SimpleSAML\XMLSecurity\Signature::addX509Certificates()

Complexity

Conditions	19
Paths	81

Size

Total Lines	88
Code Lines	55

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
     * @param \SimpleSAML\XMLSecurity\Key\X509Certificate[] $certs
     *   An X509Certificate object or an array of them.
     * @param boolean $addSubject Whether to add the subject of the certificate or not.
     * @param string|false $digest A digest algorithm identifier if the digest of the certificate should be added. False
     * otherwise.
     * @param boolean $addIssuerSerial Whether to add the serial number of the issuer or not.
     *
     * @throws \SimpleSAML\XMLSecurity\Exception\InvalidArgumentException If $certs is not a
     *   X509Certificate object or an array of them.
     */
    public function addX509Certificates(
        array $certs,
        bool $addSubject = false,
        $digest = false,
        bool $addIssuerSerial = false
    ): void {
        Assert::allIsInstanceOf($certs, Key\X509Certificate::class);

        $certData = [];

        foreach ($certs as $cert) {
            $details = $cert->getCertificateDetails();

            if ($addSubject && isset($details['subject'])) {
                // add subject
                $subjectNameValue = $details['issuer'];
                if (is_array($details['subject'])) {
                    $parts = [];
                    foreach ($details['subject'] as $key => $value) {
                        if (is_array($value)) {
                            foreach ($value as $valueElement) {
                                array_unshift($parts, $key . '=' . $valueElement);
                            }
                        } else {
                            array_unshift($parts, $key . '=' . $value);
                        }
                    }
                    $subjectNameValue = implode(',', $parts);
                }
                $certData[] = new X509SubjectName($subjectNameValue);
            }

            if ($digest !== false) {
                // add certificate digest
                $fingerprint = base64_encode(hex2bin($cert->getRawThumbprint($digest)));
                $certData[] = new X509Digest($fingerprint, $digest);
            }

            if ($addIssuerSerial && isset($details['issuer']) && isset($details['serialNumber'])) {
                if (is_array($details['issuer'])) {
                    $parts = [];
                    foreach ($details['issuer'] as $key => $value) {
                        array_unshift($parts, $key . '=' . $value);
                    }
                    $issuerName = implode(',', $parts);
                } else {
                    $issuerName = $details['issuer'];
                }

                $certData[] = new X509IssuerSerial($issuerName, $details['serialNumber']);
            }

            $certData[] = new X509Certificate(CertificateUtils::stripHeaders($cert->getCertificate()));
        }

        $keyInfoNode = $this->createElement('KeyInfo');

        $certDataNode = new X509Data($certData);
        $certDataNode->toXML($keyInfoNode);

        if ($this->objectNode === null) {
            $this->sigNode->appendChild($keyInfoNode);
        } else {
            $this->sigNode->insertBefore($keyInfoNode, $this->objectNode);
        }
    }


    /**
     * Append a signature as the last child of the signed element.
     *
     * @return \DOMNode The appended signature.
     */
    public function append(): DOMNode
    {
        return $this->insert();
    }