| 1 | <?php |
||||
| 2 | |||||
| 3 | namespace Freyo\ApiGateway; |
||||
| 4 | |||||
| 5 | use Closure; |
||||
| 6 | use Freyo\ApiGateway\Kernel\Traits\WithFingerprint; |
||||
| 7 | |||||
| 8 | class FingerprintMiddleware |
||||
| 9 | { |
||||
| 10 | use WithFingerprint; |
||||
| 11 | |||||
| 12 | /** |
||||
| 13 | * Handle an incoming request. |
||||
| 14 | * |
||||
| 15 | * @param \Illuminate\Http\Request $request |
||||
|
0 ignored issues
–
show
|
|||||
| 16 | * @param \Closure $next |
||||
| 17 | * @return mixed |
||||
| 18 | */ |
||||
| 19 | public function handle($request, Closure $next) |
||||
| 20 | { |
||||
| 21 | $authorizations = $this->authorizations($request->header('authorization')); |
||||
| 22 | $headers = preg_split('/\s+/', $authorizations['headers'] ?? []); |
||||
|
0 ignored issues
–
show
It seems like
$authorizations['headers'] ?? array() can also be of type array; however, parameter $subject of preg_split() does only seem to accept string, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 23 | if (!in_array('fingerprint', $headers)) { |
||||
|
0 ignored issues
–
show
It seems like
$headers can also be of type false; however, parameter $haystack of in_array() does only seem to accept array, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 24 | return response()->json([ |
||||
|
0 ignored issues
–
show
The function
response was not found. Maybe you did not declare it correctly or list all dependencies?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 25 | 'message' => 'HMAC signature missing fingerprint header', |
||||
| 26 | ], 401); |
||||
| 27 | } |
||||
| 28 | |||||
| 29 | $fingerprint = $this->fingerprint($request->method(), $request->url(), $request->all()); |
||||
| 30 | if ($fingerprint !== $request->header('fingerprint')) { |
||||
| 31 | return response()->json([ |
||||
| 32 | 'message' => 'fingerprint does not match', |
||||
| 33 | ], 401); |
||||
| 34 | } |
||||
| 35 | |||||
| 36 | return $next($request); |
||||
| 37 | } |
||||
| 38 | |||||
| 39 | /** |
||||
| 40 | * @param string $authorization |
||||
| 41 | * |
||||
| 42 | * @return array |
||||
| 43 | */ |
||||
| 44 | protected function authorizations($authorization) |
||||
| 45 | { |
||||
| 46 | $authorization = preg_replace('/^hmac/i', '', $authorization); |
||||
| 47 | $params = array_map('trim', explode(',', $authorization)); |
||||
| 48 | |||||
| 49 | $params = array_map(function ($item) { |
||||
| 50 | parse_str($item, $parsed); |
||||
| 51 | return array_map(function ($value) { |
||||
| 52 | return trim($value, '"\''); |
||||
| 53 | }, $parsed); |
||||
| 54 | }, $params); |
||||
| 55 | |||||
| 56 | $result = []; |
||||
| 57 | foreach ($params as $param) { |
||||
| 58 | $result = array_merge($result, $param); |
||||
| 59 | } |
||||
| 60 | |||||
| 61 | return $result; |
||||
| 62 | } |
||||
| 63 | } |
The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g.
excluded_paths: ["lib/*"], you can move it to the dependency path list as follows:For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths