Issues (547)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Helper/Api.php (1 issue)

Labels
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 * PAYONE Magento 2 Connector is free software: you can redistribute it and/or modify
5
 * it under the terms of the GNU Lesser General Public License as published by
6
 * the Free Software Foundation, either version 3 of the License, or
7
 * (at your option) any later version.
8
 *
9
 * PAYONE Magento 2 Connector is distributed in the hope that it will be useful,
10
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12
 * GNU Lesser General Public License for more details.
13
 *
14
 * You should have received a copy of the GNU Lesser General Public License
15
 * along with PAYONE Magento 2 Connector. If not, see <http://www.gnu.org/licenses/>.
16
 *
17
 * PHP version 5
18
 *
19
 * @category  Payone
20
 * @package   Payone_Magento2_Plugin
21
 * @author    FATCHIP GmbH <[email protected]>
22
 * @copyright 2003 - 2016 Payone GmbH
23
 * @license   <http://www.gnu.org/licenses/> GNU Lesser General Public License
24
 * @link      http://www.payone.de
25
 */
26
27
namespace Payone\Core\Helper;
28
29
use Payone\Core\Model\Methods\PayoneMethod;
30
use Magento\Sales\Model\Order as SalesOrder;
31
32
/**
33
 * Helper class for everything that has to do with APIs
34
 *
35
 * @category  Payone
36
 * @package   Payone_Magento2_Plugin
37
 * @author    FATCHIP GmbH <[email protected]>
38
 * @copyright 2003 - 2016 Payone GmbH
39
 * @license   <http://www.gnu.org/licenses/> GNU Lesser General Public License
40
 * @link      http://www.payone.de
41
 */
42
class Api extends Base
43
{
44
    /**
45
     * PAYONE connection curl php
46
     *
47
     * @var \Payone\Core\Helper\Connection\CurlPhp
48
     */
49
    protected $connCurlPhp;
50
51
    /**
52
     * PAYONE connection curl cli
53
     *
54
     * @var \Payone\Core\Helper\Connection\CurlCli
55
     */
56
    protected $connCurlCli;
57
58
    /**
59
     * PAYONE connection fsockopen
60
     *
61
     * @var \Payone\Core\Helper\Connection\Fsockopen
62
     */
63
    protected $connFsockopen;
64
65
    /**
66
     * Fields to copy from the request array to the order
67
     *
68
     * @var array
69
     */
70
    protected $requestToOrder = [
71
        'reference' => 'payone_refnr',
72
        'request' => 'payone_authmode',
73
        'mode' => 'payone_mode',
74
        'mandate_identification' => 'payone_mandate_id',
75
        'workorderid' => 'payone_workorder_id',
76
        'add_paydata[installment_duration]' => 'payone_installment_duration',
77
    ];
78
79
    /**
80
     * Fields to copy from the response to the order
81
     *
82
     * @var array
83
     */
84
    protected $responseToOrder = [
85
        'txid' => 'payone_txid',
86
        'mandate_identification' => 'payone_mandate_id',
87
        'clearing_reference' => 'payone_clearing_reference',
88
        'add_paydata[clearing_reference]' => 'payone_clearing_reference',
89
        'add_paydata[workorderid]' => 'payone_workorder_id',
90
        'clearing_bankaccount' => 'payone_clearing_bankaccount',
91
        'clearing_bankcode' => 'payone_clearing_bankcode',
92
        'clearing_bankcountry' => 'payone_clearing_bankcountry',
93
        'clearing_bankname' => 'payone_clearing_bankname',
94
        'clearing_bankaccountholder' => 'payone_clearing_bankaccountholder',
95
        'clearing_bankcity' => 'payone_clearing_bankcity',
96
        'clearing_bankiban' => 'payone_clearing_bankiban',
97
        'clearing_bankbic' => 'payone_clearing_bankbic'
98
    ];
99
100
    /**
101
     * Constructor
102
     *
103
     * @param \Magento\Framework\App\Helper\Context      $context
104
     * @param \Magento\Store\Model\StoreManagerInterface $storeManager
105
     * @param \Payone\Core\Helper\Shop                   $shopHelper
106
     * @param \Payone\Core\Helper\Connection\CurlPhp     $connCurlPhp
107
     * @param \Payone\Core\Helper\Connection\CurlCli     $connCurlCli
108
     * @param \Payone\Core\Helper\Connection\Fsockopen   $connFsockopen
109
     */
110
    public function __construct(
111
        \Magento\Framework\App\Helper\Context $context,
112
        \Magento\Store\Model\StoreManagerInterface $storeManager,
113
        \Payone\Core\Helper\Shop $shopHelper,
114
        \Payone\Core\Helper\Connection\CurlPhp $connCurlPhp,
115
        \Payone\Core\Helper\Connection\CurlCli $connCurlCli,
116
        \Payone\Core\Helper\Connection\Fsockopen $connFsockopen
117
    ) {
118
        parent::__construct($context, $storeManager, $shopHelper);
119
        $this->connCurlPhp = $connCurlPhp;
120
        $this->connCurlCli = $connCurlCli;
121
        $this->connFsockopen = $connFsockopen;
122
    }
123
124
    /**
125
     * Check which communication possibilities are existing and send the request
126
     *
127
     * @param  string $sRequestUrl
128
     * @return array
129
     */
130
    public function sendApiRequest($sRequestUrl)
131
    {
132
        $aParsedRequestUrl = parse_url($sRequestUrl);
133
        if ($aParsedRequestUrl === false) {
134
            return ["errormessage" => "Payone API request URL could not be parsed."];
135
        }
136
137
        if ($this->connCurlPhp->isApplicable()) {
138
            // php native curl exists so we gonna use it for requesting
139
            $aResponse = $this->connCurlPhp->sendCurlPhpRequest($aParsedRequestUrl);
140
        } elseif ($this->connCurlCli->isApplicable()) {
141
            // cli version of curl exists on server
142
            $aResponse = $this->connCurlCli->sendCurlCliRequest($aParsedRequestUrl);
143
        } else {
144
            // last resort => via sockets
145
            $aResponse = $this->connFsockopen->sendSocketRequest($aParsedRequestUrl);
146
        }
147
148
        $aResponse = $this->formatOutputByResponse($aResponse);
0 ignored issues
show
It seems like $aResponse can also be of type null; however, Payone\Core\Helper\Api::formatOutputByResponse() does only seem to accept array, maybe add an additional type check?

