CsrfManager::getRequestToken() - Code Metrics - Inspection of "Remove CSRF Manager unique support" - platine-php/framework - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — develop ( 1bde09...a10a8a )

by nguereza

created 2023-11-02 11:42 UTC

CsrfManager::getRequestToken() A

↳ Parent: CsrfManager

Complexity

Conditions	3
Paths	4

Size

Total Lines	14
Code Lines	7

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	3
eloc	7
c	0
b	0
f	0
nc	4
nop	2
dl	0
loc	14
rs	10

<?php

/**
 * Platine Framework
 *
 * Platine Framework is a lightweight, high-performance, simple and elegant PHP
 * Web framework
 *
 * This content is released under the MIT License (MIT)
 *
 * Copyright (c) 2020 Platine Framework
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in all
 * copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 */

/**
 *  @file CsrfManager.php
 *
 *  The CSRF manager class
 *
 *  @package    Platine\Framework\Security\Csrf
 *  @author Platine Developers team
 *  @copyright  Copyright (c) 2020
 *  @license    http://opensource.org/licenses/MIT  MIT License
 *  @link   https://www.platine-php.com
 *  @version 1.0.0
 *  @filesource
 */

declare(strict_types=1);

namespace Platine\Framework\Security\Csrf;

use Platine\Config\Config;
use Platine\Framework\Http\RequestData;
use Platine\Framework\Security\Csrf\CsrfStorageInterface;
use Platine\Framework\Security\Csrf\Storage\CsrfNullStorage;
use Platine\Http\ServerRequestInterface;
use Platine\Stdlib\Helper\Str;

/**
 * @class CsrfManager
 * @package Platine\Framework\Security\Csrf
 */
class CsrfManager
{
    /**
     * The application configuration class
     * @var Config
     */
    protected Config $config;

    /**
     * The storage to be used
     * @var CsrfStorageInterface
     */
    protected CsrfStorageInterface $storage;

    /**
     * Create new instance
     * @param Config $config
     * @param CsrfStorageInterface|null $storage
     */
    public function __construct(
        Config $config,
        ?CsrfStorageInterface $storage = null
    ) {
        $this->config = $config;
        $this->storage = $storage ??  new CsrfNullStorage();
    }

    /**
     * Validate the token
     * @param ServerRequestInterface $request
     * @param string|null $key
     * @return bool
     */
    public function validate(ServerRequestInterface $request, ?string $key = null): bool
    {
        if ($key === null) {
            $key = $this->getConfigValue('key');
        }

        $storageToken = $this->storage->get($key);
        if ($storageToken === null) {
            return false;
        }

        $token = $this->getRequestToken($request, $key);

        if ($token === null || $token !== $storageToken) {
            return false;
        }

        return true;
    }

    /**
     * Return the token
     * @param string|null $key
     * @return string
     */
    public function getToken(?string $key = null): string
    {
        if ($key === null) {
            $key = $this->getConfigValue('key');
        }

        $value = $this->storage->get($key);
        if ($value === null) {
            // Generate the token
            $value = sha1(Str::randomToken(24));
            $expire = $this->getConfigValue('expire') ?? 300;
            $expireTime = time() + $expire;

            $this->storage->set($key, $value, $expireTime);
        }

        return $value;
    }

    /**
     * Return the token query to be used in query string
     * @param string|null $key
     * @return array<string, string>
     */
    public function getTokenQuery(?string $key = null): array
    {
        $token = $this->getToken($key);

        if ($key === null) {
            $key = $this->getConfigValue('key');
        }

        return [$key => $token];
    }

    /**
     * Clear all CSRF data from storage
     * @return void
     */
    public function clear(): void
    {
        $this->storage->clear();
    }

    /**
     * Return the token from request
     * @param ServerRequestInterface $request
     * @param string $key
     * @return string|null
     */
    protected function getRequestToken(ServerRequestInterface $request, string $key): ?string
    {
        $param = new RequestData($request);
        $token = $param->post($key);
        if ($token === null) {
            $token = $param->get($key);
        }

        if ($token === null) {
            $token = $request->getHeaderLine('X-Csrf-Token');
        }


        return $token;
    }

    /**
     * Return the CSRF configuration value
     * @param string $key
     * @return mixed
     */
    private function getConfigValue(string $key)
    {
        $config = $this->config->get('security.csrf', []);

