Issues in BasePassportServer.php (master) - Issues in master - limoncello-php-dist/passport - Measure and Improve Code Quality continuously with Scrutinizer

Issues (69)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/BasePassportServer.php (10 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php declare(strict_types=1);

namespace Limoncello\Passport;

/**
 * Copyright 2015-2019 [email protected]
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

use Limoncello\OAuthServer\BaseAuthorizationServer;
use Limoncello\OAuthServer\Contracts\AuthorizationCodeInterface;
use Limoncello\OAuthServer\Contracts\ClientInterface;
use Limoncello\OAuthServer\Contracts\GrantTypes;
use Limoncello\OAuthServer\Contracts\ResponseTypes;
use Limoncello\OAuthServer\Exceptions\OAuthCodeRedirectException;
use Limoncello\OAuthServer\Exceptions\OAuthRedirectException;
use Limoncello\OAuthServer\Exceptions\OAuthTokenBodyException;
use Limoncello\Passport\Contracts\Entities\TokenInterface;
use Limoncello\Passport\Contracts\PassportServerIntegrationInterface;
use Limoncello\Passport\Contracts\PassportServerInterface;
use Limoncello\Passport\Entities\Token;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Log\LoggerAwareInterface as LAI;
use Psr\Log\LoggerAwareTrait;
use Zend\Diactoros\Response\JsonResponse;
use Zend\Diactoros\Response\RedirectResponse;
use Zend\Diactoros\Uri;
use function array_filter;
use function assert;
use function in_array;
use function is_int;
use function is_string;

/**
 * @package Limoncello\Passport
 *
 * @SuppressWarnings(PHPMD.TooManyPublicMethods)
 * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
 * @SuppressWarnings(PHPMD.ExcessiveClassComplexity)
 */
abstract class BasePassportServer extends BaseAuthorizationServer implements PassportServerInterface, LAI
{
    use LoggerAwareTrait;

    /**
     * @param PassportServerIntegrationInterface $integration
     * @param ServerRequestInterface             $request
     * @param array                              $parameters
     * @param string                             $realm
     *
     * @return ClientInterface|null
     *
     * @SuppressWarnings(PHPMD.NPathComplexity)
     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
     */
    abstract protected function determineClient(
        PassportServerIntegrationInterface $integration,
        ServerRequestInterface $request,
        array $parameters,
        $realm = 'OAuth'
    ): ?ClientInterface;

    /**
     * @var PassportServerIntegrationInterface
     */
    private $integration;

    /**
     * @param PassportServerIntegrationInterface $integration
     */
    public function __construct(PassportServerIntegrationInterface $integration)
    {
        parent::__construct();

        $this->setIntegration($integration);
    }

    /**
     * @inheritdoc
     *
     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
     */
    protected function createAuthorization(array $parameters): ResponseInterface
    {
        try {
            list($client, $redirectUri) = $this->getValidClientAndRedirectUri(
                $this->codeGetClientId($parameters),
                $this->codeGetRedirectUri($parameters)
            );
            if ($client === null || $redirectUri === null) {
                return $this->getIntegration()->createInvalidClientAndRedirectUriErrorResponse();
            }

            $maxStateLength = $this->getMaxStateLength();
            switch ($responseType = $this->getResponseType($parameters)) {
                case ResponseTypes::AUTHORIZATION_CODE:
                    $this->logDebug('Handling code authorization.');
                    $response = $this
                        ->codeAskResourceOwnerForApproval($parameters, $client, $redirectUri, $maxStateLength);
                    break;
                case ResponseTypes::IMPLICIT:
                    $this->logDebug('Handling implicit authorization.');
                    $response = $this
                        ->implicitAskResourceOwnerForApproval($parameters, $client, $redirectUri, $maxStateLength);
                    break;
                default:
                    // @link https://tools.ietf.org/html/rfc6749#section-3.1.1 ->
                    // @link https://tools.ietf.org/html/rfc6749#section-4.1.2.1
                    $this->logInfo('Unsupported response type in request.', ['response_type' => $responseType]);
                    $errorCode = OAuthCodeRedirectException::ERROR_UNSUPPORTED_RESPONSE_TYPE;
                    throw new OAuthCodeRedirectException($errorCode, $redirectUri);
            }
        } catch (OAuthRedirectException $exception) {
            $response = $this->createRedirectErrorResponse($exception);
        }

