This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace League\OAuth2\Client\Provider; |
||
4 | |||
5 | use League\OAuth2\Client\Provider\Exception\IdentityProviderException; |
||
6 | use League\OAuth2\Client\Token\AccessToken; |
||
7 | use League\OAuth2\Client\Tool\BearerAuthorizationTrait; |
||
8 | use Psr\Http\Message\ResponseInterface; |
||
9 | |||
10 | class Qq extends AbstractProvider |
||
11 | { |
||
12 | use BearerAuthorizationTrait; |
||
13 | |||
14 | /** |
||
15 | * Domain |
||
16 | * |
||
17 | * @var string |
||
18 | */ |
||
19 | public $domain = 'https://graph.qq.com'; |
||
20 | |||
21 | /** |
||
22 | * OpenId |
||
23 | * |
||
24 | * @see http://wiki.open.qq.com/wiki/website/%E8%8E%B7%E5%8F%96%E7%94%A8%E6%88%B7OpenID_OAuth2.0 |
||
25 | * @var string |
||
26 | */ |
||
27 | protected $openId; |
||
28 | |||
29 | /** |
||
30 | * Get authorization url to begin OAuth flow |
||
31 | * |
||
32 | * @return string |
||
33 | */ |
||
34 | public function getBaseAuthorizationUrl() |
||
35 | { |
||
36 | return $this->domain.'/oauth2.0/authorize'; |
||
37 | } |
||
38 | |||
39 | /** |
||
40 | * Get access token url to retrieve token |
||
41 | * |
||
42 | * @param array $params |
||
43 | * |
||
44 | * @return string |
||
45 | */ |
||
46 | public function getBaseAccessTokenUrl(array $params) |
||
47 | { |
||
48 | return $this->domain.'/oauth2.0/token'; |
||
49 | } |
||
50 | |||
51 | /** |
||
52 | * Get open id from access token |
||
53 | * |
||
54 | * @param array $params |
||
0 ignored issues
–
show
|
|||
55 | * |
||
56 | * @return string |
||
57 | */ |
||
58 | public function getOpenId(AccessToken $token) |
||
59 | { |
||
60 | $request = $this->getAuthenticatedRequest(self::METHOD_GET, $this->domain.'/oauth2.0/me?access_token='.(string)$token); |
||
61 | |||
62 | $response = $this->getResponse($request); |
||
63 | |||
64 | return isset($response['openid']) ? $response['openid'] : null; |
||
65 | } |
||
66 | |||
67 | /** |
||
68 | * Requests and returns the resource owner of given access token. |
||
69 | * |
||
70 | * @param AccessToken $token |
||
71 | * @return ResourceOwnerInterface |
||
72 | */ |
||
73 | public function getResourceOwner(AccessToken $token) |
||
74 | { |
||
75 | $this->openId = $this->getOpenId($token); |
||
76 | |||
77 | return parent::getResourceOwner($token); |
||
78 | } |
||
79 | |||
80 | /** |
||
81 | * Get provider url to fetch user details |
||
82 | * |
||
83 | * @param AccessToken $token |
||
84 | * |
||
85 | * @return string |
||
86 | */ |
||
87 | public function getResourceOwnerDetailsUrl(AccessToken $token) |
||
88 | { |
||
89 | return $this->domain.'/user/get_user_info?access_token=' . (string)$token . '&openid=' . $this->openId . '&oauth_consumer_key=' . $this->clientId; |
||
90 | } |
||
91 | |||
92 | /** |
||
93 | * Get the default scopes used by this provider. |
||
94 | * |
||
95 | * This should not be a complete list of all scopes, but the minimum |
||
96 | * required for the provider user interface! |
||
97 | * |
||
98 | * @return array |
||
99 | */ |
||
100 | protected function getDefaultScopes() |
||
101 | { |
||
102 | return ['get_user_info']; |
||
103 | } |
||
104 | |||
105 | /** |
||
106 | * Returns an authenticated PSR-7 request instance. |
||
107 | * |
||
108 | * @param string $method |
||
109 | * @param string $url |
||
110 | * @param null |
||
111 | * @param null |
||
112 | * @return RequestInterface |
||
113 | */ |
||