        return $config[$key] ?? null;
    }
}


1			<?php
2
3			/**
4			* Platine Framework
5			*
6			* Platine Framework is a lightweight, high-performance, simple and elegant PHP
7			* Web framework
8			*
9			* This content is released under the MIT License (MIT)
10			*
11			* Copyright (c) 2020 Platine Framework
12			*
13			* Permission is hereby granted, free of charge, to any person obtaining a copy
14			* of this software and associated documentation files (the "Software"), to deal
15			* in the Software without restriction, including without limitation the rights
16			* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
17			* copies of the Software, and to permit persons to whom the Software is
18			* furnished to do so, subject to the following conditions:
19			*
20			* The above copyright notice and this permission notice shall be included in all
21			* copies or substantial portions of the Software.
22			*
23			* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
24			* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
25			* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
26			* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
27			* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
28			* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
29			* SOFTWARE.
30			*/
31
32			/**
33			* @file CsrfManager.php
34			*
35			* The CSRF manager class
36			*
37			* @package Platine\Framework\Security\Csrf
38			* @author Platine Developers team
39			* @copyright Copyright (c) 2020
40			* @license http://opensource.org/licenses/MIT MIT License
41			* @link https://www.platine-php.com
42			* @version 1.0.0
43			* @filesource
44			*/
45
46			declare(strict_types=1);
47
48			namespace Platine\Framework\Security\Csrf;
49
50			use Platine\Config\Config;
51			use Platine\Framework\Http\RequestData;
52			use Platine\Framework\Security\Csrf\CsrfStorageInterface;
53			use Platine\Framework\Security\Csrf\Storage\CsrfNullStorage;
54			use Platine\Http\ServerRequestInterface;
55			use Platine\Stdlib\Helper\Str;
56
57			/**
58			* @class CsrfManager
59			* @package Platine\Framework\Security\Csrf
60			*/
61			class CsrfManager
62			{
63			/**
64			* The application configuration class
65			* @var Config
66			*/
67			protected Config $config;
68
69			/**
70			* The storage to be used
71			* @var CsrfStorageInterface
72			*/
73			protected CsrfStorageInterface $storage;
74
75			/**
76			* Create new instance
77			* @param Config $config
78			* @param CsrfStorageInterface\|null $storage
79			*/
80			public function __construct(
81			Config $config,
82			?CsrfStorageInterface $storage = null
83			) {
84			$this->config = $config;
85			$this->storage = $storage ?? new CsrfNullStorage();
86			}
87
88			/**
89			* Validate the token
90			* @param ServerRequestInterface $request
91			* @param string\|null $key
92			* @return bool
93			*/
94			public function validate(ServerRequestInterface $request, ?string $key = null): bool
95			{
96			if ($key === null) {
97			$key = $this->getConfigValue('key');
98			}
99
100			$storageToken = $this->storage->get($key);
101			if ($storageToken === null) {
102			return false;
103			}
104
105			$token = $this->getRequestToken($request, $key);
106
107			if ($token === null \|\| $token !== $storageToken) {
108			return false;
109			}
110
111			return true;
112			}
113
114			/**
115			* Return the token
116			* @param string\|null $key
117			* @return string
118			*/
119			public function getToken(?string $key = null): string
120			{
121			if ($key === null) {
122			$key = $this->getConfigValue('key');
123			}
124
125			$value = $this->storage->get($key);
126			if ($value === null) {
127			// Generate the token
128			$value = sha1(Str::randomToken(24));
129			$expire = $this->getConfigValue('expire') ?? 300;
130			$expireTime = time() + $expire;
131
132			$this->storage->set($key, $value, $expireTime);
133			}
134
135			return $value;
136			}
137
138			/**
139			* Return the token query to be used in query string
140			* @param string\|null $key
141			* @return array<string, string>
142			*/
143			public function getTokenQuery(?string $key = null): array
144			{
145			$token = $this->getToken($key);
146
147			if ($key === null) {
148			$key = $this->getConfigValue('key');
149			}
150
151			return [$key => $token];
152			}
153
154			/**
155			* Clear all CSRF data from storage
156			* @return void
157			*/
158			public function clear(): void
159			{
160			$this->storage->clear();
161			}
162
163			/**
164			* Return the token from request
165			* @param ServerRequestInterface $request
166			* @param string $key
167			* @return string\|null
168			*/
169			protected function getRequestToken(ServerRequestInterface $request, string $key): ?string
170			{
171			$param = new RequestData($request);
172			$token = $param->post($key);
173			if ($token === null) {
174			$token = $param->get($key);
175			}
176
177			if ($token === null) {
178			$token = $request->getHeaderLine('X-Csrf-Token');
179			}
180
181
182			return $token;
183			}
184
185			/**
186			* Return the CSRF configuration value
187			* @param string $key
188			* @return mixed
189			*/
190			private function getConfigValue(string $key)
191			{
192			$config = $this->config->get('security.csrf', []);
193
194			return $config[$key] ?? null;
195			}
196			}
197

platine-php / framework

Push — develop ( 1bde09...a10a8a )

CsrfManager::getRequestToken() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like