        return $response;
    }

    /**
     * @inheritdoc
     */
    public function postCreateToken(ServerRequestInterface $request): ResponseInterface
    {
        try {
            $parameters       = $request->getParsedBody();
            $determinedClient = $this->determineClient($this->getIntegration(), $request, $parameters);
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}

            switch ($grantType = $this->getGrantType($parameters)) {
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
                case GrantTypes::AUTHORIZATION_CODE:
                    $this->logDebug('Handling code grant.');
                    $response = $this->codeIssueToken($parameters, $determinedClient);
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
                    break;
                case GrantTypes::RESOURCE_OWNER_PASSWORD_CREDENTIALS:
                    $this->logDebug('Handling resource owner password grant.');
                    $response = $this->passIssueToken($parameters, $determinedClient);
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
                    break;
                case GrantTypes::CLIENT_CREDENTIALS:
                    $this->logDebug('Handling client credentials grant.');
                    if ($determinedClient === null) {
                        $this->logInfo('Client identification failed.');
                        throw new OAuthTokenBodyException(OAuthTokenBodyException::ERROR_INVALID_CLIENT);
                    }
                    $response = $this->clientIssueToken($parameters, $determinedClient);
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
                    break;
                case GrantTypes::REFRESH_TOKEN:
                    $this->logDebug('Handling refresh token grant.');
                    $response = $this->refreshIssueToken($parameters, $determinedClient);
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
                    break;
                default:
                    $this->logInfo('Unknown grant type.', ['grant_type' => $grantType]);
                    throw new OAuthTokenBodyException(OAuthTokenBodyException::ERROR_UNSUPPORTED_GRANT_TYPE);
            }
        } catch (OAuthTokenBodyException $exception) {
            $response = $this->createBodyErrorResponse($exception);
        }

        return $response;
    }

    /**
     * @inheritdoc
     */
    public function createCodeResponse(TokenInterface $code, string $state = null): ResponseInterface
    {
        $client = $this->readClientByIdentifier($code->getClientIdentifier());
        if ($code->getRedirectUriString() === null ||
            in_array($code->getRedirectUriString(), $client->getRedirectUriStrings()) === false
        ) {
            $this->logInfo(
                'Code has invalid redirect URI which do not match any redirect URI for its client.',
                ['id' => $code->getIdentifier()]
            );
            return $this->getIntegration()->createInvalidClientAndRedirectUriErrorResponse();
        }

        $code->setCode($this->getIntegration()->generateCodeValue($code));

        $tokenRepo   = $this->getIntegration()->getTokenRepository();
        $createdCode = $tokenRepo->createCode($code);

        $response = $this->createRedirectCodeResponse($createdCode, $state);

        return $response;
    }

    /**
     * @inheritdoc
     */
    public function createTokenResponse(TokenInterface $token, string $state = null): ResponseInterface
    {
        $client = $this->readClientByIdentifier($token->getClientIdentifier());
        if ($token->getRedirectUriString() === null ||
            in_array($token->getRedirectUriString(), $client->getRedirectUriStrings()) === false
        ) {
            $this->logInfo(
                'Token has invalid redirect URI which do not match any redirect URI for its client.',
                ['id' => $token->getIdentifier()]
            );
            return $this->getIntegration()->createInvalidClientAndRedirectUriErrorResponse();
        }

        list($tokenValue, $tokenType, $tokenExpiresIn) = $this->getIntegration()->generateTokenValues($token);

        // refresh value must be null by the spec
        $refreshValue = null;
        $token->setValue($tokenValue)->setType($tokenType)->setRefreshValue($refreshValue);
        $savedToken = $this->getIntegration()->getTokenRepository()->createToken($token);

