This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace LightSaml\Tests\Tests; |
||
4 | |||
5 | use LightSaml\Helper; |
||
6 | use LightSaml\SamlConstants; |
||
7 | use LightSaml\Tests\BaseTestCase; |
||
8 | |||
9 | class HelperTest extends BaseTestCase |
||
10 | { |
||
11 | protected $timestamps = array( |
||
12 | array(1412399250, '2014-10-04T05:07:30Z'), |
||
13 | array(1412368132, '2014-10-03T20:28:52Z'), |
||
14 | array(1412331547, '2014-10-03T10:19:07Z'), |
||
15 | ); |
||
16 | |||
17 | /** |
||
18 | * @return array |
||
19 | */ |
||
20 | public function timestamp2StringProvider() |
||
21 | { |
||
22 | return $this->timestamps; |
||
23 | } |
||
24 | |||
25 | /** |
||
26 | * @return array |
||
27 | */ |
||
28 | public function string2TimestampProvider() |
||
29 | { |
||
30 | $timestamps = array_merge( |
||
31 | $this->timestamps, |
||
32 | [ |
||
33 | array(1412399250, '2014-10-04T05:07:30+00:00'), |
||
34 | array(1412368132, '2014-10-03T20:28:52+00:00'), |
||
35 | array(1412331547, '2014-10-03T10:19:07+00:00'), |
||
36 | array(1412399250, '2014-10-04T05:07:30.000+00:00'), |
||
37 | array(1412368132, '2014-10-03T20:28:52.000+00:00'), |
||
38 | array(1412331547, '2014-10-03T10:19:07.000+00:00'), |
||
39 | array(1412399250, '2014-10-04T06:07:30+01:00'), |
||
40 | array(1412368132, '2014-10-03T21:28:52+01:00'), |
||
41 | array(1412331547, '2014-10-03T11:19:07+01:00'), |
||
42 | array(1412399250, '2014-10-04T06:07:30.000+01:00'), |
||
43 | array(1412368132, '2014-10-03T21:28:52.000+01:00'), |
||
44 | array(1412331547, '2014-10-03T11:19:07.000+01:00'), |
||
45 | ] |
||
46 | ); |
||
47 | $result = array(); |
||
48 | foreach ($timestamps as $arr) { |
||
49 | $result[] = array($arr[1], $arr[0]); |
||
50 | } |
||
51 | |||
52 | return $result; |
||
53 | } |
||
54 | |||
55 | /** |
||
56 | * @param string $timestamp |
||
57 | * @param string $string |
||
58 | * @dataProvider timestamp2StringProvider |
||
59 | */ |
||
60 | public function test__time_to_string($timestamp, $string) |
||
61 | { |
||
62 | $this->assertEquals($string, Helper::time2string($timestamp)); |
||
63 | } |
||
64 | |||
65 | /** |
||
66 | * @param string $value |
||
67 | * @param int $timestamp |
||
68 | * |
||
69 | * @dataProvider string2TimestampProvider |
||
70 | */ |
||
71 | public function test__get_timestamp_from_value_with_string($value, $timestamp) |
||
72 | { |
||
73 | $this->assertEquals($timestamp, Helper::getTimestampFromValue($value)); |
||
74 | } |
||
75 | |||
76 | /** |
||
77 | * @param string $value |
||
78 | * @param int $timestamp |
||
79 | * |
||
80 | * @dataProvider string2TimestampProvider |
||
81 | */ |
||
82 | public function test__get_timestamp_from_value_with_date_time($value, $timestamp) |
||
0 ignored issues
–
show
|
|||
83 | { |
||
84 | $dt = new \DateTime('@'.$timestamp); |
||
85 | $this->assertEquals($timestamp, Helper::getTimestampFromValue($dt)); |
||
86 | } |
||
87 | |||
88 | /** |
||
89 | * @param string $value |
||
90 | * @param int $timestamp |
||
91 | * |
||
92 | * @dataProvider string2TimestampProvider |
||
93 | */ |
||
94 | public function test__get_timestamp_from_value_with_int($value, $timestamp) |
||
0 ignored issues
–
show
|
|||
95 | { |
||
96 | $this->assertEquals($timestamp, Helper::getTimestampFromValue($timestamp)); |
||
97 | } |
||
98 | |||
99 | public function test__get_timestamp_from_value_with_invalid_value() |
||
100 | { |
||
101 | $this->expectException(\InvalidArgumentException::class); |
||
102 | Helper::getTimestampFromValue(array()); |
||
0 ignored issues
–
show
array() is of type array , but the function expects a integer|string|object<DateTime> .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
103 | } |
||
104 | |||
105 | public function test__generate_random_bytes_length() |
||
106 | { |
||
107 | $random = Helper::generateRandomBytes(10); |
||
108 | $this->assertEquals(10, strlen($random)); |
||
109 | |||
