CsrfManager::getTokenQuery() - Code Metrics - Inspection of "Add CSRF Manager support to return token query" - platine-php/framework - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — develop ( a0535d...9820b2 )

by nguereza

created 2023-11-02 04:48 UTC

CsrfManager::getTokenQuery() A

↳ Parent: CsrfManager

Complexity

Conditions	2
Paths	2

Size

Total Lines	9
Code Lines	4

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	2
eloc	4
nc	2
nop	1
dl	0
loc	9
rs	10
c	0
b	0
f	0

<?php

/**
 * Platine Framework
 *
 * Platine Framework is a lightweight, high-performance, simple and elegant PHP
 * Web framework
 *
 * This content is released under the MIT License (MIT)
 *
 * Copyright (c) 2020 Platine Framework
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in all
 * copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 */

/**
 *  @file CsrfManager.php
 *
 *  The CSRF manager class
 *
 *  @package    Platine\Framework\Security\Csrf
 *  @author Platine Developers team
 *  @copyright  Copyright (c) 2020
 *  @license    http://opensource.org/licenses/MIT  MIT License
 *  @link   https://www.platine-php.com
 *  @version 1.0.0
 *  @filesource
 */

declare(strict_types=1);

namespace Platine\Framework\Security\Csrf;

use Platine\Config\Config;
use Platine\Framework\Http\RequestData;
use Platine\Framework\Security\Csrf\CsrfStorageInterface;
use Platine\Framework\Security\Csrf\Storage\CsrfNullStorage;
use Platine\Http\ServerRequestInterface;
use Platine\Stdlib\Helper\Str;

/**
 * @class CsrfManager
 * @package Platine\Framework\Security\Csrf
 */
class CsrfManager
{
    /**
     * The application configuration class
     * @var Config
     */
    protected Config $config;

    /**
     * The storage to be used
     * @var CsrfStorageInterface
     */
    protected CsrfStorageInterface $storage;

    /**
     * Whether return need generate token per request or not
     * @var bool
     */
    protected bool $unique = false;

    /**
     * Create new instance
     * @param Config $config
     * @param CsrfStorageInterface|null $storage
     */
    public function __construct(
        Config $config,
        ?CsrfStorageInterface $storage = null
    ) {
        $this->config = $config;
        $this->storage = $storage ??  new CsrfNullStorage();
    }

    /**
     * Validate the token
     * @param ServerRequestInterface $request
     * @param string|null $key
     * @return bool
     */
    public function validate(ServerRequestInterface $request, ?string $key = null): bool
    {
        if ($key === null) {
            $key = $this->getConfigValue('key');
        }

        $storageToken = $this->storage->get($key);
        if ($storageToken === null) {
            return false;
        }

        $param = new RequestData($request);
        $token = $param->post($key);
        if ($token === null) {
            $token = $param->get($key);
        }

        if ($token === null || $token !== $storageToken) {
            return false;
        }

        if ($this->unique === false) {
            $this->storage->delete($key);
        }

        return true;
    }

    /**
     * Return the token
     * @param string|null $key
     * @return string
     */
    public function getToken(?string $key = null): string
    {
        if ($key === null) {
            $key = $this->getConfigValue('key');
        }

        $value = $this->storage->get($key);
        if ($value === null) {
            // Generate the token
            $value = sha1(Str::randomToken(24));
            $expire = $this->getConfigValue('expire') ?? 300;
            $expireTime = time() + $expire;

            $this->storage->set($key, $value, $expireTime);
        }

        return $value;
    }

    /**
     * Return the token query to be used in query string
     * @param string|null $key
     * @return array<string, string>
     */
    public function getTokenQuery(?string $key = null): array
    {
        $token = $this->getToken($key);

        if ($key === null) {
            $key = $this->getConfigValue('key');
        }

        return [$key => $token];
    }

    /**
     * Clear all CSRF data from storage
     * @return void
     */
    public function clear(): void
    {
        $this->storage->clear();
    }

    /**
     *
     * @param bool $status
     * @return $this
     */
    public function unique(bool $status = true): self
    {
        $this->unique = $status;

        return $this;
    }

    /**
     * Return the CSRF configuration value
     * @param string $key
     * @return mixed
     */
    private function getConfigValue(string $key)
    {
        $config = $this->config->get('security.csrf', []);