        $response = $this->createRedirectTokenResponse($savedToken, $tokenExpiresIn, $state);

        return $response;
    }

    /** @noinspection PhpTooManyParametersInspection
     * @inheritdoc
     *
     * @SuppressWarnings(PHPMD.BooleanArgumentFlag)
     */
    public function codeCreateAskResourceOwnerForApprovalResponse(
        ClientInterface $client,
        string $redirectUri = null,
        bool $isScopeModified = false,
        array $scopeList = null,
        string $state = null,
        array $extraParameters = []
    ): ResponseInterface {
        $this->logDebug('Asking resource owner for scope approval (code grant).');
        return $this->getIntegration()->createAskResourceOwnerForApprovalResponse(
            ResponseTypes::AUTHORIZATION_CODE,
            $client,
            $redirectUri,
            $isScopeModified,
            $scopeList,

            $state,
            $extraParameters
        );
    }

    /**
     * @inheritdoc
     */
    public function codeReadAuthenticationCode(string $code): ?AuthorizationCodeInterface
    {
        return $this->getIntegration()->getTokenRepository()
            ->readByCode($code, $this->getIntegration()->getCodeExpirationPeriod());
    }

    /**
     * @inheritdoc
     */
    public function codeCreateAccessTokenResponse(
        AuthorizationCodeInterface $code,
        array $extraParameters = []
    ): ResponseInterface {
        /** @var Token $code */
        assert($code instanceof Token);
        $updatedToken = clone $code;

        $tokenExpiresIn = $this->setUpTokenValues($updatedToken);
        $this->getIntegration()->getTokenRepository()->assignValuesToCode($updatedToken, $tokenExpiresIn);

        $response = $this->createBodyTokenResponse($updatedToken, $tokenExpiresIn);

        $this->logInfo('Authorization code successfully exchanged for a token (code grant).');

        return $response;
    }

    /**
     * @inheritdoc
     */
    public function codeRevokeTokens(AuthorizationCodeInterface $code): void
    {
        assert($code instanceof TokenInterface);

        /** @var TokenInterface $code */

        $identifier = $code->getIdentifier();
        $this->logInfo('Revoking token.', ['token_id' => $identifier]);
        $this->getIntegration()->getTokenRepository()->disable($identifier);
    }

    /** @noinspection PhpTooManyParametersInspection
     * @inheritdoc
     *
     * @SuppressWarnings(PHPMD.BooleanArgumentFlag)
     */
    public function implicitCreateAskResourceOwnerForApprovalResponse(
        ClientInterface $client,
        string $redirectUri = null,
        bool $isScopeModified = false,
        array $scopeList = null,
        string $state = null,
        array $extraParameters = []
    ): ResponseInterface {
        $response = $this->getIntegration()->createAskResourceOwnerForApprovalResponse(
            ResponseTypes::IMPLICIT,
            $client,
            $redirectUri,
            $isScopeModified,
            $scopeList,

            $state,
            $extraParameters
        );

        $this->logInfo('Created response asking resource owner for scope approval (implicit grant).');

        return $response;
    }

    /** @noinspection PhpTooManyParametersInspection
     * @inheritdoc
     *
     * @SuppressWarnings(PHPMD.BooleanArgumentFlag)
     */
    public function passValidateCredentialsAndCreateAccessTokenResponse(
        string $userName,
        string $password,
        ClientInterface $client = null,
        bool $isScopeModified = false,
        array $scope = null,
        array $extraParameters = []
    ): ResponseInterface {
        assert($client !== null);

        if (($userIdentifier = $this->getIntegration()->validateUserId($userName, $password)) === null) {
            $this->logDebug('User not found with provided username and password.', ['username' => $userName]);
            throw new OAuthTokenBodyException(OAuthTokenBodyException::ERROR_INVALID_GRANT);
        }
        assert(is_int($userIdentifier) === true);
        $this->logInfo('User authenticated with provided username and password.', ['username' => $userName]);