110 | $random = Helper::generateRandomBytes(16); |
||
111 | $this->assertEquals(16, strlen($random)); |
||
112 | |||
113 | $random = Helper::generateRandomBytes(32); |
||
114 | $this->assertEquals(32, strlen($random)); |
||
115 | } |
||
116 | |||
117 | public function test__generate_random_bytes_error_on_invalid_length() |
||
118 | { |
||
119 | $this->expectException(\InvalidArgumentException::class); |
||
120 | Helper::generateRandomBytes(''); |
||
121 | } |
||
122 | |||
123 | public function test__generate_id() |
||
124 | { |
||
125 | $id = Helper::generateID(); |
||
126 | $this->assertStringStartsWith('_', $id); |
||
127 | $this->assertEquals(43, strlen($id)); |
||
128 | |||
129 | $arr = array(); |
||
130 | for ($i = 0; $i<strlen($id); $i++) { |
||
131 | $ch = $id[$i]; |
||
132 | $arr[$ch] = true; |
||
133 | } |
||
134 | $this->assertGreaterThan(8, count($arr)); |
||
135 | } |
||
136 | |||
137 | public function test__validate_id_string_returns_true_for_valid_string() |
||
138 | { |
||
139 | $this->assertTrue(Helper::validateIdString('1234567890123456')); |
||
140 | $this->assertTrue(Helper::validateIdString('12345678901234567890')); |
||
141 | } |
||
142 | |||
143 | public function test__validate_id_string_returns_false_for_non_string() |
||
144 | { |
||
145 | $this->assertFalse(Helper::validateIdString(1234567890123456)); |
||
146 | $this->assertFalse(Helper::validateIdString(array())); |
||
0 ignored issues
–
show
array() is of type array , but the function expects a string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
147 | } |
||
148 | |||
149 | public function test__validate_id_string_returns_false_for_short_string() |
||
150 | { |
||
151 | $this->assertFalse(Helper::validateIdString('')); |
||
152 | $this->assertFalse(Helper::validateIdString('abc')); |
||
153 | $this->assertFalse(Helper::validateIdString('123456789012345')); |
||
154 | } |
||
155 | |||
156 | public function test__validate_required_string_returns_true_for_non_empty_string() |
||
157 | { |
||
158 | $this->assertTrue(Helper::validateRequiredString('1')); |
||
159 | $this->assertTrue(Helper::validateRequiredString('123')); |
||
160 | $this->assertTrue(Helper::validateRequiredString('123456789')); |
||
161 | } |
||
162 | |||
163 | public function test__validate_required_string_returns_false_for_empty_string() |
||
164 | { |
||
165 | $this->assertFalse(Helper::validateRequiredString('')); |
||
166 | } |
||
167 | |||
168 | public function test__validate_required_string_returns_false_for_null() |
||
169 | { |
||
170 | $this->assertFalse(Helper::validateRequiredString(null)); |
||
171 | } |
||
172 | |||
173 | public function test__validate_required_string_returns_false_for_non_string() |
||
174 | { |
||
175 | $this->assertFalse(Helper::validateRequiredString(123)); |
||
176 | $this->assertFalse(Helper::validateRequiredString(array())); |
||
0 ignored issues
–
show
array() is of type array , but the function expects a string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
177 | } |
||
178 | |||
179 | public function test__validate_optional_string_returns_true_for_null() |
||
180 | { |
||
181 | $this->assertTrue(Helper::validateOptionalString(null)); |
||
182 | } |
||
183 | |||
184 | public function test__validate_optional_string_returns_true_for_non_empty_string() |
||
185 | { |
||
186 | $this->assertTrue(Helper::validateOptionalString('1')); |
||
187 | $this->assertTrue(Helper::validateOptionalString('1234')); |
||
188 | } |
||
189 | |||
190 | public function test__validate_optional_string_returns_false_for_empty_string() |
||
191 | { |
||
192 | $this->assertFalse(Helper::validateOptionalString('')); |
||
193 | } |
||
194 | |||
195 | public function test__validate_optional_string_returns_false_for_non_string() |
||
196 | { |
||
197 | $this->assertFalse(Helper::validateOptionalString(123)); |
||
198 | $this->assertFalse(Helper::validateOptionalString(array())); |
||
0 ignored issues
–
show
