Pronamic\WordPress\Pay\Gateways\Ingenico\Security

Complexity

Total Complexity

15

Size/Duplication

Total Lines	116
Duplicated Lines	0 %

Test Coverage

Coverage

63.64%

Importance

Changes

0

6 Methods

Rating	Name	Duplication	Size	Complexity
A	get_request_data()	0	19	4
A	sign_data()	0	8	1
A	get_calculations_parameters_out()	0	11	3
A	get_calculations_parameters_in()	0	11	3
A	get_calculation_fields()	0	4	1
A	get_signature()	0	27	3

<?php

namespace Pronamic\WordPress\Pay\Gateways\Ingenico;

/**
 * Title: Ingenico security class
 * Description:
 * Copyright: Copyright (c) 2005 - 2016
 * Company: Pronamic
 *
 * @author  Remco Tolsma
 * @version 2.0.0
 */
class Security {
	/**
	 * The Ogone calculations parameters in
	 *
	 * @var array
	 */
	private static $calculations_parameters_in;

	/**
	 * The Ogone calucations parameters out
	 *
	 * @var array
	 */
	private static $calculations_parameters_out;

	/**
	 * Get calculations parameters in
	 */
	public static function get_calculations_parameters_in() {
		if ( ! isset( self::$calculations_parameters_in ) ) {
			self::$calculations_parameters_in = array();

			$file = dirname( __FILE__ ) . '/../data/calculations-parameters-sha-in.txt';
			if ( is_readable( $file ) ) {
				self::$calculations_parameters_in = file( $file, FILE_IGNORE_NEW_LINES );

It seems like file($file, Pronamic\WordPress\Pay\Gateways\Ingenico\FILE_IGNORE_NEW_LINES) can also be of type false. However, the property $calculations_parameters_in is declared as type array. Maybe add an additional type check?

			}
		}

		return self::$calculations_parameters_in;
	}

	/**
	 * Get calculations parameters in
	 */
	public static function get_calculations_parameters_out() {
		if ( ! isset( self::$calculations_parameters_out ) ) {
			self::$calculations_parameters_out = array();

			$file = dirname( __FILE__ ) . '/../data/calculations-parameters-sha-out.txt';
			if ( is_readable( $file ) ) {
				self::$calculations_parameters_out = file( $file, FILE_IGNORE_NEW_LINES );

It seems like file($file, Pronamic\WordPress\Pay\Gateways\Ingenico\FILE_IGNORE_NEW_LINES) can also be of type false. However, the property $calculations_parameters_out is declared as type array. Maybe add an additional type check?

			}
		}

		return self::$calculations_parameters_out;
	}

	/**
	 * Get request data
	 *
	 * @return array
	 */
	public static function get_request_data() {
		$data = array();

		if ( isset( $_SERVER['REQUEST_METHOD'] ) ) { // WPCS: input var okay
			switch ( $_SERVER['REQUEST_METHOD'] ) { // WPCS: input var okay
				case 'GET':
					// @todo see how we can improve security around this
					$data = $_GET; // WPCS: input var okay

					break;
				case 'POST':
					// @todo see how we can improve security around this
					$data = $_POST; // WPCS: input var okay // WPCS: CSRF OK

					break;
			}
		}

		return $data;
	}

	public static function get_calculation_fields( $calculation_fields, $fields ) {
		$calculation_fields = array_flip( $calculation_fields );

		return array_intersect_key( $fields, $calculation_fields );
	}

	public static function get_signature( $fields, $passphrase, $hash_algorithm ) {
		// This string is constructed by concatenating the values of the fields sent with the order (sorted
		// alphabetically, in the format ‘parameter=value’), separated by a passphrase.
		$string = '';

		// All parameters need to be put alphabetically
		ksort( $fields );

		// Loop
		foreach ( $fields as $name => $value ) {
			$value = (string) $value;

			// Use of empty will fail, value can be string '0'
			if ( strlen( $value ) > 0 ) {
				$name = strtoupper( $name );

				$string .= $name . '=' . $value . $passphrase;
			}
		}

		// Hash
		$result = hash( $hash_algorithm, $string );

		// String to uppercase
		$result = strtoupper( $result );

		return $result;
	}

	public static function sign_data( Data $data, $pass_phrase, $hash_algorithm ) {
		$calculation_fields = Security::get_calculations_parameters_in();

		$fields = Security::get_calculation_fields( $calculation_fields, $data->get_fields() );

		$signature = Security::get_signature( $fields, $pass_phrase, $hash_algorithm );

		$data->set_field( 'SHASign', $signature );
	}
}