simplesamlphp /
ws-security
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||||
| 2 | |||||||
| 3 | declare(strict_types=1); |
||||||
| 4 | |||||||
| 5 | namespace SimpleSAML\WSSecurity\XML\wsp; |
||||||
| 6 | |||||||
| 7 | use DOMElement; |
||||||
| 8 | use SimpleSAML\WSSecurity\Assert\Assert; |
||||||
| 9 | use SimpleSAML\WSSecurity\Constants as C; |
||||||
| 10 | use SimpleSAML\XML\Attribute as XMLAttribute; |
||||||
| 11 | use SimpleSAML\XML\Chunk; |
||||||
| 12 | use SimpleSAML\XML\Exception\InvalidDOMElementException; |
||||||
| 13 | use SimpleSAML\XML\Exception\SchemaViolationException; |
||||||
| 14 | use SimpleSAML\XML\ExtendableAttributesTrait; |
||||||
| 15 | use SimpleSAML\XML\{SchemaValidatableElementInterface, SchemaValidatableElementTrait}; |
||||||
| 16 | use SimpleSAML\XML\XsNamespace as NS; |
||||||
| 17 | |||||||
| 18 | /** |
||||||
| 19 | * Class defining the Policy element |
||||||
| 20 | * |
||||||
| 21 | * @package simplesamlphp/ws-security |
||||||
| 22 | */ |
||||||
| 23 | final class Policy extends AbstractOperatorContentType implements SchemaValidatableElementInterface |
||||||
| 24 | { |
||||||
| 25 | use ExtendableAttributesTrait; |
||||||
| 26 | use SchemaValidatableElementTrait; |
||||||
|
0 ignored issues
–
show
introduced
by
Loading history...
|
|||||||
| 27 | |||||||
| 28 | /** The namespace-attribute for the xs:anyAttribute element */ |
||||||
| 29 | public const XS_ANY_ATTR_NAMESPACE = NS::ANY; |
||||||
| 30 | |||||||
| 31 | |||||||
| 32 | /** |
||||||
| 33 | * Initialize a wsp:Policy |
||||||
| 34 | * |
||||||
| 35 | * @param string|null $Name |
||||||
| 36 | * @param \SimpleSAML\XML\Attribute|null $Id |
||||||
| 37 | * @param (\SimpleSAML\WSSecurity\XML\wsp\All| |
||||||
| 38 | * \SimpleSAML\WSSecurity\XML\wsp\ExactlyOne| |
||||||
| 39 | * \SimpleSAML\WSSecurity\XML\wsp\Policy| |
||||||
| 40 | * \SimpleSAML\WSSecurity\XML\wsp\PolicyReference)[] $operatorContent |
||||||
| 41 | * @param \SimpleSAML\XML\Chunk[] $children |
||||||
| 42 | * @param \SimpleSAML\XML\Attribute[] $namespacedAttributes |
||||||
| 43 | */ |
||||||
| 44 | public function __construct( |
||||||
| 45 | protected ?string $Name = null, |
||||||
| 46 | protected ?XMLAttribute $Id = null, |
||||||
| 47 | array $operatorContent = [], |
||||||
| 48 | array $children = [], |
||||||
| 49 | array $namespacedAttributes = [], |
||||||
| 50 | ) { |
||||||
| 51 | Assert::nullOrValidURI($Name, SchemaViolationException::class); |
||||||
|
0 ignored issues
–
show
The method
nullOrValidURI() does not exist on SimpleSAML\WSSecurity\Assert\Assert. Since you implemented __callStatic, consider adding a @method annotation.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 52 | if ($Id !== null) { |
||||||
| 53 | Assert::validNCName($Id->getAttrValue(), SchemaViolationException::class); |
||||||
| 54 | } |
||||||
| 55 | |||||||
| 56 | $this->setAttributesNS($namespacedAttributes); |
||||||
| 57 | |||||||
| 58 | parent::__construct($operatorContent, $children); |
||||||
| 59 | } |
||||||
| 60 | |||||||
| 61 | |||||||
| 62 | /** |
||||||
| 63 | * @return \SimpleSAML\XML\Attribute|null |
||||||
| 64 | */ |
||||||
| 65 | public function getId(): ?XMLAttribute |
||||||
| 66 | { |
||||||
| 67 | return $this->Id; |
||||||
| 68 | } |
||||||
| 69 | |||||||
| 70 | |||||||
| 71 | /** |
||||||
| 72 | * @return string|null |
||||||
| 73 | */ |
||||||
| 74 | public function getName(): ?string |
||||||
| 75 | { |
||||||
| 76 | return $this->Name; |
||||||
| 77 | } |
||||||
| 78 | |||||||
| 79 | |||||||
| 80 | /** |
||||||
| 81 | * Test if an object, at the state it's in, would produce an empty XML-element |
||||||
| 82 | * |
||||||
| 83 | * @return bool |
||||||
| 84 | */ |
||||||
| 85 | final public function isEmptyElement(): bool |
||||||
| 86 | { |
||||||
| 87 | return empty($this->getName()) |
||||||
| 88 | && empty($this->getId()) |
