StaticConfig::enableCommonName() - Code Metrics - Inspection of "split out input validation and only do that in the..." - eduVPN/vpn-server-api - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — master ( 046bfa...91fb1e )

by François

created 2016-02-22 18:55 UTC

StaticConfig::enableCommonName() A

↳ Parent: StaticConfig

Complexity

Conditions	3
Paths	2

Size

Total Lines	14
Code Lines	7

Duplication

Lines	14
Ratio	100 %

Importance

Changes	2
Bugs	0	Features	0

Metric	Value
c	2
b	0
f	0
dl	14
loc	14
rs	9.4285
cc	3
eloc	7
nc	2
nop	1

<?php
/**
 * Copyright 2015 François Kooman <[email protected]>.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
namespace fkooman\VPN\Server\Config;

use fkooman\Json\Json;
use RuntimeException;

/**
 * Manage static configuration for configurations.
 * Features:
 * - disable a configuration based on CN
 * - set static IPv4/IPv6 address for a CN.
 */
class StaticConfig
{
    /** @var string */
    private $staticConfigDir;

    /** @var IP */
    private $ipRange;

    /** @var IP */
    private $poolRange;

    public function __construct($staticConfigDir, IP $ipRange, IP $poolRange)
    {
        $this->staticConfigDir = $staticConfigDir;
        $this->ipRange = $ipRange;
        $this->poolRange = $poolRange;
    }

    public function getIpRange()
    {
        return $this->ipRange;
    }

    public function getPoolRange()
    {
        return $this->poolRange;
    }

    private function parseConfig($commonName)
    {
        $commonNamePath = sprintf('%s/%s', $this->staticConfigDir, $commonName);
        // XXX do something if file does not exist
        try {
            return Json::decodeFile($commonNamePath);
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
        } catch (RuntimeException $e) {
            return [];
        }
    }

    public function disableCommonName($commonName)

    {
        $clientConfig = $this->parseConfig($commonName);
        if (array_key_exists('disable', $clientConfig) && $clientConfig['disable']) {
            // already disabled
            return false;
        }

        $clientConfig['disable'] = true;
        $this->writeFile($commonName, $clientConfig);

        return true;
    }

    public function enableCommonName($commonName)

    {
        $clientConfig = $this->parseConfig($commonName);
        if (array_key_exists('disable', $clientConfig) && $clientConfig['disable']) {
            // it is disabled, enable it
            $clientConfig['disable'] = false;
            $this->writeFile($commonName, $clientConfig);

            return true;
        }

        // it is not disabled
        return false;
    }

    public function isDisabled($commonName)
    {
        $clientConfig = $this->parseConfig($commonName);

        return array_key_exists('disable', $clientConfig) && $clientConfig['disable'];
    }

    public function getDisabledCommonNames($userId = null)
    {
        $disabledCommonNames = array();
        $pathFilter = sprintf('%s/*', $this->staticConfigDir);
        if (!is_null($userId)) {
            $pathFilter = sprintf('%s/%s_*', $this->staticConfigDir, $userId);
        }

        foreach (glob($pathFilter) as $commonNamePath) {
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
            $commonName = basename($commonNamePath);

            if ($this->isDisabled($commonName)) {
                $disabledCommonNames[] = $commonName;
            }
        }

        return $disabledCommonNames;
    }

    public function getStaticAddresses($userId = null)
    {
        $staticAddresses = array();
        $pathFilter = sprintf('%s/*', $this->staticConfigDir);
        if (!is_null($userId)) {
            $pathFilter = sprintf('%s/%s_*', $this->staticConfigDir, $userId);
        }

        foreach (glob($pathFilter) as $commonNamePath) {
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
            $commonName = basename($commonNamePath);
            $ip = $this->getStaticAddress($commonName);
            if (!is_null($ip['v4'])) {
                $staticAddresses[$commonName] = $ip;
            }
        }

        return $staticAddresses;
    }

    public function getStaticAddress($commonName)
    {
        $clientConfig = $this->parseConfig($commonName);

        $v4 = null;
        if (array_key_exists('v4', $clientConfig)) {
            $v4 = $clientConfig['v4'];
        }

        return array(
            'v4' => $v4,
        );
    }

    public function setStaticAddresses($commonName, $v4)
    {
        if (!is_null($v4)) {

            // IP MUST be in ipRange
            if (!$this->ipRange->inRange($v4)) {
                throw new RuntimeException('IP is out of range');
            }

            // IP MUST NOT be in poolRange (including network and broadcast
            if ($this->poolRange->inRange($v4, true)) {
                throw new RuntimeException('IP cannot be in poolRange');
            }

