lazyboywu /
oauth2-qq
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace League\OAuth2\Client\Provider; |
||
| 4 | |||
| 5 | use League\OAuth2\Client\Provider\Exception\IdentityProviderException; |
||
| 6 | use League\OAuth2\Client\Token\AccessToken; |
||
| 7 | use League\OAuth2\Client\Tool\BearerAuthorizationTrait; |
||
| 8 | use Psr\Http\Message\ResponseInterface; |
||
| 9 | |||
| 10 | class Qq extends AbstractProvider |
||
| 11 | { |
||
| 12 | use BearerAuthorizationTrait; |
||
| 13 | |||
| 14 | /** |
||
| 15 | * Domain |
||
| 16 | * |
||
| 17 | * @var string |
||
| 18 | */ |
||
| 19 | public $domain = 'https://graph.qq.com'; |
||
| 20 | |||
| 21 | /** |
||
| 22 | * OpenId |
||
| 23 | * |
||
| 24 | * @see http://wiki.open.qq.com/wiki/website/%E8%8E%B7%E5%8F%96%E7%94%A8%E6%88%B7OpenID_OAuth2.0 |
||
| 25 | * @var string |
||
| 26 | */ |
||
| 27 | protected $openId; |
||
| 28 | |||
| 29 | /** |
||
| 30 | * Get authorization url to begin OAuth flow |
||
| 31 | * |
||
| 32 | * @return string |
||
| 33 | */ |
||
| 34 | public function getBaseAuthorizationUrl() |
||
| 35 | { |
||
| 36 | return $this->domain.'/oauth2.0/authorize'; |
||
| 37 | } |
||
| 38 | |||
| 39 | /** |
||
| 40 | * Get access token url to retrieve token |
||
| 41 | * |
||
| 42 | * @param array $params |
||
| 43 | * |
||
| 44 | * @return string |
||
| 45 | */ |
||
| 46 | public function getBaseAccessTokenUrl(array $params) |
||
| 47 | { |
||
| 48 | return $this->domain.'/oauth2.0/token'; |
||
| 49 | } |
||
| 50 | |||
| 51 | /** |
||
| 52 | * Get open id from access token |
||
| 53 | * |
||
| 54 | * @param array $params |
||
|
0 ignored issues
–
show
|
|||
| 55 | * |
||
| 56 | * @return string |
||
| 57 | */ |
||
| 58 | public function getOpenId(AccessToken $token) |
||
| 59 | { |
||
| 60 | $request = $this->getAuthenticatedRequest(self::METHOD_GET, $this->domain.'/oauth2.0/me?access_token='.(string)$token); |
||
| 61 | |||
| 62 | $response = $this->getResponse($request); |
||
| 63 | |||
| 64 | return isset($response['openid']) ? $response['openid'] : null; |
||
| 65 | } |
||
| 66 | |||
| 67 | /** |
||
| 68 | * Requests and returns the resource owner of given access token. |
||
| 69 | * |
||
| 70 | * @param AccessToken $token |
||
| 71 | * @return ResourceOwnerInterface |
||
| 72 | */ |
||
| 73 | public function getResourceOwner(AccessToken $token) |
||
| 74 | { |
||
| 75 | $this->openId = $this->getOpenId($token); |
||
| 76 | |||
| 77 | return parent::getResourceOwner($token); |
||
| 78 | } |
||
| 79 | |||
| 80 | /** |
||
| 81 | * Get provider url to fetch user details |
||
| 82 | * |
||
| 83 | * @param AccessToken $token |
||
| 84 | * |
||
| 85 | * @return string |
||
| 86 | */ |
||
| 87 | public function getResourceOwnerDetailsUrl(AccessToken $token) |
||
| 88 | { |
||
| 89 | return $this->domain.'/user/get_user_info?access_token=' . (string)$token . '&openid=' . $this->openId . '&oauth_consumer_key=' . $this->clientId; |
||
| 90 | } |
||
| 91 | |||
| 92 | /** |
||
| 93 | * Get the default scopes used by this provider. |
||
| 94 | * |
||
| 95 | * This should not be a complete list of all scopes, but the minimum |
||
| 96 | * required for the provider user interface! |
||
| 97 | * |
||
| 98 | * @return array |
||
| 99 | */ |
||
| 100 | protected function getDefaultScopes() |
||
| 101 | { |
||
| 102 | return ['get_user_info']; |
||
| 103 | } |
||
| 104 | |||
| 105 | /** |
||
| 106 | * Returns an authenticated PSR-7 request instance. |
||
| 107 | * |
||
| 108 | * @param string $method |
||
| 109 | * @param string $url |
||
| 110 | * @param null |
||
| 111 | * @param null |
||
| 112 | * @return RequestInterface |
||
| 113 | */ |
||