||||||
| 89 | && empty($this->getAttributesNS()) |
||||||
| 90 | && parent::isEmptyElement(); |
||||||
| 91 | } |
||||||
| 92 | |||||||
| 93 | |||||||
| 94 | /* |
||||||
| 95 | * Convert XML into an wsp:Policy element |
||||||
| 96 | * |
||||||
| 97 | * @param \DOMElement $xml The XML element we should load |
||||||
| 98 | * @return static |
||||||
| 99 | * |
||||||
| 100 | * @throws \SimpleSAML\XML\Exception\InvalidDOMElementException |
||||||
| 101 | * If the qualified name of the supplied element is wrong |
||||||
| 102 | */ |
||||||
| 103 | #[\Override] |
||||||
| 104 | public static function fromXML(DOMElement $xml): static |
||||||
| 105 | { |
||||||
| 106 | Assert::same($xml->localName, static::getLocalName(), InvalidDOMElementException::class); |
||||||
|
0 ignored issues
–
show
The method
same() does not exist on SimpleSAML\WSSecurity\Assert\Assert. Since you implemented __callStatic, consider adding a @method annotation.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 107 | Assert::same($xml->namespaceURI, static::NS, InvalidDOMElementException::class); |
||||||
| 108 | |||||||
| 109 | $Id = null; |
||||||
| 110 | if ($xml->hasAttributeNS(C::NS_SEC_UTIL, 'Id')) { |
||||||
| 111 | $Id = new XMLAttribute(C::NS_SEC_UTIL, 'wsu', 'Id', $xml->getAttributeNS(C::NS_SEC_UTIL, 'Id')); |
||||||
| 112 | } |
||||||
| 113 | |||||||
| 114 | $namespacedAttributes = self::getAttributesNSFromXML($xml); |
||||||
| 115 | foreach ($namespacedAttributes as $i => $attr) { |
||||||
| 116 | if ($attr->getNamespaceURI() === null) { |
||||||
| 117 | if ($attr->getAttrName() === 'Name') { |
||||||
| 118 | unset($namespacedAttributes[$i]); |
||||||
| 119 | break; |
||||||
| 120 | } |
||||||
| 121 | } elseif ($attr->getNamespaceURI() === C::NS_SEC_UTIL) { |
||||||
| 122 | if ($attr->getAttrName() === 'Id') { |
||||||
| 123 | unset($namespacedAttributes[$i]); |
||||||
| 124 | break; |
||||||
| 125 | } |
||||||
| 126 | } |
||||||
| 127 | } |
||||||
| 128 | |||||||
| 129 | $operatorContent = $children = []; |
||||||
| 130 | for ($n = $xml->firstChild; $n !== null; $n = $n->nextSibling) { |
||||||
| 131 | if (!($n instanceof DOMElement)) { |
||||||
| 132 | continue; |
||||||
| 133 | } elseif ($n->namespaceURI !== self::NS) { |
||||||
| 134 | $children[] = new Chunk($n); |
||||||
| 135 | continue; |
||||||
| 136 | } |
||||||
| 137 | |||||||
| 138 | $operatorContent[] = match ($n->localName) { |
||||||
| 139 | 'All' => All::fromXML($n), |
||||||
| 140 | 'ExactlyOne' => ExactlyOne::fromXML($n), |
||||||
| 141 | 'Policy' => Policy::fromXML($n), |
||||||
| 142 | 'PolicyReference' => PolicyReference::fromXML($n), |
||||||
| 143 | default => null, |
||||||
| 144 | }; |
||||||
| 145 | } |
||||||
| 146 | |||||||
| 147 | return new static( |
||||||
| 148 | self::getOptionalAttribute($xml, 'Name', null), |
||||||
| 149 | $Id, |
||||||
| 150 | $operatorContent, |
||||||
| 151 | $children, |
||||||
| 152 | $namespacedAttributes, |
||||||
| 153 | ); |
||||||
| 154 | } |
||||||
| 155 | |||||||
| 156 | |||||||
| 157 | /** |
||||||
| 158 | * Convert this wsp:Policy to XML. |
||||||
| 159 | * |
||||||
| 160 | * @param \DOMElement|null $parent The element we should add this wsp:Policy to |
||||||
| 161 | * @return \DOMElement This wsp:Policy element. |
||||||
| 162 | */ |
||||||
| 163 | public function toXML(?DOMElement $parent = null): DOMElement |
||||||
| 164 | { |
||||||
| 165 | $e = parent::toXML($parent); |
||||||
| 166 | |||||||
| 167 | if ($this->getName() !== null) { |
||||||
| 168 | $e->setAttribute('Name', $this->getName()); |
||||||
| 169 | } |
||||||
| 170 | |||||||
| 171 | $this->getId()?->toXML($e); |
||||||
| 172 | |||||||
| 173 | foreach ($this->getAttributesNS() as $attr) { |
||||||
| 174 | $attr->toXML($e); |
||||||
| 175 | } |
||||||
| 176 | |||||||
| 177 | return $e; |
||||||
| 178 | } |
||||||
| 179 | } |
||||||
| 180 |