        return $config[$key] ?? null;
    }
}


1			<?php
2
3			/**
4			* Platine Framework
5			*
6			* Platine Framework is a lightweight, high-performance, simple and elegant PHP
7			* Web framework
8			*
9			* This content is released under the MIT License (MIT)
10			*
11			* Copyright (c) 2020 Platine Framework
12			*
13			* Permission is hereby granted, free of charge, to any person obtaining a copy
14			* of this software and associated documentation files (the "Software"), to deal
15			* in the Software without restriction, including without limitation the rights
16			* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
17			* copies of the Software, and to permit persons to whom the Software is
18			* furnished to do so, subject to the following conditions:
19			*
20			* The above copyright notice and this permission notice shall be included in all
21			* copies or substantial portions of the Software.
22			*
23			* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
24			* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
25			* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
26			* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
27			* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
28			* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
29			* SOFTWARE.
30			*/
31
32			/**
33			* @file CsrfManager.php
34			*
35			* The CSRF manager class
36			*
37			* @package Platine\Framework\Security\Csrf
38			* @author Platine Developers team
39			* @copyright Copyright (c) 2020
40			* @license http://opensource.org/licenses/MIT MIT License
41			* @link https://www.platine-php.com
42			* @version 1.0.0
43			* @filesource
44			*/
45
46			declare(strict_types=1);
47
48			namespace Platine\Framework\Security\Csrf;
49
50			use Platine\Config\Config;
51			use Platine\Framework\Http\RequestData;
52			use Platine\Framework\Security\Csrf\CsrfStorageInterface;
53			use Platine\Framework\Security\Csrf\Storage\CsrfNullStorage;
54			use Platine\Http\ServerRequestInterface;
55			use Platine\Stdlib\Helper\Str;
56
57			/**
58			* @class CsrfManager
59			* @package Platine\Framework\Security\Csrf
60			*/
61			class CsrfManager
62			{
63			/**
64			* The application configuration class
65			* @var Config
66			*/
67			protected Config $config;
68
69			/**
70			* The storage to be used
71			* @var CsrfStorageInterface
72			*/
73			protected CsrfStorageInterface $storage;
74
75			/**
76			* Whether return need generate token per request or not
77			* @var bool
78			*/
79			protected bool $unique = false;
80
81			/**
82			* Create new instance
83			* @param Config $config
84			* @param CsrfStorageInterface\|null $storage
85			*/
86			public function __construct(
87			Config $config,
88			?CsrfStorageInterface $storage = null
89			) {
90			$this->config = $config;
91			$this->storage = $storage ?? new CsrfNullStorage();
92			}
93
94			/**
95			* Validate the token
96			* @param ServerRequestInterface $request
97			* @param string\|null $key
98			* @return bool
99			*/
100			public function validate(ServerRequestInterface $request, ?string $key = null): bool
101			{
102			if ($key === null) {
103			$key = $this->getConfigValue('key');
104			}
105
106			$storageToken = $this->storage->get($key);
107			if ($storageToken === null) {
108			return false;
109			}
110
111			$param = new RequestData($request);
112			$token = $param->post($key);
113			if ($token === null) {
114			$token = $param->get($key);
115			}
116
117			if ($token === null \|\| $token !== $storageToken) {
118			return false;
119			}
120
121			if ($this->unique === false) {
122			$this->storage->delete($key);
123			}
124
125			return true;
126			}
127
128			/**
129			* Return the token
130			* @param string\|null $key
131			* @return string
132			*/
133			public function getToken(?string $key = null): string
134			{
135			if ($key === null) {
136			$key = $this->getConfigValue('key');
137			}
138
139			$value = $this->storage->get($key);
140			if ($value === null) {
141			// Generate the token
142			$value = sha1(Str::randomToken(24));
143			$expire = $this->getConfigValue('expire') ?? 300;
144			$expireTime = time() + $expire;
145
146			$this->storage->set($key, $value, $expireTime);
147			}
148
149			return $value;
150			}
151
152			/**
153			* Return the token query to be used in query string
154			* @param string\|null $key
155			* @return array<string, string>
156			*/
157			public function getTokenQuery(?string $key = null): array
158			{
159			$token = $this->getToken($key);
160
161			if ($key === null) {
162			$key = $this->getConfigValue('key');
163			}
164
165			return [$key => $token];
166			}
167
168			/**
169			* Clear all CSRF data from storage
170			* @return void
171			*/
172			public function clear(): void
173			{
174			$this->storage->clear();
175			}
176
177			/**
178			*
179			* @param bool $status
180			* @return $this
181			*/
182			public function unique(bool $status = true): self
183			{
184			$this->unique = $status;
185
186			return $this;
187			}
188
189			/**
190			* Return the CSRF configuration value
191			* @param string $key
192			* @return mixed
193			*/
194			private function getConfigValue(string $key)
195			{
196			$config = $this->config->get('security.csrf', []);
197
198			return $config[$key] ?? null;
199			}
200			}
201

platine-php / framework

Push — develop ( a0535d...9820b2 )

CsrfManager::getTokenQuery() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like