| 114 | public function getAuthenticatedRequest($method, $url, $token = null, array $options = null) |
||
| 115 | { |
||
| 116 | return $this->getRequestFactory()->getRequest($method, $url); |
||
| 117 | } |
||
| 118 | |||
| 119 | /** |
||
| 120 | * Parses the response according to its content-type header. |
||
| 121 | * |
||
| 122 | * @throws UnexpectedValueException |
||
| 123 | * @param ResponseInterface $response |
||
| 124 | * @return array |
||
| 125 | */ |
||
| 126 | protected function parseResponse(ResponseInterface $response) |
||
| 127 | { |
||
| 128 | $content = (string) $response->getBody(); |
||
| 129 | |||
| 130 | if(strpos($content, "callback") !== false){ |
||
| 131 | $lpos = strpos($content, "("); |
||
| 132 | $rpos = strrpos($content, ")"); |
||
| 133 | $content = substr($content, $lpos + 1, $rpos - $lpos -1); |
||
| 134 | |||
| 135 | return $this->parseJson($content); |
||
| 136 | } else if(strpos($content, "access_token=") !== false) { |
||
| 137 | $result = array(); |
||
| 138 | parse_str($content, $result); |
||
| 139 | return $result; |
||
| 140 | } else { |
||
| 141 | return parent::parseResponse($response); |
||
| 142 | } |
||
| 143 | } |
||
| 144 | |||
| 145 | /** |
||
| 146 | * Check a provider response for errors. |
||
| 147 | * |
||
| 148 | * @link http://wiki.open.qq.com/wiki/website/%E5%85%AC%E5%85%B1%E8%BF%94%E5%9B%9E%E7%A0%81%E8%AF%B4%E6%98%8E#100000-100031.EF.BC.9APC.E7.BD.91.E7.AB.99.E6.8E.A5.E5.85.A5.E6.97.B6.E7.9A.84.E5.85.AC.E5.85.B1.E8.BF.94.E5.9B.9E.E7.A0.81 |
||
| 149 | * @throws IdentityProviderException |
||
| 150 | * @param ResponseInterface $response |
||
| 151 | * @param string $data Parsed response data |
||
| 152 | * @return void |
||
| 153 | */ |
||
| 154 | protected function checkResponse(ResponseInterface $response, $data) |
||
| 155 | { |
||
| 156 | if ($response->getStatusCode() != 200) { |
||
| 157 | throw new IdentityProviderException( |
||
| 158 | 'can not access', |
||
| 159 | 0, |
||
| 160 | $response |
||
|
0 ignored issues
–
show
$response is of type object<Psr\Http\Message\ResponseInterface>, but the function expects a array|string.
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
Loading history...
|
|||
| 161 | ); |
||
| 162 | } |
||
| 163 | |||
| 164 | if (isset($data['code']) || isset($data['ret'])) { |
||
| 165 | // fix code to ret |
||
| 166 | $data['ret'] = isset($data['code']) ? $data['code'] : $data['ret']; |
||
| 167 | |||
| 168 | if ($data['ret'] > 0) { |
||
| 169 | throw new IdentityProviderException( |
||
| 170 | $data['msg'], |
||
| 171 | $data['ret'], |
||
| 172 | $response |
||
|
0 ignored issues
–
show
$response is of type object<Psr\Http\Message\ResponseInterface>, but the function expects a array|string.
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
Loading history...
|
|||
| 173 | ); |
||
| 174 | } |
||
| 175 | } |
||
| 176 | |||
| 177 | } |
||
| 178 | |||
| 179 | /** |
||
| 180 | * Generate a user object from a successful user details request. |
||
| 181 | * |
||
| 182 | * @param array $response |
||
| 183 | * @param AccessToken $token |
||
| 184 | * @return League\OAuth2\Client\Provider\ResourceOwnerInterface |
||
| 185 | */ |
||
| 186 | protected function createResourceOwner(array $response, AccessToken $token) |
||
| 187 | { |
||
| 188 | $user = new QqResourceOwner($response); |
||
| 189 | |||
| 190 | $user->setOpenId($this->openId); |
||
| 191 | |||
| 192 | return $user; |
||
| 193 | } |
||
| 194 | } |
||
| 195 |
This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.
Consider the following example. The parameter
$italyis not defined by the methodfinale(...).The most likely cause is that the parameter was removed, but the annotation was not.