array() is of type array , but the function expects a string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
199 | } |
||
200 | |||
201 | public function test__validate_well_formed_uri_string_returns_false_for_empty_string() |
||
202 | { |
||
203 | $this->assertFalse(Helper::validateWellFormedUriString('')); |
||
204 | } |
||
205 | |||
206 | public function test__validate_well_formed_uri_string_returns_false_for_null() |
||
207 | { |
||
208 | $this->assertFalse(Helper::validateWellFormedUriString(null)); |
||
209 | } |
||
210 | |||
211 | public function test__validate_well_formed_uri_string_returns_false_for_too_big_string() |
||
212 | { |
||
213 | $str = str_pad('', 67000, 'x'); |
||
214 | $this->assertFalse(Helper::validateWellFormedUriString($str)); |
||
215 | } |
||
216 | |||
217 | public function test__validate_well_formed_uri_string_returns_false_for_string_with_spaces() |
||
218 | { |
||
219 | $this->assertFalse(Helper::validateWellFormedUriString('123 456 789')); |
||
220 | } |
||
221 | |||
222 | public function test__validate_well_formed_uri_string_returns_false_for_string_without_scheme() |
||
223 | { |
||
224 | $this->assertFalse(Helper::validateWellFormedUriString('example.com')); |
||
225 | $this->assertFalse(Helper::validateWellFormedUriString(':example.com')); |
||
226 | $this->assertFalse(Helper::validateWellFormedUriString('//:example.com')); |
||
227 | } |
||
228 | |||
229 | public function test__validate_well_formed_uri_string_returns_false_for_string_with_invalid_scheme() |
||
230 | { |
||
231 | $this->assertFalse(Helper::validateWellFormedUriString('a=b:example.com')); |
||
232 | $this->assertFalse(Helper::validateWellFormedUriString('a b:example.com')); |
||
233 | $this->assertFalse(Helper::validateWellFormedUriString('a&b:example.com')); |
||
234 | } |
||
235 | |||
236 | public function test__validate_well_formed_uri_string_returns_false_for_valid_string() |
||
237 | { |
||
238 | $this->assertTrue(Helper::validateWellFormedUriString('http://example.com')); |
||
239 | $this->assertTrue(Helper::validateWellFormedUriString(SamlConstants::NS_ASSERTION)); |
||
240 | $this->assertTrue(Helper::validateWellFormedUriString(SamlConstants::PROTOCOL_SAML2)); |
||
241 | $this->assertTrue(Helper::validateWellFormedUriString(SamlConstants::NAME_ID_FORMAT_EMAIL)); |
||
242 | $this->assertTrue(Helper::validateWellFormedUriString(SamlConstants::BINDING_SAML2_HTTP_REDIRECT)); |
||
243 | $this->assertTrue(Helper::validateWellFormedUriString(SamlConstants::STATUS_SUCCESS)); |
||
244 | $this->assertTrue(Helper::validateWellFormedUriString(SamlConstants::AUTHN_CONTEXT_PASSWORD)); |
||
245 | } |
||
246 | |||
247 | View Code Duplication | public function notBeforeProvider() |
|
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
248 | { |
||
249 | return array( |
||
250 | array(1000, 900, 10, false), |
||
251 | array(1000, 1100, 10, true), |
||
252 | ); |
||
253 | } |
||
254 | |||
255 | /** |
||
256 | * @dataProvider notBeforeProvider |
||
257 | */ |
||
258 | public function test__validate_not_before($notBefore, $now, $allowedSecondsSkew, $expected) |
||
259 | { |
||
260 | $this->assertEquals($expected, Helper::validateNotBefore($notBefore, $now, $allowedSecondsSkew)); |
||
261 | } |
||
262 | |||
263 | View Code Duplication | public function notOnOrAfterProvider() |
|
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
264 | { |
||
265 | return array( |
||
266 | array(1000, 900, 10, true), |
||
267 | array(1000, 1100, 10, false), |
||
268 | ); |
||
269 | } |
||
270 | |||
271 | /** |
||
272 | * @dataProvider notOnOrAfterProvider |
||
273 | */ |
||
274 | public function test__validate_not_on_or_after($notOnOrAfter, $now, $allowedSecondsSkew, $expected) |
||
275 | { |
||
276 | $this->assertEquals($expected, Helper::validateNotOnOrAfter($notOnOrAfter, $now, $allowedSecondsSkew)); |
||
277 | } |
||
278 | } |
||
279 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.