This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace Http\Client\Plugin; |
||
4 | |||
5 | 1 | @trigger_error('The '.__NAMESPACE__.'\CookiePlugin class is deprecated since version 1.1 and will be removed in 2.0. Use Http\Client\Common\Plugin\CookiePlugin instead.', E_USER_DEPRECATED); |
|
6 | |||
7 | use Http\Client\Exception\TransferException; |
||
8 | use Http\Message\Cookie; |
||
9 | use Http\Message\CookieJar; |
||
10 | use Psr\Http\Message\RequestInterface; |
||
11 | use Psr\Http\Message\ResponseInterface; |
||
12 | |||
13 | /** |
||
14 | * Handle request cookies. |
||
15 | * |
||
16 | * @author Joel Wurtz <[email protected]> |
||
17 | * |
||
18 | * @deprecated since since version 1.1, and will be removed in 2.0. Use {@link \Http\Client\Common\Plugin\CookiePlugin} instead. |
||
19 | */ |
||
20 | class CookiePlugin implements Plugin |
||
0 ignored issues
–
show
|
|||
21 | { |
||
22 | /** |
||
23 | * Cookie storage. |
||
24 | * |
||
25 | * @var CookieJar |
||
26 | */ |
||
27 | private $cookieJar; |
||
28 | |||
29 | /** |
||
30 | * @param CookieJar $cookieJar |
||
31 | */ |
||
32 | 10 | public function __construct(CookieJar $cookieJar) |
|
33 | { |
||
34 | 10 | $this->cookieJar = $cookieJar; |
|
35 | 10 | } |
|
36 | |||
37 | /** |
||
38 | * {@inheritdoc} |
||
39 | */ |
||
40 | 8 | public function handleRequest(RequestInterface $request, callable $next, callable $first) |
|
41 | { |
||
42 | 8 | foreach ($this->cookieJar->getCookies() as $cookie) { |
|
43 | 6 | if ($cookie->isExpired()) { |
|
44 | 1 | continue; |
|
45 | } |
||
46 | |||
47 | 5 | if (!$cookie->matchDomain($request->getUri()->getHost())) { |
|
48 | 1 | continue; |
|
49 | } |
||
50 | |||
51 | 4 | if (!$cookie->matchPath($request->getUri()->getPath())) { |
|
52 | 1 | continue; |
|
53 | } |
||
54 | |||
55 | 3 | if ($cookie->isSecure() && ('https' !== $request->getUri()->getScheme())) { |
|
56 | 1 | continue; |
|
57 | } |
||
58 | |||
59 | 2 | $request = $request->withAddedHeader('Cookie', sprintf('%s=%s', $cookie->getName(), $cookie->getValue())); |
|
60 | 8 | } |
|
61 | |||
62 | 8 | return $next($request)->then(function (ResponseInterface $response) use ($request) { |
|
63 | 2 | if ($response->hasHeader('Set-Cookie')) { |
|
64 | 2 | $setCookies = $response->getHeader('Set-Cookie'); |
|
65 | |||
66 | 2 | foreach ($setCookies as $setCookie) { |
|
67 | 2 | $cookie = $this->createCookie($request, $setCookie); |
|
68 | |||
69 | // Cookie invalid do not use it |
||
70 | 1 | if (null === $cookie) { |
|
71 | continue; |
||
72 | } |
||
73 | |||
74 | // Restrict setting cookie from another domain |
||
75 | 1 | if (false === strpos($cookie->getDomain(), $request->getUri()->getHost())) { |
|
76 | continue; |
||
77 | } |
||
78 | |||
79 | 1 | $this->cookieJar->addCookie($cookie); |
|
80 | 1 | } |
|
81 | 1 | } |
|
82 | |||
83 | 1 | return $response; |
|
84 | 8 | }); |
|
85 | } |
||
86 | |||
87 | /** |
||
88 | * Creates a cookie from a string. |
||
89 | * |
||
90 | * @param RequestInterface $request |
||
91 | * @param $setCookie |
||
92 | * |
||
93 | * @return Cookie|null |
||
94 | * |
||
95 | * @throws \Http\Client\Exception\TransferException |
||
96 | */ |
||
97 | 2 | private function createCookie(RequestInterface $request, $setCookie) |
|
98 | { |
||
99 | 2 | $parts = array_map('trim', explode(';', $setCookie)); |
|
100 | |||
101 | 2 | if (empty($parts) || !strpos($parts[0], '=')) { |
|
102 | return; |
||
103 | } |
||
104 | |||
105 | 2 | list($name, $cookieValue) = $this->createValueKey(array_shift($parts)); |
|
106 | |||
107 | 2 | $maxAge = null; |
|
108 | 2 | $expires = null; |
|
109 | 2 | $domain = $request->getUri()->getHost(); |
|
110 | 2 | $path = $request->getUri()->getPath(); |
|
111 | 2 | $secure = false; |
|
112 | 2 | $httpOnly = false; |
|
113 | |||
114 | // Add the cookie pieces into the parsed data array |
||
115 | 2 | foreach ($parts as $part) { |
|
116 | 2 | list($key, $value) = $this->createValueKey($part); |
|
117 | |||
118 | 2 | switch (strtolower($key)) { |
|
119 | 2 | case 'expires': |
|
120 | 2 | $expires = \DateTime::createFromFormat(\DateTime::COOKIE, $value); |
|
121 | |||
122 | 2 | if (true !== ($expires instanceof \DateTime)) { |
|
123 | 1 | throw new TransferException( |
|
124 | 1 | sprintf( |
|
125 | 1 | 'Cookie header `%s` expires value `%s` could not be converted to date', |
|
126 | 1 | $name, |
|
127 | $value |
||
128 | 1 | ) |
|
129 | 1 | ); |
|
130 | } |
||
131 | |||
132 | 1 | break; |
|
133 | |||
134 | 1 | case 'max-age': |
|
135 | 1 | $maxAge = (int) $value; |
|
136 | |||
137 | 1 | break; |
|
138 | |||
139 | 1 | case 'domain': |
|
140 | 1 | $domain = $value; |
|
141 | |||
142 | 1 | break; |
|
143 | |||
144 | 1 | case 'path': |
|
145 | 1 | $path = $value; |
|
146 | |||
147 | 1 | break; |
|
148 | |||
149 | 1 | case 'secure': |
|
150 | 1 | $secure = true; |
|
151 | |||
152 | 1 | break; |
|
153 | |||
154 | 1 | case 'httponly': |
|
155 | 1 | $httpOnly = true; |
|
156 | |||
157 | 1 | break; |
|
158 | 1 | } |
|
159 | 1 | } |
|
160 | |||
161 | 1 | return new Cookie($name, $cookieValue, $maxAge, $domain, $path, $secure, $httpOnly, $expires); |
|
162 | } |
||
163 | |||
164 | /** |
||
165 | * Separates key/value pair from cookie. |
||
166 | * |
||
167 | * @param $part |
||
168 | * |
||
169 | * @return array |
||
170 | */ |
||
171 | 2 | private function createValueKey($part) |
|
172 | { |
||
173 | 2 | $parts = explode('=', $part, 2); |
|
174 | 2 | $key = trim($parts[0]); |
|
175 | 2 | $value = isset($parts[1]) ? trim($parts[1]) : true; |
|
176 | |||
177 | 2 | return [$key, $value]; |
|
178 | } |
||
179 | } |
||
180 |
This class, trait or interface has been deprecated. The supplier of the file has supplied an explanatory message.
The explanatory message should give you some clue as to whether and when the type will be removed from the class and what other constant to use instead.