symphonycms / symphony-2

symphony/lib/toolkit/class.xsrf.php

<?php

if (!defined("__IN_SYMPHONY__")) {

The string literal __IN_SYMPHONY__ does not require double quotes, as per coding-style, please use single quotes.

    die("You cannot directly access this file.");

The string literal You cannot directly access this file. does not require double quotes, as per coding-style, please use single quotes.

}

/**
 * @package toolkit
 */

/**
 * The `XSRF` class provides protection for mitigating XRSF/CSRF attacks.
 *
 * @since Symphony 2.4
 * @author Rich Adams, http://richadams.me
 */
class XSRF
{
    /**
     * Return's the location of the XSRF tokens in the Session
     *
     * @return string|null
     */
    public static function getSessionToken()
    {
        $token = null;

        if (isset($_SESSION[__SYM_COOKIE_PREFIX__]['xsrf-token'])) {

The constant __SYM_COOKIE_PREFIX__ was not found. Maybe you did not declare it correctly or list all dependencies?

            $token = $_SESSION[__SYM_COOKIE_PREFIX__]['xsrf-token'];
        }

        if (is_array($token)) {
            $token = key($token);
        }

        return is_null($token) ? null : $token;
    }

    /**
     * Adds a token to the Session
     *
     * @param array $token
     */
    public static function setSessionToken($token = array())

Incorrect spacing between argument "$token" and equals sign; expected 0 but found 1

Incorrect spacing between default value and equals sign for argument "$token"; expected 0 but found 1

    {
        $_SESSION[__SYM_COOKIE_PREFIX__]['xsrf-token'] = $token;

The constant __SYM_COOKIE_PREFIX__ was not found. Maybe you did not declare it correctly or list all dependencies?

    }

    /**
     * Removes the token from the Session
     *
     * @param string $token
     */
    public static function removeSessionToken($token = null)

Incorrect spacing between argument "$token" and equals sign; expected 0 but found 1

Incorrect spacing between default value and equals sign for argument "$token"; expected 0 but found 1

    {
        if (is_null($token)) {
            return;
        }

        $_SESSION[__SYM_COOKIE_PREFIX__]['xsrf-token'] = null;

The constant __SYM_COOKIE_PREFIX__ was not found. Maybe you did not declare it correctly or list all dependencies?

    }

    /**
     * Generates nonce to a desired `$length` using `openssl` where available,
     * falling back to using `/dev/urandom` and a microtime implementation
     * otherwise
     *
     * @param integer $length optional. By default, 30.
     * @return string
     *  base64 encoded, url safe
     */
    public static function generateNonce($length = 30)

Incorrect spacing between argument "$length" and equals sign; expected 0 but found 1

Incorrect spacing between default value and equals sign for argument "$length"; expected 0 but found 1

    {
        $random = null;
        if ($length < 1) {
            throw new Exception('$length must be greater than 0');
        }

        // Use the new PHP 7 random_bytes call, if available
        if (!$random && function_exists('random_bytes')) {

$random is of type null, thus it always evaluated to false.

            $random = random_bytes($length);
        }

        // Get some random binary data from open ssl, if available
        if (!$random && function_exists('openssl_random_pseudo_bytes')) {
            $random = openssl_random_pseudo_bytes($length);
        }

        // Fallback to /dev/urandom
        if (!$random && is_readable('/dev/urandom')) {
            if (($handle = @fopen('/dev/urandom', 'rb')) !== false) {
                $random = @fread($handle, $length);
                @fclose($handle);

It seems like you do not handle an error condition for fclose(). This can introduce security issues, and is generally not recommended.

            }
        }

        // Fallback if no random bytes were found
        if (!$random) {
            $random = microtime();

            for ($i = 0; $i < 1000; $i += $length) {
                $random = sha1(microtime() . $random);
            }
        }

        // Convert to base64
        $random = base64_encode($random);

        // Replace unsafe chars
        $random = strtr($random, '+/', '-_');
        $random = str_replace('=', '', $random);

        // Truncate the string to specified lengh
        $random = substr($random, 0, $length);

        return $random;
    }

    /**
     * Creates the form input to use to house the token
     *
     * @return XMLElement
     */
    public static function formToken()
    {
        // <input type="hidden" name="xsrf" value=" . self::getToken() . " />
        $obj = new XMLElement("input");

The string literal input does not require double quotes, as per coding-style, please use single quotes.

        $obj->setAttribute("type", "hidden");

The string literal type does not require double quotes, as per coding-style, please use single quotes.

The string literal hidden does not require double quotes, as per coding-style, please use single quotes.

        $obj->setAttribute("name", "xsrf");

The string literal name does not require double quotes, as per coding-style, please use single quotes.

The string literal xsrf does not require double quotes, as per coding-style, please use single quotes.

        $obj->setAttribute("value", self::getToken());

The string literal value does not require double quotes, as per coding-style, please use single quotes.

        return $obj;
    }

    /**
     * This is the nonce used to stop CSRF/XSRF attacks. It's stored in the user session.
     *
     * @return string
     */
    public static function getToken()
    {
        $token = self::getSessionToken();
        if (is_null($token)) {
            $nonce = self::generateNonce();
            self::setSessionToken($nonce);

$nonce of type string is incompatible with the type array expected by parameter $token of XSRF::setSessionToken().

        // Handle old tokens (< 2.6.0)
        } elseif (is_array($token)) {

The condition is_array($token) is always false.

            $nonce = key($token);
            self::setSessionToken($nonce);

        // New style tokens
        } else {
            $nonce = $token;
        }

        return $nonce;
    }

    /**
     * This will determine if a token is valid.
     *
     * @param string $xsrf
     *  The token to validate
     * @return boolean
     */
    public static function validateToken($xsrf)
    {
        $token = self::getSessionToken();

        return $token === $xsrf;
    }

    /**
     * This will validate a request has a good token.
     *
     * @throws SymphonyErrorPage
     * @param boolean $silent
     *  If true, this function will return false if the request fails,
     *  otherwise it will throw an Exception. By default this function
     *  will thrown an exception if the request is invalid.
     * @return false|void
     */
    public static function validateRequest($silent = false)

Incorrect spacing between argument "$silent" and equals sign; expected 0 but found 1

Incorrect spacing between default value and equals sign for argument "$silent"; expected 0 but found 1

    {
        // Only care if we have a POST request.
        if (count($_POST) > 0) {
            if (!self::validateToken($_POST["xsrf"])) {

The string literal xsrf does not require double quotes, as per coding-style, please use single quotes.

                // Token was invalid, show an error page.
                if (!$silent) {
                    self::throwXSRFException();
                } else {
                    return false;
                }
            }
        }
    }

    /**
     * The error function that's thrown if the token is invalid.
     *
     * @throws SymphonyErrorPage
     */
    public static function throwXSRFException()
    {
        $msg =
            __('Request was rejected for having an invalid cross-site request forgery token.')
            . '<br/><br/>' .
            __('Please go back and try again.');
        throw new SymphonyErrorPage($msg, __('Access Denied'), 'generic', array(), Page::HTTP_STATUS_FORBIDDEN);
    }

    /**
     * Return's the location of the XSRF tokens in the Session
     *
     * @deprecated This function will be removed in Symphony 3.0. Use
     *  `getSessionToken()` instead.
     * @return string|null
     */
    public static function getSession()
    {
        if (Symphony::Log()) {
            Symphony::Log()->pushDeprecateWarningToLog('XSRF::getSession()', 'XSRF::getSessionToken()');
        }

No blank line found after control structure

        return self::getSessionToken();
    }
}