            // cannot be server IP (we assume for now firstHost is server IP
            if ($v4 === $this->ipRange->getFirstHost()) {
                throw new RuntimeException('IP cannot be server IP');
            }

            // XXX make sure it is not already in use by another config, it is
            // okay if it is this config!
            $staticAddresses = $this->getStaticAddresses();
            foreach ($staticAddresses as $cn => $c) {
                if ($c['v4'] === $v4) {
                    if ($commonName === $cn) {
                        // the commonName is allowed to have the same address,
                        // i.e. when setting the same IPv4 address that was 
                        // already assigned to that CN
                        continue;
                    }

                    throw new RuntimeException(sprintf('IP address already in use by "%s"', $cn));
                }
            }
        }
        $clientConfig = $this->parseConfig($commonName);
        $clientConfig['v4'] = $v4;
        $this->writeFile($commonName, $clientConfig);

        return true;
    }

    private function writeFile($commonName, array $clientConfig)
    {
        $commonNamePath = sprintf('%s/%s', $this->staticConfigDir, $commonName);

        if (false === @file_put_contents($commonNamePath, Json::encode($clientConfig))) {
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}
            throw new RuntimeException('unable to write to static configuration file');
        }
    }
}


GitHub Access Token became invalid

Push — master ( 046bfa...91fb1e )

