This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace Eole\Sandstone\OAuth2\Silex; |
||
4 | |||
5 | use Pimple\ServiceProviderInterface; |
||
6 | use Pimple\Container; |
||
7 | use Eole\Sandstone\OAuth2\Security\Http\Firewall\OAuth2Listener; |
||
8 | use Eole\Sandstone\OAuth2\Security\Http\EntryPoint\NoEntryPoint; |
||
9 | use Eole\Sandstone\OAuth2\Security\Authentication\Provider\OAuth2Provider; |
||
10 | use Eole\Sandstone\OAuth2\Storage\Client; |
||
11 | use Eole\Sandstone\OAuth2\Storage\Session; |
||
12 | use Eole\Sandstone\OAuth2\Storage\AccessToken; |
||
13 | use Eole\Sandstone\OAuth2\Storage\Scope; |
||
14 | use Eole\Sandstone\OAuth2\Storage\RefreshToken as RefreshTokenStorage; |
||
15 | use Eole\Sandstone\OAuth2\Grant\Password; |
||
16 | use Eole\Sandstone\OAuth2\Grant\RefreshToken as RefreshTokenGrant; |
||
17 | use Eole\Sandstone\OAuth2\AuthorizationServer; |
||
18 | use Eole\Sandstone\OAuth2\ResourceServer; |
||
19 | use Eole\Sandstone\OAuth2\Controller\OAuth2Controller; |
||
20 | |||
21 | class OAuth2ServiceProvider implements ServiceProviderInterface |
||
22 | { |
||
23 | /** |
||
24 | * {@InheritDoc} |
||
25 | */ |
||
26 | public function register(Container $app) |
||
27 | { |
||
28 | $app['oauth.tokens_dir.access_token'] = function () use ($app) { |
||
29 | $dir = $app['oauth.tokens_dir'].'/access-tokens'; |
||
30 | $this->touchDir($dir); |
||
31 | return $dir; |
||
32 | }; |
||
33 | |||
34 | $app['oauth.tokens_dir.refresh_token'] = function () use ($app) { |
||
35 | $dir = $app['oauth.tokens_dir'].'/refresh-tokens'; |
||
36 | $this->touchDir($dir); |
||
37 | return $dir; |
||
38 | }; |
||
39 | |||
40 | /** |
||
41 | * Storage |
||
42 | */ |
||
43 | $app['sandstone.oauth.storage.session'] = function () use ($app) { |
||
44 | return new Session($app['oauth.tokens_dir.access_token'], $app['oauth.scope']); |
||
45 | }; |
||
46 | |||
47 | $app['sandstone.oauth.storage.access_token'] = function () use ($app) { |
||
48 | return new AccessToken($app['oauth.tokens_dir.access_token']); |
||
49 | }; |
||
50 | |||
51 | $app['sandstone.oauth.storage.client'] = function () use ($app) { |
||
52 | return new Client($app['oauth.clients']); |
||
53 | }; |
||
54 | |||
55 | $app['sandstone.oauth.storage.scope'] = function () { |
||
56 | return new Scope(); |
||
57 | }; |
||
58 | |||
59 | $app['sandstone.oauth.storage.refresh_token'] = function () use ($app) { |
||
60 | return new RefreshTokenStorage($app['oauth.tokens_dir.refresh_token']); |
||
61 | }; |
||
62 | |||
63 | /** |
||
64 | * Grant |
||
65 | */ |
||
66 | $app['sandstone.oauth.grant.password'] = function () use ($app) { |
||
67 | $userProvider = $app['oauth.security.user_provider']; |
||
68 | |||
69 | if (is_string($userProvider)) { |
||
70 | $userProvider = $app[$userProvider]; |
||
71 | } |
||
72 | |||
73 | return new Password( |
||
74 | $userProvider, |
||
75 | $app['security.encoder_factory'] |
||
76 | ); |
||
77 | }; |
||
78 | |||
79 | $app['sandstone.oauth.grant.refresh_token'] = function () { |
||
80 | return new RefreshTokenGrant(); |
||
0 ignored issues
–
show
|
|||
81 | }; |
||
82 | |||
83 | /** |
||
84 | * Server |
||
85 | */ |
||
