Issues (100)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/F2fpay/Refund/Client.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace  Kaylyu\Alipay\F2fpay\Refund;
4
5
use Kaylyu\Alipay\F2fpay\Base\Aop\Request\AlipayTradeRefundQueryRequest;
6
use Kaylyu\Alipay\F2fpay\Base\Aop\Request\AlipayTradeRefundRequest;
7
use Kaylyu\Alipay\F2fpay\Base\Model\Builder\AlipayTradeRefundContentBuilder;
8
use Kaylyu\Alipay\F2fpay\Base\Model\Builder\AlipayTradeRefundQueryContentBuilder;
9
use Kaylyu\Alipay\F2fpay\Base\Model\Result\AlipayF2FPayResult;
10
use Kaylyu\Alipay\F2fpay\Kernel\BaseClient;
11
use function Kaylyu\Alipay\F2fpay\Kernel\Support\tradeError;
12
use function Kaylyu\Alipay\F2fpay\Kernel\Support\tradeSuccess;
13
14
15
/**
16
 * Class Product.
17
 */
18
class Client extends BaseClient
19
{
20
    /**
21
     * 统一收单交易退款接口
22
     *
23
     * 当交易发生之后一段时间内,由于买家或者卖家的原因需要退款时,卖家可以通过退款接口将支付款退还给买家,支付宝将在收到退款请求并且验证成功之后,按照退款规则将支付款按原路退到买家帐号上
24
     * 交易超过约定时间(签约时设置的可退款时间)的订单无法进行退款 支付宝退款支持单笔交易分多次退款,多次退款需要提交原支付订单的商户订单号和设置不同的退款单号
25
     * 一笔退款失败后重新提交,要采用原来的退款单号
26
     * 总退款金额不能超过用户实际支付金额
27
     *
28
     * @param AlipayTradeRefundContentBuilder $builder
29
     * @author kaylv <[email protected]>
30
     * @return array|\Kaylyu\Alipay\Kernel\Support\Collection|string
31
     */
32 View Code Duplication
    public function refund(AlipayTradeRefundContentBuilder $builder)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
33
    {
34
        $request = new AlipayTradeRefundRequest();
35
        $request->setBizContent($builder->getBizContent());
36
37
        //请求
38
        $response = $this->httpPost($request, $builder->getAppAuthToken());
39
40
        //获取
41
        $data = $response->alipay_trade_refund_response;
42
        $sign = $response->sign;
43
44
        //组装返回数据
45
        $result = new AlipayF2FPayResult($data, $sign);
46
47
        //处理
48
        if (tradeSuccess($data)) {
49
            // 查询返回该订单交易支付成功
50
            $result->setTradeStatus(AlipayF2FPayResult::ALIPAY_F2FPAY_RESULT_SUCCESS);
51
        } elseif (tradeError($data)) {
52
            //查询发生异常或无返回,交易状态未知
53
            $result->setTradeStatus(AlipayF2FPayResult::ALIPAY_F2FPAY_RESULT_UNKNOWN);
54
        } else {
55
            //其他情况均表明该订单号交易失败
56
            $result->setTradeStatus(AlipayF2FPayResult::ALIPAY_F2FPAY_RESULT_FAILED);
57
        }
58
59
        return $this->formatResponseToType($result);
60
    }
61
62
    /**
63
     * 统一收单交易退款查询
64
     *
65
     * 商户可使用该接口查询自已通过alipay.trade.refund或alipay.trade.refund.apply提交的退款请求是否执行成功。
66
     * 该接口的返回码10000,仅代表本次查询操作成功,不代表退款成功。
67
     * 如果该接口返回了查询数据,且refund_status为空或为REFUND_SUCCESS,则代表退款成功,
68
     * 如果没有查询到则代表未退款成功,可以调用退款接口进行重试。重试时请务必保证退款请求号一致
69
     *
70
     * @param AlipayTradeRefundQueryContentBuilder $builder
71
     * @author kaylv <[email protected]>
72
     * @return array|\Kaylyu\Alipay\Kernel\Support\Collection|string
73
     */
74 View Code Duplication
    public function query(AlipayTradeRefundQueryContentBuilder $builder)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
75
    {
76
        $request = new AlipayTradeRefundQueryRequest();
77
        $request->setBizContent($builder->getBizContent());
78
79
        //请求
80
        $response = $this->httpPost($request, $builder->getAppAuthToken());
81
82
        //获取
83
        $data = $response->alipay_trade_fastpay_refund_query_response;
84
        $sign = $response->sign;
85
86
        //组装返回数据
87
        $result = new AlipayF2FPayResult($data, $sign);
88
89
        //处理
90
        if (tradeSuccess($data)) {
91
            // 查询返回该订单交易支付成功
92
            $result->setTradeStatus(AlipayF2FPayResult::ALIPAY_F2FPAY_RESULT_SUCCESS);
93
        } elseif (tradeError($data)) {
94
            //查询发生异常或无返回,交易状态未知
95
            $result->setTradeStatus(AlipayF2FPayResult::ALIPAY_F2FPAY_RESULT_UNKNOWN);
96
        } else {
97
            //其他情况均表明该订单号交易失败
98
            $result->setTradeStatus(AlipayF2FPayResult::ALIPAY_F2FPAY_RESULT_FAILED);
99
        }
100
101
        return $this->formatResponseToType($result);
102
    }
103
}
104