StaticConfig::enableCommonName() A

Complexity

Size

Duplication

Importance

General Strategies to prevent injection

General Strategies to prevent injection

General Strategies to prevent injection

General Strategies to prevent injection

1		<?php
2		/**
3		* Copyright 2015 François Kooman <[email protected]>.
4		*
5		* Licensed under the Apache License, Version 2.0 (the "License");
6		* you may not use this file except in compliance with the License.
7		* You may obtain a copy of the License at
8		*
9		* http://www.apache.org/licenses/LICENSE-2.0
10		*
11		* Unless required by applicable law or agreed to in writing, software
12		* distributed under the License is distributed on an "AS IS" BASIS,
13		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14		* See the License for the specific language governing permissions and
15		* limitations under the License.
16		*/
17		namespace fkooman\VPN\Server\Config;
18
19		use fkooman\Json\Json;
20		use RuntimeException;
21
22		/**
23		* Manage static configuration for configurations.
24		* Features:
25		* - disable a configuration based on CN
26		* - set static IPv4/IPv6 address for a CN.
27		*/
28		class StaticConfig
29		{
30		/** @var string */
31		private $staticConfigDir;
32
33		/** @var IP */
34		private $ipRange;
35
36		/** @var IP */
37		private $poolRange;
38
39		public function __construct($staticConfigDir, IP $ipRange, IP $poolRange)
40		{
41		$this->staticConfigDir = $staticConfigDir;
42		$this->ipRange = $ipRange;
43		$this->poolRange = $poolRange;
44		}
45
46		public function getIpRange()
47		{
48		return $this->ipRange;
49		}
50
51		public function getPoolRange()
52		{
53		return $this->poolRange;
54		}
55
56		private function parseConfig($commonName)
57		{
58		$commonNamePath = sprintf('%s/%s', $this->staticConfigDir, $commonName);
59		// XXX do something if file does not exist
60		try {
61		return Json::decodeFile($commonNamePath);
		0 ignored issues – show Security File Exposure introduced 2016-02-22 10:53 UTC by Report Bug Copy Issue Report `$commonNamePath` can contain request data and is used in file inclusion context(s) leading to a potential security vulnerability. General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
62		} catch (RuntimeException $e) {
63		return [];
64		}
65		}
66
67	View Code Duplication	public function disableCommonName($commonName)
		0 ignored issues – show Duplication introduced 2016-02-22 10:53 UTC by Report Bug Copy Issue Report This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
68		{
69		$clientConfig = $this->parseConfig($commonName);
70		if (array_key_exists('disable', $clientConfig) && $clientConfig['disable']) {
71		// already disabled
72		return false;
73		}
74
75		$clientConfig['disable'] = true;
76		$this->writeFile($commonName, $clientConfig);
77
78		return true;
79		}
80
81	View Code Duplication	public function enableCommonName($commonName)
		0 ignored issues – show Duplication introduced 2016-02-22 10:53 UTC by Report Bug Copy Issue Report This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
82		{
83		$clientConfig = $this->parseConfig($commonName);
84		if (array_key_exists('disable', $clientConfig) && $clientConfig['disable']) {
85		// it is disabled, enable it
86		$clientConfig['disable'] = false;
87		$this->writeFile($commonName, $clientConfig);
88
89		return true;
90		}
91
92		// it is not disabled
93		return false;
94		}
95
96		public function isDisabled($commonName)
97		{
98		$clientConfig = $this->parseConfig($commonName);
99
100		return array_key_exists('disable', $clientConfig) && $clientConfig['disable'];
101		}
102
103		public function getDisabledCommonNames($userId = null)
104		{
105		$disabledCommonNames = array();
106		$pathFilter = sprintf('%s/*', $this->staticConfigDir);
107		if (!is_null($userId)) {
108		$pathFilter = sprintf('%s/%s_*', $this->staticConfigDir, $userId);
109		}
110
111		foreach (glob($pathFilter) as $commonNamePath) {
		0 ignored issues – show Security File Exposure introduced 2016-02-22 10:53 UTC by Report Bug Copy Issue Report `$pathFilter` can contain request data and is used in file inclusion context(s) leading to a potential security vulnerability. General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
112		$commonName = basename($commonNamePath);
113
114		if ($this->isDisabled($commonName)) {
115		$disabledCommonNames[] = $commonName;
116		}
117		}
118
119		return $disabledCommonNames;
120		}
121
122		public function getStaticAddresses($userId = null)
123		{
124		$staticAddresses = array();
125		$pathFilter = sprintf('%s/*', $this->staticConfigDir);
126		if (!is_null($userId)) {
127		$pathFilter = sprintf('%s/%s_*', $this->staticConfigDir, $userId);
128		}
129
130		foreach (glob($pathFilter) as $commonNamePath) {
		0 ignored issues – show Security File Exposure introduced 2016-02-22 10:53 UTC by Report Bug Copy Issue Report `$pathFilter` can contain request data and is used in file inclusion context(s) leading to a potential security vulnerability. General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
131		$commonName = basename($commonNamePath);
132		$ip = $this->getStaticAddress($commonName);
133		if (!is_null($ip['v4'])) {
134		$staticAddresses[$commonName] = $ip;
135		}
136		}
137
138		return $staticAddresses;
139		}
140
141		public function getStaticAddress($commonName)
142		{
143		$clientConfig = $this->parseConfig($commonName);
144
145		$v4 = null;
146		if (array_key_exists('v4', $clientConfig)) {
147		$v4 = $clientConfig['v4'];
148		}
149
150		return array(
151		'v4' => $v4,
152		);
153		}
154
155		public function setStaticAddresses($commonName, $v4)
156		{
157		if (!is_null($v4)) {
158
159		// IP MUST be in ipRange
160		if (!$this->ipRange->inRange($v4)) {
161		throw new RuntimeException('IP is out of range');
162		}
163
164		// IP MUST NOT be in poolRange (including network and broadcast
165		if ($this->poolRange->inRange($v4, true)) {
166		throw new RuntimeException('IP cannot be in poolRange');
167		}
168
169		// cannot be server IP (we assume for now firstHost is server IP
170		if ($v4 === $this->ipRange->getFirstHost()) {
171		throw new RuntimeException('IP cannot be server IP');
172		}
173
174		// XXX make sure it is not already in use by another config, it is
175		// okay if it is this config!
176		$staticAddresses = $this->getStaticAddresses();
177		foreach ($staticAddresses as $cn => $c) {
178		if ($c['v4'] === $v4) {
179		if ($commonName === $cn) {
180		// the commonName is allowed to have the same address,
181		// i.e. when setting the same IPv4 address that was
182		// already assigned to that CN
183		continue;
184		}
185
186		throw new RuntimeException(sprintf('IP address already in use by "%s"', $cn));
187		}
188		}
189		}
190		$clientConfig = $this->parseConfig($commonName);
191		$clientConfig['v4'] = $v4;
192		$this->writeFile($commonName, $clientConfig);
193
194		return true;
195		}
196
197		private function writeFile($commonName, array $clientConfig)
198		{
199		$commonNamePath = sprintf('%s/%s', $this->staticConfigDir, $commonName);
200
201		if (false === @file_put_contents($commonNamePath, Json::encode($clientConfig))) {
		0 ignored issues – show Security File Manipulation introduced 2016-02-22 10:53 UTC by Report Bug Copy Issue Report `$commonNamePath` can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability. General Strategies to prevent injection In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values: if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); } For numeric data, we recommend to explicitly cast the data: $sanitized = (integer) $tainted; Loading history...
202		throw new RuntimeException('unable to write to static configuration file');
203		}
204		}
205		}
206

eduVPN / vpn-server-api

GitHub Access Token became invalid

Push — master ( 046bfa...91fb1e )

StaticConfig::enableCommonName() A

Complexity

Size

Duplication

Importance

General Strategies to prevent injection

General Strategies to prevent injection

General Strategies to prevent injection

General Strategies to prevent injection

Duplication Side-by-Side

Filter issues like