WebStream\Annotation\Attributes\CsrfProtection

Complexity

Total Complexity

8

Size/Duplication

Total Lines	55
Duplicated Lines	0 %

Importance

Changes

0

2 Methods

Rating	Name	Duplication	Size	Complexity
A	onInject()	0	2	1
C	onMethodInject()	0	25	7

<?php
namespace WebStream\Annotation\Attributes;

use WebStream\Annotation\Base\Annotation;
use WebStream\Annotation\Base\IAnnotatable;
use WebStream\Annotation\Base\IMethod;
use WebStream\Container\Container;
use WebStream\Exception\Extend\CsrfException;

/**
 * CsrfProtection
 * @author Ryuichi TANAKA.
 * @since 2015/05/08
 * @version 0.7
 *
 * @Annotation
 * @Target("METHOD")
 */
class CsrfProtection extends Annotation implements IMethod
{
    /**
     * @var array<string> 注入アノテーション情報
     */
    private $injectAnnotation;

The property $injectAnnotation is not used and could be removed.

    /**
     * @var array<string> 読み込みアノテーション情報
     */
    private $readAnnotation;

The property $readAnnotation is not used and could be removed.

    /**
     * @var array<string, string> CSRF定数定義
     */
    private $csrfProtectionDefinitions = [
        'tokenKey' => '__CSRF_TOKEN__',
        'tokenHeader' => 'X-CSRF-Token'
    ];

    /**
     * {@inheritdoc}
     */
    public function onInject(array $injectAnnotation)
    {
    }

    /**
     * {@inheritdoc}
     */
    public function onMethodInject(IAnnotatable $instance, \ReflectionMethod $method, Container $container)
    {
        $tokenByRequest = null;
        if (array_key_exists($this->csrfProtectionDefinitions['tokenKey'], $container->post)) {

The property post does not exist on WebStream\Container\Container. Since you implemented __get, consider adding a @property annotation.

It seems like $container->post can also be of type null and string; however, parameter $search of array_key_exists() does only seem to accept array, maybe add an additional type check?

            $tokenByRequest = $container->post[$this->csrfProtectionDefinitions['tokenKey']];
        } elseif (array_key_exists($this->csrfProtectionDefinitions['tokenHeader'], $container->header)) {

The property header does not exist on WebStream\Container\Container. Since you implemented __get, consider adding a @property annotation.

            $tokenByRequest = $container->header[$this->csrfProtectionDefinitions['tokenHeader']];
        }

        $tokenInSession = $container->session->get($this->csrfProtectionDefinitions['tokenKey']);

The property session does not exist on WebStream\Container\Container. Since you implemented __get, consider adding a @property annotation.

The method get() does not exist on null.

        $container->session->delete($this->csrfProtectionDefinitions['tokenKey']);

        // POSTリクエスト以外はチェックしない
        if ($container->requestMethod !== 'POST') {

The property requestMethod does not exist on WebStream\Container\Container. Since you implemented __get, consider adding a @property annotation.

            return;
        }

        // リクエストトークン、セッショントークンが両方空はNG
        if ($tokenInSession === null && $tokenByRequest === null) {
            throw new CsrfException("Sent invalid CSRF token");
        }

        // リクエストトークンとセッショントークンが一致しない場合NG
        if ($tokenInSession !== $tokenByRequest) {
            throw new CsrfException("Sent invalid CSRF token");
        }
    }
}