This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /* |
||
4 | * This file is part of the GestPayWS library. |
||
5 | * |
||
6 | * (c) Manuel Dalla Lana <[email protected]> |
||
7 | * |
||
8 | * This source file is subject to the MIT license that is bundled |
||
9 | * with this source code in the file LICENSE. |
||
10 | */ |
||
11 | |||
12 | namespace EndelWar\GestPayWS\Parameter; |
||
13 | |||
14 | use InvalidArgumentException; |
||
15 | |||
16 | /** |
||
17 | * Class EncryptParameter |
||
18 | * @package EndelWar\GestPayWS\Parameter |
||
19 | * |
||
20 | * @property string $shopLogin |
||
21 | * @property int $uicCode; |
||
22 | * @property float $amount; |
||
23 | * @property string $shopTransactionId; |
||
24 | * @property string $buyerName; |
||
25 | * @property string $buyerEmail; |
||
26 | * @property int $languageId; |
||
27 | * @property string $customInfo; |
||
28 | * @property string $requestToken; |
||
29 | * @property string $ppSellerProtection; |
||
30 | * @property string $shippingDetails; |
||
31 | * @property string $paymentTypes; |
||
32 | * @property string $paymentTypeDetail; |
||
33 | */ |
||
34 | class EncryptParameter extends Parameter |
||
35 | { |
||
36 | protected $parametersName = array( |
||
37 | // Mandatory parameters |
||
38 | 'shopLogin', |
||
39 | 'uicCode', |
||
40 | 'amount', |
||
41 | 'shopTransactionId', |
||
42 | // Optional parameters |
||
43 | 'buyerName', |
||
44 | 'buyerEmail', |
||
45 | 'languageId', |
||
46 | 'customInfo', |
||
47 | 'requestToken', |
||
48 | //'cardNumber', //deprecated |
||
49 | //'expiryMonth', //deprecated |
||
50 | //'expiryYear', //deprecated |
||
51 | //'cvv', //deprecated |
||
52 | |||
53 | /* to be implemented |
||
0 ignored issues
–
show
|
|||
54 | 'ppSellerProtection', |
||
55 | 'shippingDetails', |
||
56 | 'paymentTypes', |
||
57 | 'paymentTypeDetail', |
||
58 | 'redFraudPrevention', |
||
59 | 'Red_CustomerInfo', |
||
60 | 'Red_ShippingInfo', |
||
61 | 'Red_BillingInfo', |
||
62 | 'Red_CustomerData', |
||
63 | 'Red_CustomInfo', |
||
64 | 'Red_Items', |
||
65 | 'Consel_MerchantPro', |
||
66 | 'Consel_CustomerInfo', |
||
67 | 'payPalBillingAgreementDescription' |
||
68 | */ |
||
69 | ); |
||
70 | protected $mandatoryParameters = array( |
||
71 | 'shopLogin', |
||
72 | 'uicCode', |
||
73 | 'amount', |
||
74 | 'shopTransactionId', |
||
75 | ); |
||
76 | protected $separator = '*P1*'; |
||
77 | private $customInfoArray = array(); |
||
78 | private $invalidChars = array( |
||
79 | '&', |
||
80 | ' ', |
||
81 | '§', //need also to be added programmatically, because UTF-8 |
||
82 | '(', |
||
83 | ')', |
||
84 | '*', |
||
85 | '<', |
||
86 | '>', |
||
87 | ',', |
||
88 | ';', |
||
89 | ':', |
||
90 | '*P1*', |
||
91 | '/', |
||
92 | '[', |
||
93 | ']', |
||
94 | '?', |
||
95 | '=', |
||
96 | '--', |
||
97 | '/*', |
||
98 | '%', |
||
99 | '//', |
||
100 | ); |
||
101 | private $invalidCharsFlattened = ''; |
||
102 | |||
103 | /** |
||
104 | * @param array $parameters |
||
105 | */ |
||
106 | 31 | public function __construct(array $parameters = array()) |
|
107 | { |
||
108 | 31 | $this->invalidChars[] = chr(167); //§ ascii char |
|
109 | |||
110 | 31 | parent::__construct($parameters); |
|
111 | 31 | } |
|
112 | |||
113 | /** |
||
114 | * @param string $key |
