whm\Smoke\Rules\Security\PasswordSecureTransferRule

Complexity

Total Complexity

6

Size/Duplication

Total Lines	41
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	3

Importance

Changes

0

1 Method

Rating	Name	Duplication	Size	Complexity
B	doValidation()	0	34	6

<?php

namespace whm\Smoke\Rules\Security;

use Psr\Http\Message\ResponseInterface;
use Symfony\Component\DomCrawler\Crawler;
use whm\Smoke\Http\Response;
use whm\Smoke\Rules\Rule;
use whm\Smoke\Rules\StandardRule;

/**
 * This rule checks if a https request contains any insecure includes via http.
 */
class PasswordSecureTransferRule extends StandardRule
{
    protected $contentTypes = array('text/html');

    private $knownIdentifier = array();

    protected function doValidation(ResponseInterface $response)
    {
        $crawler = new Crawler((string)$response->getBody());
        $actionNodes = $crawler->filterXPath('//form[//input[@type="password"]]');

        $url = (string)$response->getUri();

It seems like you code against a concrete implementation and not the interface Psr\Http\Message\ResponseInterface as the method getUri() does only exist in the following implementations of said interface: phm\HttpWebdriverClient\Http\Client\Chrome\ChromeResponse, phm\HttpWebdriverClient\Http\Client\Guzzle\GuzzleResponse, phm\HttpWebdriverClient\Http\Client\Guzzle\Response, phm\HttpWebdriverClient\Http\Response\BrowserResponse, whm\Smoke\Http\ConnectionRefusedResponse, whm\Smoke\Http\ErrorResponse.

        foreach ($actionNodes as $node) {
            $action = $node->getAttribute('action');

            if (strpos($action, 'https://') === 0) {
                continue;
            }

            $fullPath = $node->tagName;
            $parent = $node->parentNode;

            while ($parent = $parent->parentNode) {
                if (property_exists($parent, 'tagName')) {
                    $fullPath = $parent->tagName . '/' . $fullPath;
                } else {
                    break;
                }
            }

            if (in_array($fullPath, $this->knownIdentifier, true)) {
                continue;
            }

            $this->knownIdentifier[] = $fullPath;

            $this->assert(strpos($url, 'https://') !== false, 'Password is transferred insecure using HTTP.');
        }
    }
}