        $changedScopeOrNull = $this->getIntegration()->verifyAllowedUserScope($userIdentifier, $scope);
        if ($changedScopeOrNull !== null) {
            assert(is_array($changedScopeOrNull));
            $isScopeModified = true;
            $scope           = $changedScopeOrNull;
        }

        $unsavedToken = $this->getIntegration()->createTokenInstance();
        $unsavedToken
            ->setClientIdentifier($client->getIdentifier())
            ->setScopeIdentifiers($scope)
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
            ->setUserIdentifier($userIdentifier);
        $isScopeModified === true ? $unsavedToken->setScopeModified() : $unsavedToken->setScopeUnmodified();

        $tokenExpiresIn = $this->setUpTokenValues($unsavedToken);
        $savedToken     = $this->getIntegration()->getTokenRepository()->createToken($unsavedToken);

        $response = $this->createBodyTokenResponse($savedToken, $tokenExpiresIn);

        return $response;
    }

    /**
     * @inheritdoc
     */
    public function passReadDefaultClient(): ClientInterface
    {
        $defaultClientId = $this->getIntegration()->getDefaultClientIdentifier();

        assert(is_string($defaultClientId) === true && empty($defaultClientId) === false);

        $defaultClient   = $this->readClientByIdentifier($defaultClientId);

        assert($defaultClient !== null);

        return $defaultClient;
    }

    /**
     * @inheritdoc
     */
    public function clientCreateAccessTokenResponse(
        ClientInterface $client,
        bool $isScopeModified,
        array $scope = null,
        array $extraParameters = []
    ): ResponseInterface {
        $this->logDebug('Prepare token for client.');
        assert($client !== null);

        $unsavedToken = $this->getIntegration()->createTokenInstance();
        $unsavedToken
            ->setClientIdentifier($client->getIdentifier())
            ->setScopeIdentifiers($scope);
function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
        $isScopeModified === true ? $unsavedToken->setScopeModified() : $unsavedToken->setScopeUnmodified();


        $tokenExpiresIn = $this->setUpTokenValue($unsavedToken);
        $savedToken     = $this->getIntegration()->getTokenRepository()->createToken($unsavedToken);

        $response = $this->createBodyTokenResponse($savedToken, $tokenExpiresIn);

        return $response;
    }

    /**
     * @inheritdoc
     *
     * @return TokenInterface|null
     */
    public function readTokenByRefreshValue(string $refreshValue): ?\Limoncello\OAuthServer\Contracts\TokenInterface
    {
        return $this->getIntegration()->getTokenRepository()->readByRefresh(
            $refreshValue,
            $this->getIntegration()->getTokenExpirationPeriod()
        );
    }

    /**
     * @inheritdoc
     *
     * @SuppressWarnings(PHPMD.ElseExpression)
     */
    public function refreshCreateAccessTokenResponse(
        ClientInterface $client,
        \Limoncello\OAuthServer\Contracts\TokenInterface $token,
        bool $isScopeModified,
        array $scope = null,
        array $extraParameters = []
    ): ResponseInterface {
        $this->logDebug('Prepare refresh token.');

        /** @var TokenInterface $token */
        assert($token instanceof TokenInterface);

        $updatedToken   = clone $token;
        $tokenExpiresIn = $this->getIntegration()->isRenewRefreshValue() === false ?
            $this->setUpTokenValue($updatedToken) : $this->setUpTokenValues($updatedToken);

        $tokenRepo = $this->getIntegration()->getTokenRepository();
        if ($isScopeModified === false) {
            $tokenRepo->updateValues($updatedToken);
        } else {
            assert(is_array($scope));
            $tokenRepo->inTransaction(function () use ($tokenRepo, $updatedToken, $scope) {
                $tokenRepo->updateValues($updatedToken);
                $tokenRepo->unbindScopes($updatedToken->getIdentifier());
                $tokenRepo->bindScopeIdentifiers($updatedToken->getIdentifier(), $scope);
            });
            $updatedToken->setScopeModified()->setScopeIdentifiers($scope);
        }
        $response = $this->createBodyTokenResponse($updatedToken, $tokenExpiresIn);

        return $response;
    }

    /**
     * @inheritdoc
     */
    public function readClientByIdentifier(string $clientIdentifier): ?ClientInterface
    {
        return $this->getIntegration()->getClientRepository()->read($clientIdentifier);
    }