||
115 | * @param mixed $value |
||
116 | */ |
||
117 | 31 | View Code Duplication | public function set($key, $value) |
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
118 | { |
||
119 | 31 | if (!in_array($key, $this->parametersName, true)) { |
|
120 | 1 | throw new InvalidArgumentException(sprintf('%s is not a valid parameter name.', $key)); |
|
121 | } |
||
122 | 31 | $this->verifyParameterValidity($value); |
|
123 | 31 | parent::set($key, $value); |
|
124 | 31 | } |
|
125 | |||
126 | /** |
||
127 | * @param mixed $customInfo string already encoded or array of key/value to be encoded |
||
128 | */ |
||
129 | 7 | public function setCustomInfo($customInfo) |
|
130 | { |
||
131 | 7 | if (!is_array($customInfo)) { |
|
132 | 2 | $this->parameters['customInfo'] = $customInfo; |
|
133 | 2 | } else { |
|
134 | //check string validity |
||
135 | |||
136 | 5 | foreach ($customInfo as $key => $value) { |
|
137 | 5 | $value = urlencode($value); |
|
138 | 5 | $this->verifyParameterValidity($key); |
|
139 | 5 | $this->verifyParameterValidity($value); |
|
140 | |||
141 | 5 | if (strlen($value) > 300) { |
|
142 | 1 | $value = substr($value, 0, 300); |
|
143 | 1 | } |
|
144 | 5 | $customInfo[$key] = $value; |
|
145 | 5 | } |
|
146 | 5 | $this->customInfoArray = $customInfo; |
|
147 | 5 | $this->parameters['customInfo'] = http_build_query($this->customInfoArray, '', $this->separator); |
|
148 | } |
||
149 | 7 | } |
|
150 | |||
151 | /** |
||
152 | * @return array |
||
153 | */ |
||
154 | 2 | View Code Duplication | public function getCustomInfoToArray() |
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
155 | { |
||
156 | 2 | $allinfo = explode($this->separator, $this->customInfo); |
|
0 ignored issues
–
show
The property
customInfo does not seem to exist. Did you mean customInfoArray ?
An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name. If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading. ![]() |
|||
157 | 2 | $customInfoArray = array(); |
|
158 | 2 | foreach ($allinfo as $singleInfo) { |
|
159 | 2 | $tagvalue = explode('=', $singleInfo); |
|
160 | 2 | $customInfoArray[$tagvalue[0]] = urldecode($tagvalue[1]); |
|
161 | 2 | } |
|
162 | |||
163 | 2 | return $customInfoArray; |
|
164 | } |
||
165 | |||
166 | /** |
||
167 | * @param $value |
||
168 | * @return bool |
||
169 | */ |
||
170 | 31 | public function verifyParameterValidity($value) |
|
171 | { |
||
172 | 31 | if (strlen($this->invalidCharsFlattened) === 0) { |
|
173 | 31 | $invalidCharsQuoted = array_map('preg_quote', $this->invalidChars); |
|
174 | 31 | $this->invalidCharsFlattened = implode('|', $invalidCharsQuoted); |
|
175 | 31 | } |
|
176 | |||
177 | 31 | if (preg_match_all('#' . $this->invalidCharsFlattened . '#', $value, $matches)) { |
|
178 | 6 | $invalidCharsMatched = '"' . implode('", "', $matches[0]) . '"'; |
|
179 | 6 | throw new InvalidArgumentException( |
|
180 | 6 | 'String ' . $value . ' contains invalid chars (i.e.: ' . $invalidCharsMatched . ').' |
|
181 | 6 | ); |
|
182 | } |
||
183 | |||
184 | 31 | return true; |
|
185 | } |
||
186 | } |
||
187 |
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.
The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.
This check looks for comments that seem to be mostly valid code and reports them.