If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check:

/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue.

Loading history...
149
150
        return $aResponse;
151
    }
152
153
    /**
154
     * Format response to a clean output array
155
     *
156
     * @param  array $aResponse
157
     * @return array
158
     */
159
    protected function formatOutputByResponse($aResponse)
160
    {
161
        $aOutput = [];
162
163
        if (is_array($aResponse)) { // correct response existing?
164
            foreach ($aResponse as $iLinenum => $sLine) { // go through line by line
165
                $iPos = strpos($sLine, "=");
166
                if ($iPos > 0) { // is a "=" as delimiter existing?
167
                    $aOutput[substr($sLine, 0, $iPos)] = trim(substr($sLine, $iPos + 1));
168
                } elseif (!empty($sLine)) { // is line not empty?
169
                    $aOutput[$iLinenum] = $sLine; // add the line unedited
170
                }
171
            }
172
        }
173
174
        return $aOutput;
175
    }
176
177
    /**
178
     * Generate the request url out of the params and die api url
179
     *
180
     * @param  array  $aParameters
181
     * @param  string $sApiUrl
182
     * @return string
183
     */
184
    public function getRequestUrl($aParameters, $sApiUrl)
185
    {
186
        $sRequestUrl = '';
187
        foreach ($aParameters as $sKey => $mValue) {
188
            if (is_array($mValue)) { // might be array
189
                foreach ($mValue as $i => $sSubValue) {
190
                    $sRequestUrl .= "&".$sKey."[".$i."]=".urlencode($sSubValue);
191
                }
192
            } else {
193
                $sRequestUrl .= "&".$sKey."=".urlencode($mValue);
194
            }
195
        }
196
        $sRequestUrl = $sApiUrl."?".substr($sRequestUrl, 1);
197
        return $sRequestUrl;
198
    }
199
200
    /**
201
     * Copy Data to order by given map
202
     *
203
     * @param SalesOrder $oOrder
204
     * @param array $aData
205
     * @param array $aMap
206
     * @return SalesOrder
207
     */
208
    protected function addDataToOrder(SalesOrder $oOrder, $aData, $aMap)
209
    {
210
        foreach ($aMap as $sFrom => $sTo) {
211
            if (isset($aData[$sFrom])) {
212
                $oOrder->setData($sTo, $aData[$sFrom]);
213
            }
214
        }
215
        return $oOrder;
216
    }
217
218
    /**
219
     * Add PAYONE information to the order object to be saved in the DB
220
     *
221
     * @param  SalesOrder $oOrder
222
     * @param  array      $aRequest
223
     * @param  array      $aResponse
224
     * @return void
225
     */
226
    public function addPayoneOrderData(SalesOrder $oOrder, $aRequest, $aResponse)
227
    {
228
        $this->addDataToOrder($oOrder, $aRequest, $this->requestToOrder);
229
        $this->addDataToOrder($oOrder, $aResponse, $this->responseToOrder);
230
    }
231
232
    /**
233
     * Check if invoice-data has to be added to the authorization request
234
     *
235
     * @param  PayoneMethod $oPayment
236
     * @return bool
237
     */
238
    public function isInvoiceDataNeeded(PayoneMethod $oPayment)
239
    {
240
        $blInvoiceEnabled = (bool)$this->getConfigParam('transmit_enabled', 'invoicing'); // invoicing enabled?
241
        if ($blInvoiceEnabled || $oPayment->needsProductInfo()) {
242
            return true; // invoice data needed
243
        }
244
        return false; // invoice data not needed
245
    }
246
}
247