    /**
     * @param string|null $clientId
     * @param string|null $redirectFromQuery
     *
     * @return array [client|null, uri|null]
     *
     * @SuppressWarnings(PHPMD.ElseExpression)
     */
    protected function getValidClientAndRedirectUri(string $clientId = null, string $redirectFromQuery = null): array
    {
        $client           = null;
        $validRedirectUri = null;

        if ($clientId !== null &&
            ($client = $this->readClientByIdentifier($clientId)) !== null
        ) {
            $validRedirectUri = $this->selectValidRedirectUri($client, $redirectFromQuery);
            if ($validRedirectUri === null) {
                $this->logDebug(
                    'Choosing valid redirect URI for client failed.',
                    ['client_id' => $clientId, 'redirect_uri_from_query' => $redirectFromQuery]
                );
            }
        } else {
            $this->logDebug('Client is not found.', ['client_id' => $clientId]);
        }

        return [$client, $validRedirectUri];
    }

    /**
     * @param TokenInterface $token
     * @param int            $tokenExpiresIn
     *
     * @return ResponseInterface
     */
    protected function createBodyTokenResponse(TokenInterface $token, int $tokenExpiresIn): ResponseInterface
    {
        $this->logDebug('Sending token as JSON response.');

        $scopeList  = $token->isScopeModified() === false || empty($token->getScopeIdentifiers()) === true ?
            null : $token->getScopeList();

        // for access token format @link https://tools.ietf.org/html/rfc6749#section-5.1
        $parameters = $this->filterNulls([
            'access_token'  => $token->getValue(),
            'token_type'    => $token->getType(),
            'expires_in'    => $tokenExpiresIn,
            'refresh_token' => $token->getRefreshValue(),
            'scope'         => $scopeList,
        ]);

        // extra parameters
        // https://tools.ietf.org/html/rfc6749#section-4.1.4
        // https://tools.ietf.org/html/rfc6749#section-4.3.3
        // https://tools.ietf.org/html/rfc6749#section-4.4.3
        $extraParameters = $this->getIntegration()->getBodyTokenExtraParameters($token);

        $response = new JsonResponse($parameters + $extraParameters, 200, [
            'Cache-Control' => 'no-store',
            'Pragma'        => 'no-cache'
        ]);

        return $response;
    }

    /**
     * @param TokenInterface $code
     * @param string|null    $state
     *
     * @return ResponseInterface
     */
    protected function createRedirectCodeResponse(TokenInterface $code, string $state = null): ResponseInterface
    {
        $this->logDebug('Sending code as redirect response.');

        // for access token format @link https://tools.ietf.org/html/rfc6749#section-4.1.3
        $parameters = $this->filterNulls([
            'code'  => $code->getCode(),
            'state' => $state,
        ]);

        $redirectUri = $code->getRedirectUriString();
        $query       = $this->encodeAsXWwwFormUrlencoded($parameters);

        $response = new RedirectResponse((new Uri($redirectUri))->withQuery($query));

        return $response;
    }

    /**
     * @param TokenInterface $token
     * @param int            $tokenExpiresIn
     * @param string|null    $state
     *
     * @return ResponseInterface
     */
    protected function createRedirectTokenResponse(
        TokenInterface $token,
        int $tokenExpiresIn,
        string $state = null
    ): ResponseInterface {
        $this->logDebug('Sending token as redirect response.');

        $scopeList  = $token->isScopeModified() === false || empty($token->getScopeIdentifiers()) === true ?
            null : $token->getScopeList();