86 | $app['sandstone.oauth.authorization_server'] = function () use ($app) { |
||
87 | return new AuthorizationServer( |
||
88 | $app['sandstone.oauth.storage.session'], |
||
89 | $app['sandstone.oauth.storage.access_token'], |
||
90 | $app['sandstone.oauth.storage.client'], |
||
91 | $app['sandstone.oauth.storage.scope'], |
||
92 | $app['sandstone.oauth.storage.refresh_token'], |
||
93 | $app['sandstone.oauth.grant.password'], |
||
94 | $app['sandstone.oauth.grant.refresh_token'] |
||
95 | ); |
||
96 | }; |
||
97 | |||
98 | $app['sandstone.oauth.resource_server'] = function () use ($app) { |
||
99 | return new ResourceServer( |
||
100 | $app['sandstone.oauth.storage.session'], |
||
101 | $app['sandstone.oauth.storage.access_token'], |
||
102 | $app['sandstone.oauth.storage.client'], |
||
103 | $app['sandstone.oauth.storage.scope'] |
||
0 ignored issues
–
show
The call to
ResourceServer::__construct() has too many arguments starting with $app['sandstone.oauth.storage.scope'] .
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. In this case you can add the ![]() |
|||
104 | ); |
||
105 | }; |
||
106 | |||
107 | /** |
||
108 | * Security |
||
109 | */ |
||
110 | $app['security.authentication_listener.factory.oauth'] = $app->protect(function ($name) use ($app) { |
||
111 | |||
112 | // define the authentication provider object |
||
113 | $app['security.authentication_provider.'.$name.'.oauth'] = function () use ($app) { |
||
114 | return new OAuth2Provider( |
||
115 | $app['security.user_provider.'.$app['oauth.firewall_name']], |
||
116 | $app['security.user_checker'], |
||
117 | $app['sandstone.oauth.resource_server'] |
||
118 | ); |
||
119 | }; |
||
120 | |||
121 | // define the authentication listener object |
||
122 | $app['security.authentication_listener.'.$name.'.oauth'] = function () use ($app) { |
||
123 | return new OAuth2Listener( |
||
124 | $app['security.token_storage'], |
||
125 | $app['security.authentication_manager'], |
||
126 | $app['sandstone.oauth.resource_server'] |
||
127 | ); |
||
128 | }; |
||
129 | |||
130 | // define the entry point object |
||
131 | $app['security.entry_point.'.$name.'.oauth'] = function () { |
||
132 | return new NoEntryPoint(); |
||
133 | }; |
||
134 | |||
135 | return array( |
||
136 | // the authentication provider id |
||
137 | 'security.authentication_provider.'.$name.'.oauth', |
||
138 | // the authentication listener id |
||
139 | 'security.authentication_listener.'.$name.'.oauth', |
||
140 | // the entry point id |
||
141 | 'security.entry_point.'.$name.'.oauth', |
||
142 | // the position of the listener in the stack |
||
143 | 'pre_auth' |
||
144 | ); |
||
145 | }); |
||
146 | |||
147 | $app['sandstone.oauth.controller'] = function () use ($app) { |
||
148 | return new OAuth2Controller($app['sandstone.oauth.authorization_server']); |
||
149 | }; |
||
150 | } |
||
151 | |||
152 | /** |
||
153 | * Check tokens directory exists or create it. |
||
154 | */ |
||
155 | private function touchDir($dir) |
||
156 | { |
||
157 | if (!is_dir($dir)) { |
||
158 | mkdir($dir, 0777, true); |
||
159 | } |
||
160 | } |
||
161 | } |
||
162 |
This check looks for function calls that miss required arguments.