View GitHub Repository ubiquity-security

Schedule Inspection
Subscribe
Passed
Push — master ( b3e27e...db1dbb )
by Jean-Christophe
01:47
created

NonceGenerator::_generateNonce()   A

↳ Parent: NonceGenerator

Complexity

Conditions 2
Paths 2

Size

Total Lines 7
Code Lines 5

Duplication

Lines 0
Ratio 0 %

Importance

Changes 1
Bugs 0 Features 1
Metric Value
eloc 5
c 1
b 0
f 1
dl 0
loc 7
rs 10
cc 2
nc 2
nop 2
1 
<?php
2 
namespace Ubiquity\security\csp;
3 

            


            
                                                                                                            
                            
            
                                    
            
            

                
                    4
                

                                    
                                                    
                
                
                
use Ubiquity\utils\http\URequest;

            


            
                                                                                                            
                            
            
                                    
            
            

                
                    5
                

                                    
                                                    
                
                
                

            


            
                                                                                                            
                            
            
                                    
            
            

                
                    6
                

                                    
                                                    
                
                
                
class NonceGenerator {

            


            
                                                                                                            
                            
            
                                    
            
            

                
                    7
                

                                    
                                                    
                
                
                

            


            
                                                                                                            
                            
            
                                    
            
            

                
                    8
                

                                    
                                                    
                
                
                
	private array $nonces = [];

            


            
                                                                                                            
                                                                
            
                                    
            
            

                
                    9
                

                                    
                                                    
                
                
                

            


            
                                                                        
                            
            
                                    
            
            

                
                    10
                

                                    
                                                    
                
                
                
	protected function _generateNonce(string $name, ?int $value = null): string {

            


            
                                                                        
                            
            
                                    
            
            

                
                    11
                

                                    
                                                    
                
                
                
		$bytes = \random_bytes((int) ($value ?? 32));

            


            
                                                                        
                            
            
                                    
            
            

                
                    12
                

                                    
                                                    
                
                
                
		$nonce = \base64_encode($bytes);

            


            
                                                                        
                            
            
                                    
            
            

                
                    13
                

                                    
                                                    
                
                
                
		if (! URequest::isAjax()) {

            


            
                                                                        
                            
            
                                    
            
            

                
                    14
                

                                    
                                                    
                
                
                
			$this->onNonce($name, $nonce);

            


            
                                                                        
                            
            
                                    
            
            

                
                    15
                

                                    
                                                    
                
                
                
		}

            


            
                                                                        
                            
            
                                    
            
            

                
                    16
                

                                    
                                                    
                
                
                
		return $nonce;

            


            
                                                                                                            
                            
            
                                    
            
            

                
                    17
                

                                    
                                                    
                
                
                
	}

            


            
                                                                                                            
                            
            
                                    
            
            

                
                    18
                

                                    
                                                    
                
                
                

            


            
                                                                                                            
                            
            
                                    
            
            

                
                    19
                

                                    
                                                    
                
                
                
	public function getNonce(string $name) {

            


            
                                                                                                            
                            
            
                                    
            
            

                
                    20
                

                                    
                                                    
                
                
                
		return $this->nonces[$name] ??= self::_generateNonce($name, $value);

            


                            

                    
                        
                    
                    
                    
                    
                                                                                                                                                        
                        

                            
                            
0 ignored issues

                            –
                            show
                        


                        

                                                                                        




    

        
            Bug
            Best Practice
    
    
    
        introduced 
                            by 
            

        

        

            
        

        

            

                

                    
                
                
            


        

    

    

        
                        

                            
                        

                                        
The method Ubiquity\security\csp\No...rator::_generateNonce() is not static, but was called statically.
                                                                                   (
                                     Ignorable by Annotation
                                )
                                

                                    
 If this is a false-positive, you can also ignore this issue in your code via the ignore-call   annotation

                                    

                                        

                                            20
                                            
                                                
		return $this->nonces[$name] ??= self::/** @scrutinizer ignore-call */ _generateNonce($name, $value);

                                        

                                                                            

                                

                                                                                                                            

                    
                                                    

                     Loading history...
                

                    


    




                                                                                            




    

        
            Comprehensibility
            Best Practice
    
    
    
        introduced 
                            by 
            

        

        

            
        

        

            

                

                    
                
                
            


        

    

    

        
                        

                            
                        

                                        
The variable $value seems to be never defined.
                                                                                                

                    
                                                    

                     Loading history...
                

                    


    




                                                                                    


                    		
                

            
                                                                                                            
                            
            
                                    
            
            

                
                    21
                

                                    
                                                    
                
                
                
	}

            


            
                                                                                                            
                            
            
                                    
            
            

                
                    22
                

                                    
                                                    
                
                
                

            


            
                                                                                                            
                            
            
                                    
            
            

                
                    23
                

                                    
                                                    
                
                
                
	function onNonce(string $name, string $value) {}

            


                            

                    
                        
                    
                    
                    
                    
                                                                                                                                                                                                            
                        

                            
                            
0 ignored issues

                            –
                            show
                        


                        

                                                                                        




    

        
            Unused Code
    
    
    
        introduced 
                            by 
            

        

        

            
        

        

            

                

                    
                
                
            


        

    

    

        
                        

                            
                                
                            
                        

                                        
The parameter $value is not used and could be removed.
                                                                                   (
                                     Ignorable by Annotation
                                )
                                

                                    
 If this is a false-positive, you can also ignore this issue in your code via the ignore-unused   annotation

                                    

                                        

                                            23
                                            
                                                
	function onNonce(string $name, /** @scrutinizer ignore-unused */ string $value) {}

                                        

                                                                            

                                

                                                                                                                            

                    
                                            

                            

                            

                                
                                    
                                
                            


                            
This check looks for parameters that have been defined for a function or method, but which
are not used in the method body.


                        

                                                    

                     Loading history...
                

                    


    




                                                                                            




    

        
            Unused Code
    
    
    
        introduced 
                            by 
            

        

        

            
        

        

            

                

                    
                
                
            


        

    

    

        
                        

                            
                                
                            
                        

                                        
The parameter $name is not used and could be removed.
                                                                                   (
                                     Ignorable by Annotation
                                )
                                

                                    
 If this is a false-positive, you can also ignore this issue in your code via the ignore-unused   annotation

                                    

                                        

                                            23
                                            
                                                
	function onNonce(/** @scrutinizer ignore-unused */ string $name, string $value) {}

                                        

                                                                            

                                

                                                                                                                            

                    
                                            

                            

                            

                                
                                    
                                
                            


                            
This check looks for parameters that have been defined for a function or method, but which
are not used in the method body.


                        

                                                    

                     Loading history...
                

                    


    




                                                                                            




    

        
            Best Practice
    
    
    
        introduced 
                            by 
            

        

        

            
        

        

            

                

                    
                
                
            


        

    

    

        
                        

                            
                                
                            
                        

                                        
It is generally recommended to explicitly declare the visibility for methods.
                                            

                    
                                            

                            

                            

                                
                                    
                                
                            


                            
Adding explicit visibility (private, protected, or public) is generally
recommend to communicate to other developers how, and from where this method
is intended to be used.


                        

                                                    

                     Loading history...
                

                    


    




                                                                                    


                    		
                

            
                                                                                                            
                            
            
                                    
            
            

                
                    24
                

                                    
                                                    
                
                
                
}

            


            
                                                                                                            
                                                                
            
                                    
            
            

                
                    25
                

                                    
                                                    
                
                
                

            


            
                                                        
            
                                    
            
            

                
                    26