114 | public function getAuthenticatedRequest($method, $url, $token = null, array $options = null) |
||
115 | { |
||
116 | return $this->getRequestFactory()->getRequest($method, $url); |
||
117 | } |
||
118 | |||
119 | /** |
||
120 | * Parses the response according to its content-type header. |
||
121 | * |
||
122 | * @throws UnexpectedValueException |
||
123 | * @param ResponseInterface $response |
||
124 | * @return array |
||
125 | */ |
||
126 | protected function parseResponse(ResponseInterface $response) |
||
127 | { |
||
128 | $content = (string) $response->getBody(); |
||
129 | |||
130 | if(strpos($content, "callback") !== false){ |
||
131 | $lpos = strpos($content, "("); |
||
132 | $rpos = strrpos($content, ")"); |
||
133 | $content = substr($content, $lpos + 1, $rpos - $lpos -1); |
||
134 | |||
135 | return $this->parseJson($content); |
||
136 | } else if(strpos($content, "access_token=") !== false) { |
||
137 | $result = array(); |
||
138 | parse_str($content, $result); |
||
139 | return $result; |
||
140 | } else { |
||
141 | return parent::parseResponse($response); |
||
142 | } |
||
143 | } |
||
144 | |||
145 | /** |
||
146 | * Check a provider response for errors. |
||
147 | * |
||
148 | * @link http://wiki.open.qq.com/wiki/website/%E5%85%AC%E5%85%B1%E8%BF%94%E5%9B%9E%E7%A0%81%E8%AF%B4%E6%98%8E#100000-100031.EF.BC.9APC.E7.BD.91.E7.AB.99.E6.8E.A5.E5.85.A5.E6.97.B6.E7.9A.84.E5.85.AC.E5.85.B1.E8.BF.94.E5.9B.9E.E7.A0.81 |
||
149 | * @throws IdentityProviderException |
||
150 | * @param ResponseInterface $response |
||
151 | * @param string $data Parsed response data |
||
152 | * @return void |
||
153 | */ |
||
154 | protected function checkResponse(ResponseInterface $response, $data) |
||
155 | { |
||
156 | if ($response->getStatusCode() != 200) { |
||
157 | throw new IdentityProviderException( |
||
158 | 'can not access', |
||
159 | 0, |
||
160 | $response |
||
0 ignored issues
–
show
$response is of type object<Psr\Http\Message\ResponseInterface> , but the function expects a array|string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
161 | ); |
||
162 | } |
||
163 | |||
164 | if (isset($data['code']) || isset($data['ret'])) { |
||
165 | // fix code to ret |
||
166 | $data['ret'] = isset($data['code']) ? $data['code'] : $data['ret']; |
||
167 | |||
168 | if ($data['ret'] > 0) { |
||
169 | throw new IdentityProviderException( |
||
170 | $data['msg'], |
||
171 | $data['ret'], |
||
172 | $response |
||
0 ignored issues
–
show
$response is of type object<Psr\Http\Message\ResponseInterface> , but the function expects a array|string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
173 | ); |
||
174 | } |
||
175 | } |
||
176 | |||
177 | } |
||
178 | |||
179 | /** |
||
180 | * Generate a user object from a successful user details request. |
||
181 | * |
||
182 | * @param array $response |
||
183 | * @param AccessToken $token |
||
184 | * @return League\OAuth2\Client\Provider\ResourceOwnerInterface |
||
185 | */ |
||
186 | protected function createResourceOwner(array $response, AccessToken $token) |
||
187 | { |
||
188 | $user = new QqResourceOwner($response); |
||
189 | |||
190 | $user->setOpenId($this->openId); |
||
191 | |||
192 | return $user; |
||
193 | } |
||
194 | } |
||
195 |
This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.
Consider the following example. The parameter
$italy
is not defined by the methodfinale(...)
.The most likely cause is that the parameter was removed, but the annotation was not.