
151
152		//Check if last character is not a new line
153	5	if (substr($body, -1) !== "\n") {
154		//Add said new line
155	2	$body = $body . "\n";
156	2	}
157
158	5	var_dump($body, $DVC);
		0 ignored issues – show Security Debugging Code introduced 2016-09-13 11:46 UTC by Report Bug Copy Issue Report `var_dump($body, $DVC);` looks like debug code. Are you sure you do not want to remove it? This might expose sensitive data. Loading history...
159
160		//Check it again
161	5	if ($body === $DVC) {
162	2	return true;
163		}
164
165	3	return false;
166		}
167
168	15	private function decodeCSR()
169		{
170		try {
171	15	$data = openssl_csr_get_public_key($this->getCSR());
172	15	$details = openssl_pkey_get_details($data);
173	12	$key = $details['key'];
174	12	$subject = openssl_csr_get_subject($this->getCSR());
175	15	} catch (\Exception $e) {
176	3	throw new Exception("Invalid CSR");
177		}
178
179		return array(
180	12	"subject" => $subject,
181		"key" => $key
182	12	);
183		}
184
185	12	private function processResponse()
186		{
187	12	$response = $this->request->getBody();
188	12	$lines = explode("\n", $response);
189	12	$data = array();
190		//Remove the first array as we don't need the SAN and can cause problems
191		//with a multi domain SAN
192	12	unset($lines[0]);
193
194	12	foreach ($lines as $v) {
195	12	if (!empty($v)) {
196	12	$value = explode("=", $v);
197	12	$data[$value[0]] = $value[1];
198	12	}
199	12	}
200
201	12	$this->setMD5($data["md5"]);
202	12	$this->setSHA1($data["sha1"]);
203
204	12	return $data ? $data : false;
205		}
206
207	3	private function fetchDVCFile($domain)
208		{
209		//We do most of our DVC over http:// unless the site is fully SSL
210	3	$protocol = 'http://';
211
212	3	if ($this->forceSSL) {
213		$protocol = 'https://';
214		}
215
216	3	$url = $protocol . $domain . "/" . $this->getMD5() . '.txt';
217
218	3	$client = new Client(['allow_redirects' => false, 'verify' => false]);
219
220		try {
221	3	$response = $client->request('GET', $url);
222	3	} catch (ClientException $e) {
223	1	var_dump('te', $e);
		0 ignored issues – show Security Debugging Code introduced 2016-09-13 11:46 UTC by Report Bug Copy Issue Report `var_dump('te', $e);` looks like debug code. Are you sure you do not want to remove it? This might expose sensitive data. Loading history...
224	1	return false;
225		}
226
227	2	return $response;
228		}
229		}
230

XigenChris / ComodoDecodeCSR

Push — develop ( e30e33...f509d5 )

ComodoDecodeCSR::addWarning() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like