simplesamlphp /
saml2
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||
| 2 | |||||
| 3 | declare(strict_types=1); |
||||
| 4 | |||||
| 5 | namespace SimpleSAML\SAML2\XML\saml; |
||||
| 6 | |||||
| 7 | use DOMElement; |
||||
| 8 | use SimpleSAML\SAML2\Assert\Assert; |
||||
| 9 | use SimpleSAML\SAML2\Exception\RuntimeException; |
||||
| 10 | use SimpleSAML\XML\AbstractElement; |
||||
| 11 | use SimpleSAML\XML\Chunk; |
||||
| 12 | use SimpleSAML\XML\Registry\ElementRegistry; |
||||
| 13 | use SimpleSAML\XML\SchemaValidatableElementInterface; |
||||
| 14 | use SimpleSAML\XML\SchemaValidatableElementTrait; |
||||
| 15 | use SimpleSAML\XMLSchema\Constants as C_XSI; |
||||
|
0 ignored issues
–
show
|
|||||
| 16 | use SimpleSAML\XMLSchema\Exception\InvalidDOMElementException; |
||||
| 17 | use SimpleSAML\XMLSchema\Type\DateTimeValue; |
||||
|
0 ignored issues
–
show
The type
SimpleSAML\XMLSchema\Type\DateTimeValue was not found. Maybe you did not declare it correctly or list all dependencies?
The issue could also be caused by a filter entry in the build configuration.
If the path has been excluded in your configuration, e.g. filter:
dependency_paths: ["lib/*"]
For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths Loading history...
|
|||||
| 18 | use SimpleSAML\XMLSchema\Type\IntegerValue; |
||||
|
0 ignored issues
–
show
The type
SimpleSAML\XMLSchema\Type\IntegerValue was not found. Maybe you did not declare it correctly or list all dependencies?
The issue could also be caused by a filter entry in the build configuration.
If the path has been excluded in your configuration, e.g. filter:
dependency_paths: ["lib/*"]
For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths Loading history...
|
|||||
| 19 | use SimpleSAML\XMLSchema\Type\Interface\ValueTypeInterface; |
||||
| 20 | use SimpleSAML\XMLSchema\Type\StringValue; |
||||
|
0 ignored issues
–
show
The type
SimpleSAML\XMLSchema\Type\StringValue was not found. Maybe you did not declare it correctly or list all dependencies?
The issue could also be caused by a filter entry in the build configuration.
If the path has been excluded in your configuration, e.g. filter:
dependency_paths: ["lib/*"]
For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths Loading history...
|
|||||
| 21 | |||||
| 22 | use function sprintf; |
||||
| 23 | use function strval; |
||||
| 24 | |||||
| 25 | /** |
||||
| 26 | * Serializable class representing an AttributeValue. |
||||
| 27 | * |
||||
| 28 | * @package simplesamlphp/saml2 |
||||
| 29 | */ |
||||
| 30 | class AttributeValue extends AbstractSamlElement implements SchemaValidatableElementInterface |
||||
|
0 ignored issues
–
show
The type
SimpleSAML\SAML2\XML\saml\AbstractSamlElement was not found. Maybe you did not declare it correctly or list all dependencies?
The issue could also be caused by a filter entry in the build configuration.
If the path has been excluded in your configuration, e.g. filter:
dependency_paths: ["lib/*"]
For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths Loading history...
|
|||||
| 31 | { |
||||
| 32 | use SchemaValidatableElementTrait; |
||||
| 33 | |||||
| 34 | |||||
| 35 | /** |
||||
| 36 | * Create an AttributeValue. |
||||
| 37 | * |
||||
| 38 | * @param ( |
||||
| 39 | * \SimpleSAML\XMLSchema\Type\Interface\ValueTypeInterface| |
||||
| 40 | * \SimpleSAML\XML\AbstractElement| |
||||
| 41 | * null |
||||
| 42 | * ) $value |
||||
| 43 | */ |
||||
| 44 | final public function __construct( |
||||
| 45 | protected ValueTypeInterface|AbstractElement|null $value, |
||||
| 46 | ) { |
||||
| 47 | } |
||||
| 48 | |||||
| 49 | |||||
| 50 | /** |
||||
| 51 | * Get the XSI type of this attribute value. |
||||
| 52 | */ |
||||
| 53 | public function getXsiType(): string |
||||
| 54 | { |
||||
| 55 | $value = $this->getValue(); |
||||
| 56 | |||||
| 57 | if ($value === null) { |
||||
| 58 | return 'xs:nil'; |
||||
| 59 | } elseif ($value instanceof AbstractElement) { |
||||
| 60 | return sprintf( |
||||
| 61 | '%s:%s', |
||||
| 62 | $value::getNamespacePrefix(), |
||||
| 63 | AbstractElement::getClassName(get_class($value)), |
||||
| 64 | ); |
||||
| 65 | } |
||||
| 66 | |||||
| 67 | return $value->getType(); |
||||
| 68 | } |
