LightSaml\Validator\Model\Statement\StatementValidator

Complexity

Total Complexity

26

Size/Duplication

Total Lines	88
Duplicated Lines	0 %

Importance

Changes	1
Bugs	0	Features	0

5 Methods

Rating	Name	Duplication	Size	Complexity
B	validateAuthnStatement()	0	20	7
A	validateAttribute()	0	4	2
B	validateAuthnContext()	0	24	11
A	validateStatement()	0	8	3
A	validateAttributeStatement()	0	8	3

<?php

/*
 * This file is part of the LightSAML-Core package.
 *
 * (c) Milos Tomic <tmilos@lightsaml.com>
 *
 * This source file is subject to the MIT license that is bundled
 * with this source code in the file LICENSE.
 */

namespace LightSaml\Validator\Model\Statement;

use LightSaml\Error\LightSamlValidationException;
use LightSaml\Helper;
use LightSaml\Model\Assertion\AbstractStatement;
use LightSaml\Model\Assertion\Attribute;
use LightSaml\Model\Assertion\AttributeStatement;
use LightSaml\Model\Assertion\AuthnContext;
use LightSaml\Model\Assertion\AuthnStatement;

class StatementValidator implements StatementValidatorInterface
{
    /**
     * @throws \LightSaml\Error\LightSamlValidationException
     *
     * @return void
     */
    public function validateStatement(AbstractStatement $statement)
    {
        if ($statement instanceof AuthnStatement) {
            $this->validateAuthnStatement($statement);
        } elseif ($statement instanceof AttributeStatement) {
            $this->validateAttributeStatement($statement);
        } else {
            throw new LightSamlValidationException(sprintf("Unsupported Statement type '%s'", get_class($statement)));
        }
    }

    private function validateAuthnStatement(AuthnStatement $statement)
    {
        if (false == $statement->getAuthnInstantTimestamp()) {

It seems like you are loosely comparing $statement->getAuthnInstantTimestamp() of type integer|null against false; this is ambiguous if the integer can be zero. Consider using a strict comparison === instead.

            throw new LightSamlValidationException('AuthnStatement MUST have an AuthnInstant attribute');
        }
        if (false == Helper::validateOptionalString($statement->getSessionIndex())) {

It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

            throw new LightSamlValidationException('SessionIndex attribute of AuthnStatement must contain at least one non-whitespace character');
        }
        if ($statement->getSubjectLocality()) {
            if (false == Helper::validateOptionalString($statement->getSubjectLocality()->getAddress())) {

It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

                throw new LightSamlValidationException('Address attribute of SubjectLocality must contain at least one non-whitespace character');
            }
            if (false == Helper::validateOptionalString($statement->getSubjectLocality()->getDnsName())) {

It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

                throw new LightSamlValidationException('DNSName attribute of SubjectLocality must contain at least one non-whitespace character');
            }
        }
        if (false == $statement->getAuthnContext()) {

The condition false == $statement->getAuthnContext() is always false.

            throw new LightSamlValidationException('AuthnStatement MUST have an AuthnContext element');
        }
        $this->validateAuthnContext($statement->getAuthnContext());
    }

    private function validateAuthnContext(AuthnContext $authnContext)
    {
        if (false == $authnContext->getAuthnContextClassRef() &&

It seems like you are loosely comparing $authnContext->getAuthnContextClassRef() of type null|string against false; this is ambiguous if the string can be empty. Consider using a strict comparison === instead.

            false == $authnContext->getAuthnContextDecl() &&

It seems like you are loosely comparing $authnContext->getAuthnContextDecl() of type null|string against false; this is ambiguous if the string can be empty. Consider using a strict comparison === instead.

            false == $authnContext->getAuthnContextDeclRef()

It seems like you are loosely comparing $authnContext->getAuthnContextDeclRef() of type null|string against false; this is ambiguous if the string can be empty. Consider using a strict comparison === instead.

        ) {
            throw new LightSamlValidationException('AuthnContext element MUST contain at least one AuthnContextClassRef, AuthnContextDecl or AuthnContextDeclRef element');
        }

        if ($authnContext->getAuthnContextClassRef() &&
            $authnContext->getAuthnContextDecl() &&
            $authnContext->getAuthnContextDeclRef()
        ) {
            throw new LightSamlValidationException('AuthnContext MUST NOT contain more than two elements.');
        }

        if ($authnContext->getAuthnContextClassRef()) {
            if (false == Helper::validateWellFormedUriString($authnContext->getAuthnContextClassRef())) {

It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

                throw new LightSamlValidationException('AuthnContextClassRef has a value which is not a wellformed absolute uri');
            }
        }
        if ($authnContext->getAuthnContextDeclRef()) {
            if (false === Helper::validateWellFormedUriString($authnContext->getAuthnContextDeclRef())) {
                throw new LightSamlValidationException('AuthnContextDeclRef has a value which is not a wellformed absolute uri');
            }
        }
    }

    private function validateAttributeStatement(AttributeStatement $statement)
    {
        if (false == $statement->getAllAttributes()) {
            throw new LightSamlValidationException('AttributeStatement MUST contain at least one Attribute or EncryptedAttribute');
        }

        foreach ($statement->getAllAttributes() as $attribute) {
            $this->validateAttribute($attribute);
        }
    }

    /**
     * @throws LightSamlValidationException
     *
     * @return void
     */
    private function validateAttribute(Attribute $attribute)
    {
        if (false == Helper::validateRequiredString($attribute->getName())) {

It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

            throw new LightSamlValidationException('Name attribute of Attribute element MUST contain at least one non-whitespace character');
        }
    }
}