        // for access token format @link https://tools.ietf.org/html/rfc6749#section-5.1
        $parameters = $this->filterNulls([
            'access_token' => $token->getValue(),
            'token_type'   => $token->getType(),
            'expires_in'   => $tokenExpiresIn,
            'scope'        => $scopeList,
            'state'        => $state,
        ]);

        $fragment = $this->encodeAsXWwwFormUrlencoded($parameters);

        $response = new RedirectResponse((new Uri($token->getRedirectUriString()))->withFragment($fragment));

        return $response;
    }

    /**
     * @param OAuthTokenBodyException $exception
     *
     * @return ResponseInterface
     */
    protected function createBodyErrorResponse(OAuthTokenBodyException $exception): ResponseInterface
    {
        $data = $this->filterNulls([
            'error'             => $exception->getErrorCode(),
            'error_description' => $exception->getErrorDescription(),
            'error_uri'         => $this->getBodyErrorUri($exception),
        ]);

        $this->logDebug('Sending OAuth error as JSON response.', $data);

        $response = new JsonResponse($data, $exception->getHttpCode(), $exception->getHttpHeaders());

        return $response;
    }

    /**
     * @param OAuthRedirectException $exception
     *
     * @return ResponseInterface
     */
    protected function createRedirectErrorResponse(OAuthRedirectException $exception): ResponseInterface
    {
        $parameters = $this->filterNulls([
            'error'             => $exception->getErrorCode(),
            'error_description' => $exception->getErrorDescription(),
            'error_uri'         => $exception->getErrorUri(),
            'state'             => $exception->getState(),
        ]);

        $this->logDebug('Sending OAuth error via redirect.', $parameters);

        $fragment = $this->encodeAsXWwwFormUrlencoded($parameters);
        $uri      = (new Uri($exception->getRedirectUri()))->withFragment($fragment);

        $response = new RedirectResponse($uri, 302, $exception->getHttpHeaders());

        return $response;
    }

    /**
     * @param TokenInterface $token
     *
     * @return int
     */
    protected function setUpTokenValue(TokenInterface $token): int
    {
        list($tokenValue, $tokenType, $tokenExpiresIn) =
            $this->getIntegration()->generateTokenValues($token);
        $token->setValue($tokenValue)->setType($tokenType);

        return $tokenExpiresIn;
    }

    /**
     * @param TokenInterface $token
     *
     * @return int
     */
    protected function setUpTokenValues(TokenInterface $token): int
    {
        list($tokenValue, $tokenType, $tokenExpiresIn, $refreshValue) =
            $this->getIntegration()->generateTokenValues($token);
        $token->setValue($tokenValue)->setType($tokenType)->setRefreshValue($refreshValue);

        return $tokenExpiresIn;
    }

    /**
     * @return PassportServerIntegrationInterface
     */
    protected function getIntegration(): PassportServerIntegrationInterface
    {
        return $this->integration;
    }

    /**
     * @param PassportServerIntegrationInterface $integration
     *
     * @return self
     */
    protected function setIntegration(PassportServerIntegrationInterface $integration): self
    {
        $this->integration = $integration;

        return $this;
    }

    /**
     * @param OAuthTokenBodyException $exception
     *
     * @return null|string
     */
    protected function getBodyErrorUri(OAuthTokenBodyException $exception)
    {
        assert($exception !== null);

        return null;
    }

    /**
     * @param string $message
     * @param array  $context
     *
     * @return void
     */
    protected function logDebug(string $message, array $context = []): void
    {
        if ($this->logger !== null) {
            $this->logger->debug($message, $context);
        }
    }

    /**
     * @param string $message
     * @param array  $context
     *
     * @return void
     */
    protected function logInfo(string $message, array $context = []): void
    {
        if ($this->logger !== null) {
            $this->logger->info($message, $context);
        }
    }

    /**
     * @param array $array
     *
     * @return array
     */
    private function filterNulls(array $array): array
    {
        return array_filter($array, function ($value) {
            return $value !== null;
        });
    }
}


limoncello-php-dist / passport

Issues (69)

Security Analysis no request data

src/BasePassportServer.php (10 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like