php-guard /
oauth-server
| Conditions | 13 |
| Paths | 17 |
| Total Lines | 91 |
| Code Lines | 40 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
| 1 | <?php |
||
| 80 | public function handleAccessTokenRequest(TokenEndpoint $tokenEndpoint, array $requestData): array |
||
| 81 | { |
||
| 82 | if (empty($requestData['code'])) { |
||
| 83 | throw new OAuthException('invalid_request', |
||
| 84 | 'The request is missing the required parameter code', |
||
| 85 | 'https://tools.ietf.org/html/rfc7636#section-4.4'); |
||
| 86 | } |
||
| 87 | $code = $requestData['code']; |
||
| 88 | |||
| 89 | $authorizationCode = $this->authorizationCodeStorage->find($code); |
||
| 90 | |||
| 91 | /** |
||
| 92 | * ensure that the authorization code was issued to the authenticated |
||
| 93 | * confidential client, or if the client is public, ensure that the |
||
| 94 | * code was issued to "client_id" in the request, |
||
| 95 | */ |
||
| 96 | if (!$authorizationCode || $authorizationCode->getClientIdentifier() !== $tokenEndpoint->getClient()->getIdentifier()) { |
||
| 97 | throw new OAuthException('invalid_grant', |
||
| 98 | 'The request includes the invalid parameter code', |
||
| 99 | 'https://tools.ietf.org/html/rfc7636#section-4.4'); |
||
| 100 | } |
||
| 101 | |||
| 102 | $this->authorizationCodeStorage->revoke($code); |
||
| 103 | |||
| 104 | /** |
||
| 105 | * verify that the authorization code is valid |
||
| 106 | */ |
||
| 107 | if ($authorizationCode->isExpired()) { |
||
| 108 | throw new OAuthException('invalid_grant', |
||
| 109 | 'The request includes the invalid parameter code. The code has expired', |
||
| 110 | 'https://tools.ietf.org/html/rfc7636#section-4.4'); |
||
| 111 | } |
||
| 112 | |||
| 113 | /** |
||
| 114 | * ensure that the "redirect_uri" parameter is present if the |
||
| 115 | * "redirect_uri" parameter was included in the initial authorization |
||
| 116 | * request as described in Section 4.1.1, and if included ensure that |
||
| 117 | * their values are identical. |
||
| 118 | */ |
||
| 119 | if ($authorizationCode->getRedirectUri()) { |
||
| 120 | if (empty($requestData['redirect_uri'])) { |
||
| 121 | throw new OAuthException('invalid_request', |
||
| 122 | 'The request is missing the required parameter redirect_uri', |
||
| 123 | 'https://tools.ietf.org/html/rfc7636#section-4.1'); |
||
| 124 | } |
||
| 125 | if ($requestData['redirect_uri'] !== $authorizationCode->getRedirectUri()) { |
||
| 126 | throw new OAuthException('invalid_request', |
||
| 127 | 'The request includes the invalid parameter redirect_uri', |
||
| 128 | 'https://tools.ietf.org/html/rfc7636#section-4.1'); |
||
| 129 | } |
||
| 130 | } |
||
| 131 | |||
| 132 | $codeChallenge = $this->authorizationCodeStorage->getCodeChallenge($authorizationCode); |
||
| 133 | |||
| 134 | if ($codeChallenge && $codeChallenge->getCodeChallenge()) { |
||
| 135 | if (empty($requestData['code_verifier'])) { |
||
| 136 | throw new OAuthException('invalid_request', |
||
| 137 | 'The request is missing the required parameter code_verifier', |
||
| 138 | 'https://tools.ietf.org/html/rfc7636#section-4.4'); |
||
| 139 | } |
||
| 140 | |||
| 141 | if ($codeChallenge->getCodeChallengeMethod() === 'S256') { |
||
| 142 | /** |
||
| 143 | * If the "code_challenge_method" from Section 4.3 was "S256", the |
||
| 144 | * received "code_verifier" is hashed by SHA-256, base64url-encoded, and |
||
| 145 | * then compared to the "code_challenge", i.e.: |
||
| 146 | */ |
||
| 147 | $hashedCodeVerifier = self::base64url_encode(hash('sha256', $requestData['code_verifier'])); |
||
| 148 | } else { |
||
| 149 | /** |
||
| 150 | * If the "code_challenge_method" from Section 4.3 was "plain", they are |
||
| 151 | * compared directly, i.e.: |
||
| 152 | */ |
||
| 153 | $hashedCodeVerifier = $requestData['code_verifier']; |
||
| 154 | } |
||
| 155 | |||
| 156 | /** |
||
| 157 | * If the values are equal, the token endpoint MUST continue processing |
||
| 158 | * as normal (as defined by OAuth 2.0 [RFC6749]). If the values are not |
||
| 159 | * equal, an error response indicating "invalid_grant" as described in |
||
| 160 | * Section 5.2 of [RFC6749] MUST be returned. |
||
| 161 | */ |
||
| 162 | if ($hashedCodeVerifier !== $codeChallenge->getCodeChallenge()) { |
||
| 163 | throw new OAuthException('invalid_grant', |
||
| 164 | 'The request includes the invalid parameter code_verifier', |
||
| 165 | 'https://tools.ietf.org/html/rfc7636#section-4.4'); |
||
| 166 | } |
||
| 167 | } |
||
| 168 | |||
| 169 | return $tokenEndpoint->issueTokens($authorizationCode->getScope(), |
||
| 170 | $authorizationCode->getResourceOwnerIdentifier(), $authorizationCode->getCode()); |
||
| 171 | } |
||
| 198 | } |
Loading history...
This check compares calls to functions or methods with their respective definitions. If the call has less arguments than are defined, it raises an issue.
If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above.