SimpleSAML\Module\ldap\Auth\Process\AttributeAddFromLDAP::process()

Complexity

Conditions	19
Paths	109

Size

Total Lines	94
Code Lines	58

Duplication

Lines	0
Ratio	0 %

Importance

Changes	3
Bugs	0	Features	0

<?php
    public function process(array &$request): void
    {
        Assert::keyExists($request, 'Attributes');

        $attributes = &$request['Attributes'];
        
        // skip if any of if_missing_attributes is set
        foreach($this->if_missing_attributes as $attribute) {
            if (isset($attributes[$attribute])) {
                \SimpleSAML\Logger::debug(
                    'AttributeAddFromLDAP: '
                    . 'skipping because ' . $attribute . ' is present'
                );
                return;
            }
        }

        // perform a merge on the ldap_search_filter
        // loop over the attributes and build the search and replace arrays
        $arrSearch = [];
        $arrReplace = [];
        foreach ($attributes as $attr => $val) {
            $arrSearch[] = '%' . $attr . '%';

            if (strlen($val[0]) > 0) {
                $arrReplace[] = Ldap::escapeFilterValue($val[0]);
            } else {
                $arrReplace[] = '';
            }
        }

        // merge the attributes into the ldap_search_filter
        $filter = str_replace($arrSearch, $arrReplace, $this->search_filter);

It seems like $arrReplace can also be of type array<mixed,array|string>; however, parameter $replace of str_replace() does only seem to accept string|string[], maybe add an additional type check?

        if (strpos($filter, '%') !== false) {
            Logger::info(
                'AttributeAddFromLDAP: There are non-existing attributes in the search filter. (' .
                $this->search_filter . ')'
            );
            return;
        }

        if (!in_array($this->attr_policy, ['merge', 'replace', 'add'], true)) {
            Logger::warning("AttributeAddFromLDAP: 'attribute.policy' must be one of 'merge'," .
                "'replace' or 'add'.");
            return;
        }

        // getLdap
        try {
            $ldap = $this->getLdap();
        } catch (\Exception $e) {
            // Added this warning in case $this->getLdap() fails
            Logger::warning("AttributeAddFromLDAP: exception = " . $e);
            return;
        }
        // search for matching entries
        try {
            $entries = $ldap->searchformultiple(
                $this->base_dn,
                $filter,
                array_values($this->search_attributes),
                true,
                false
            );
        } catch (\Exception $e) {
            return; // silent fail, error is still logged by LDAP search
        }

        // handle [multiple] values
        foreach ($entries as $entry) {
            foreach ($this->search_attributes as $target => $name) {
                if (is_numeric($target)) {
                    $target = $name;
                }

                if (isset($attributes[$target]) && $this->attr_policy === 'replace') {
                    unset($attributes[$target]);
                }
                $name = strtolower($name);
                if (isset($entry[$name])) {
                    unset($entry[$name]['count']);
                    if (isset($attributes[$target])) {
                        foreach (array_values($entry[$name]) as $value) {
                            if ($this->attr_policy === 'merge') {
                                if (!in_array($value, $attributes[$target], true)) {
                                    $attributes[$target][] = $value;
                                }
                            } else {
                                $attributes[$target][] = $value;
                            }
                        }
                    } else {
                        $attributes[$target] = array_values($entry[$name]);
                    }