SAML2\SOAP

Complexity

Total Complexity

7

Size/Duplication

Total Lines	92
Duplicated Lines	0 %

Coupling/Cohesion

Components	0
Dependencies	7

Importance

Changes

0

4 Methods

Rating	Name	Duplication	Size	Complexity
B	getOutputToSend()	0	40	3
A	send()	0	10	1
A	receive()	0	15	2
A	getInputStream()	0	4	1

<?php

namespace SAML2;

use DOMDocument;

use SAML2\XML\ecp\Response as ECPResponse;

/**
 * Class which implements the SOAP binding.
 *
 * @package SimpleSAMLphp
 */
class SOAP extends Binding
{
    public function getOutputToSend(Message $message)
    {
        $envelope = <<<SOAP
<?xml version="1.0" encoding="utf-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="%s">
    <SOAP-ENV:Header />
    <SOAP-ENV:Body />
</SOAP-ENV:Envelope>
SOAP;
        $envelope = sprintf($envelope, Constants::NS_SOAP);

        $doc = new DOMDocument;
        $doc->loadXML($envelope);

        // In the Artifact Resolution profile, this will be an ArtifactResolve
        // containing another message (e.g. a Response), however in the ECP
        // profile, this is the Response itself.
        if ($message instanceof Response) {
            $header = $doc->getElementsByTagNameNS(Constants::NS_SOAP, 'Header')->item(0);

            $response = new ECPResponse;
            $response->AssertionConsumerServiceURL = $this->getDestination() ?: $message->getDestination();

            $response->toXML($header);

$header of type object<DOMNode> is not a sub-type of object<DOMElement>. It seems like you assume a child class of the class DOMNode to be always present.

            // TODO We SHOULD add ecp:RequestAuthenticated SOAP header if we
            // authenticated the AuthnRequest. It may make sense to have a
            // standardized way for Message objects to contain (optional) SOAP
            // headers for use with the SOAP binding.
            //
            // https://docs.oasis-open.org/security/saml/Post2.0/saml-ecp/v2.0/cs01/saml-ecp-v2.0-cs01.html#_Toc366664733
            // See Section 2.3.6.1

38% of this comment could be valid code. Did you maybe forget this after debugging?

        }

        $body = $doc->getElementsByTagNameNs(Constants::NS_SOAP, 'Body')->item(0);

        $body->appendChild($doc->importNode($message->toSignedXML(), true));

        return $doc->saveXML();
    }

    /**
     * Send a SAML 2 message using the SOAP binding.
     *
     * Note: This function never returns.
     *
     * @param \SAML2\Message $message The message we should send.
     *
     * @SuppressWarnings(PHPMD.ExitExpression)
     */
    public function send(Message $message)
    {
        header('Content-Type: text/xml', true);

        $xml = $this->getOutputToSend($message);
        SAML2_Utils::getContainer()->debugMessage($xml, 'out');
        echo $xml;

        exit(0);
    }

    /**
     * Receive a SAML 2 message sent using the HTTP-POST binding.
     *
     * Throws an exception if it is unable receive the message.
     *
     * @return \SAML2\Message The received message.
     * @throws \Exception
     */
    public function receive()
    {
        $postText = $this->getInputStream();

        if (empty($postText)) {
            throw new \Exception('Invalid message received to AssertionConsumerService endpoint.');
        }

        $document = DOMDocumentFactory::fromString($postText);
        $xml = $document->firstChild;
        Utils::getContainer()->debugMessage($xml, 'in');

$xml is of type object<DOMNode>, but the function expects a string.

        $results = Utils::xpQuery($xml, '/soap-env:Envelope/soap-env:Body/*[1]');

        return Message::fromXML($results[0]);
    }

    protected function getInputStream()
    {
        return file_get_contents('php://input');
    }
}