Psr7Middlewares\Middleware\FormTimestamp

Complexity

Total Complexity

17

Size/Duplication

Total Lines	161
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	7

Importance

Changes	2
Bugs	0	Features	1

6 Methods

Rating	Name	Duplication	Size	Complexity
A	getGenerator()	0	4	1
A	inputName()	0	6	1
A	min()	0	6	1
A	max()	0	6	1
B	__invoke()	0	26	5
C	isValid()	0	41	8

<?php

namespace Psr7Middlewares\Middleware;

use Psr7Middlewares\Middleware;
use Psr7Middlewares\Utils;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Message\ResponseInterface;
use RuntimeException;
use Exception;

/**
 * Middleware to span protection using the timestamp value in forms.
 */
class FormTimestamp
{
    use Utils\FormTrait;
    use Utils\CryptTrait;

    const KEY_GENERATOR = 'FORM_TIMESTAMP_GENERATOR';

    /**
     * @var string The honeypot input name
     */
    private $inputName = 'hpt_time';

    /**
     * @var int Minimum seconds to determine whether the request is a bot
     */
    private $min = 3;

    /**
     * @var int Max seconds to expire the form. Zero to do not expire
     */
    private $max = 0;

    /**
     * Returns a callable to generate the inputs.
     *
     * @param ServerRequestInterface $request
     *
     * @return callable|null
     */
    public static function getGenerator(ServerRequestInterface $request)
    {
        return Middleware::getAttribute($request, self::KEY_GENERATOR);
    }

    /**
     * Set the field name.
     * 
     * @param string $inputName
     * 
     * @return self
     */
    public function inputName($inputName)
    {
        $this->inputName = $inputName;

        return $this;
    }

    /**
     * Minimum time required.
     * 
     * @param int $seconds
     * 
     * @return self
     */
    public function min($seconds)
    {
        $this->min = $seconds;

        return $this;
    }

    /**
     * Max time before expire the form.
     * 
     * @param int $seconds
     * 
     * @return self
     */
    public function max($seconds)
    {
        $this->max = $seconds;

        return $this;
    }

    /**
     * Execute the middleware.
     *
     * @param ServerRequestInterface $request
     * @param ResponseInterface      $response
     * @param callable               $next
     *
     * @return ResponseInterface
     */
    public function __invoke(ServerRequestInterface $request, ResponseInterface $response, callable $next)
    {
        if (!Middleware::hasAttribute($request, FormatNegotiator::KEY)) {
            throw new RuntimeException('FormTimestamp middleware needs FormatNegotiator executed before');
        }

        if (FormatNegotiator::getFormat($request) !== 'html') {
            return $next($request, $response);
        }

        if (Utils\Helpers::isPost($request) && !$this->isValid($request)) {
            return $response->withStatus(403);
        }

        $value = $this->encrypt(time());

        $generator = function () use ($value) {
            return '<input type="hidden" name="'.$this->inputName.'" value="'.$value.'">';
        };

        $response = $next($request, $response);

        return $this->insertIntoPostForms($response, function ($match) use ($generator) {
            return $match[0].$generator();
        });
    }

    /**
     * Check whether the request is valid.
     * 
     * @param ServerRequestInterface $request
     * 
     * @return bool
     */
    private function isValid(ServerRequestInterface $request)
    {
        $data = $request->getParsedBody();

        //value does not exists
        if (empty($data[$this->inputName])) {
            return false;
        }

        try {
            $time = $this->decrypt($data[$this->inputName]);
        } catch (Exception $e) {
            return false;
        }

        //value is not valid
        if (!is_numeric($time)) {
            return false;
        }

        $now = time();

        //sent from future
        if ($now < $time) {
            return false;
        }

        $diff = $now - $time;

        //check min
        if ($diff < $this->min) {
            return false;
        }

        //check max
        if ($this->max && $diff > $this->max) {
            return false;
        }

        return true;
    }
}