||||
| 69 | |||||
| 70 | |||||
| 71 | /** |
||||
| 72 | * Get this attribute value. |
||||
| 73 | * |
||||
| 74 | * @return ( |
||||
|
0 ignored issues
–
show
|
|||||
| 75 | * \SimpleSAML\XMLSchema\Type\Interface\ValueTypeInterface| |
||||
| 76 | * \SimpleSAML\XML\AbstractElement| |
||||
| 77 | * null |
||||
| 78 | * ) |
||||
| 79 | */ |
||||
| 80 | public function getValue(): ValueTypeInterface|AbstractElement|null |
||||
| 81 | { |
||||
| 82 | return $this->value; |
||||
| 83 | } |
||||
| 84 | |||||
| 85 | |||||
| 86 | /** |
||||
| 87 | * Convert XML into a AttributeValue |
||||
| 88 | * |
||||
| 89 | * @throws \SimpleSAML\XMLSchema\Exception\InvalidDOMElementException |
||||
| 90 | * if the qualified name of the supplied element is wrong |
||||
| 91 | */ |
||||
| 92 | public static function fromXML(DOMElement $xml): static |
||||
| 93 | { |
||||
| 94 | Assert::same($xml->localName, static::getLocalName(), InvalidDOMElementException::class); |
||||
| 95 | Assert::same($xml->namespaceURI, AttributeValue::NS, InvalidDOMElementException::class); |
||||
| 96 | |||||
| 97 | if ($xml->childElementCount > 0) { |
||||
| 98 | $node = $xml->firstElementChild; |
||||
| 99 | |||||
| 100 | $registry = ElementRegistry::getInstance(); |
||||
| 101 | $handler = $registry->getElementHandler($node->namespaceURI, $node->localName); |
||||
| 102 | |||||
| 103 | $value = $handler ? $handler::fromXML($node) : Chunk::fromXML($node); |
||||
|
0 ignored issues
–
show
It seems like
$node can also be of type null; however, parameter $xml of SimpleSAML\XML\Chunk::fromXML() does only seem to accept DOMElement, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 104 | } elseif ($xml->hasAttributeNS(C_XSI::NS_XSI, 'nil')) { |
||||
| 105 | Assert::oneOf($xml->getAttributeNS(C_XSI::NS_XSI, 'nil'), ['1', 'true']); |
||||
| 106 | Assert::isEmpty($xml->nodeValue); |
||||
| 107 | Assert::isEmpty($xml->textContent); |
||||
| 108 | |||||
| 109 | $value = null; |
||||
| 110 | } elseif ($xml->hasAttributeNS(C_XSI::NS_XSI, 'type')) { |
||||
| 111 | $type = $xml->getAttributeNS(C_XSI::NS_XSI, 'type'); |
||||
| 112 | |||||
| 113 | switch ($type) { |
||||
| 114 | case 'xs:dateTime': |
||||
| 115 | $value = DateTimeValue::fromString($xml->textContent); |
||||
| 116 | break; |
||||
| 117 | case 'xs:integer': |
||||
| 118 | $value = IntegerValue::fromString($xml->textContent); |
||||
| 119 | break; |
||||
| 120 | case 'xs:string': |
||||
| 121 | $value = StringValue::fromString($xml->textContent); |
||||
| 122 | break; |
||||
| 123 | default: |
||||
| 124 | throw new RuntimeException(sprintf("Cannot process xsi:type '%s'", $type)); |
||||
| 125 | } |
||||
| 126 | } else { |
||||
| 127 | $value = StringValue::fromString($xml->textContent); |
||||
| 128 | } |
||||
| 129 | |||||
| 130 | return new static($value); |
||||
| 131 | } |
||||
| 132 | |||||
| 133 | |||||
| 134 | /** |
||||
| 135 | * Append this attribute value to an element. |
||||
| 136 | */ |
||||
| 137 | public function toXML(?DOMElement $parent = null): DOMElement |
||||
| 138 | { |
||||
| 139 | $e = parent::instantiateParentElement($parent); |
||||
| 140 | |||||
| 141 | $value = $this->getValue(); |
||||
| 142 | if ($value === null) { |
||||
| 143 | $e->setAttributeNS('http://www.w3.org/2000/xmlns/', 'xmlns:xsi', C_XSI::NS_XSI); |
||||
| 144 | $e->setAttributeNS(C_XSI::NS_XSI, 'xsi:nil', '1'); |
||||
| 145 | } elseif ($value instanceof AbstractElement) { |
||||
| 146 | $value->toXML($e); |
||||
| 147 | } elseif ($value instanceof StringValue) { |
||||
| 148 | $e->textContent = strval($value); |
||||
| 149 | } else { |
||||
| 150 | $e->setAttributeNS('http://www.w3.org/2000/xmlns/', 'xmlns:xs', C_XSI::NS_XS); |
||||
| 151 | $e->setAttributeNS('http://www.w3.org/2000/xmlns/', 'xmlns:xsi', C_XSI::NS_XSI); |
||||
| 152 | $e->setAttributeNS(C_XSI::NS_XSI, 'xsi:type', $value->getType()); |
||||
| 153 | $e->textContent = strval($value); |
||||
| 154 | } |
||||
| 155 | |||||
| 156 | return $e; |
||||
| 157 | } |
||||
| 158 | } |
||||
| 159 |
The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g.
excluded_paths: ["lib/*"], you can move it to the dependency path list as follows:For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths