From 7a64366d56be50fd36d666f6f525a08042e21ce6 Mon Sep 17 00:00:00 2001 From: Barnaby Walters Date: Tue, 15 Jun 2021 01:03:11 +0200 Subject: [PATCH] Corrected some more type issues --- src/Server.php | 12 ++++++++---- src/functions.php | 12 ++++++------ 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/src/Server.php b/src/Server.php index 40b62f2..f37369d 100644 --- a/src/Server.php +++ b/src/Server.php @@ -108,10 +108,13 @@ class Server { protected LoggerInterface $logger; + /** @var callable */ protected $httpGetWithEffectiveUrl; + /** @var callable */ protected $handleAuthenticationRequestCallback; + /** @var callable */ protected $handleNonIndieAuthRequest; protected string $exceptionTemplatePath; @@ -397,7 +400,7 @@ class Server { return new Response(200, [ 'content-type' => 'application/json', 'cache-control' => 'no-store', - ], json_encode(array_filter($tokenData, function ($k) { + ], json_encode(array_filter($tokenData, function (string $k) { // Prevent codes exchanged at the authorization endpoint from returning any information other than // me and profile. return in_array($k, ['me', 'profile']); @@ -438,7 +441,8 @@ class Server { // How most errors are handled depends on whether or not the request has a valid redirect_uri. In // order to know that, we need to also validate, fetch and parse the client_id. // If the request lacks a hash, or if the provided hash was invalid, perform the validation. - if (!array_key_exists(self::HASH_QUERY_STRING_KEY, $queryParams) || !hash_equals(hashAuthorizationRequestParameters($request, $this->secret), $queryParams[self::HASH_QUERY_STRING_KEY])) { + $currentRequestHash = hashAuthorizationRequestParameters($request, $this->secret); + if (is_null($currentRequestHash) or !hash_equals($currentRequestHash, $queryParams[self::HASH_QUERY_STRING_KEY])) { // All we need to know at this stage is whether the redirect_uri is valid. If it // sufficiently matches the client_id, we don’t (yet) need to fetch the client_id. if (!urlComponentsMatch($queryParams['client_id'], $queryParams['redirect_uri'], [PHP_URL_SCHEME, PHP_URL_HOST, PHP_URL_PORT])) { @@ -557,7 +561,7 @@ class Server { } $expectedHash = hashAuthorizationRequestParameters($request, $this->secret); - if (!hash_equals($expectedHash, $queryParams[self::HASH_QUERY_STRING_KEY])) { + if (is_null($expectedHash) or !hash_equals($expectedHash, $queryParams[self::HASH_QUERY_STRING_KEY])) { $this->logger->warning("The hash provided in the URL was invalid!", [ 'expected' => $expectedHash, 'actual' => $queryParams[self::HASH_QUERY_STRING_KEY] @@ -754,7 +758,7 @@ class Server { ], json_encode(array_merge([ // Ensure that the token_type key is present, if tokenStorage doesn’t include it. 'token_type' => 'Bearer' - ], array_filter($tokenData, function ($k) { + ], array_filter($tokenData, function (string $k) { // We should be able to trust the return data from tokenStorage, but there’s no harm in // preventing code_challenges from leaking, per OAuth2. return !in_array($k, ['code_challenge', 'code_challenge_method']); diff --git a/src/functions.php b/src/functions.php index 0ec294d..79fdb52 100644 --- a/src/functions.php +++ b/src/functions.php @@ -46,7 +46,7 @@ function hashAuthorizationRequestParameters(ServerRequestInterface $request, str $hashedParameters = $hashedParameters ?? ['client_id', 'redirect_uri', 'code_challenge', 'code_challenge_method']; $algo = $algo ?? 'sha256'; - $queryParams = $request->getQueryParams() ?? []; + $queryParams = $request->getQueryParams(); $data = ''; foreach ($hashedParameters as $key) { if (!array_key_exists($key, $queryParams)) { @@ -57,25 +57,25 @@ function hashAuthorizationRequestParameters(ServerRequestInterface $request, str return hash_hmac($algo, $data, $secret); } -function isIndieAuthAuthorizationCodeRedeemingRequest(ServerRequestInterface $request) { +function isIndieAuthAuthorizationCodeRedeemingRequest(ServerRequestInterface $request): bool { return strtolower($request->getMethod()) == 'post' && array_key_exists('grant_type', $request->getParsedBody() ?? []) && $request->getParsedBody()['grant_type'] == 'authorization_code'; } -function isIndieAuthAuthorizationRequest(ServerRequestInterface $request, $permittedMethods=['get']) { +function isIndieAuthAuthorizationRequest(ServerRequestInterface $request, array $permittedMethods=['get']): bool { return in_array(strtolower($request->getMethod()), array_map('strtolower', $permittedMethods)) && array_key_exists('response_type', $request->getQueryParams() ?? []) && $request->getQueryParams()['response_type'] == 'code'; } -function isAuthorizationApprovalRequest(ServerRequestInterface $request) { +function isAuthorizationApprovalRequest(ServerRequestInterface $request): bool { return strtolower($request->getMethod()) == 'post' && array_key_exists('taproot_indieauth_action', $request->getParsedBody() ?? []) && $request->getParsedBody()[Server::APPROVE_ACTION_KEY] == Server::APPROVE_ACTION_VALUE; } -function buildQueryString(array $parameters) { +function buildQueryString(array $parameters): string { $qs = []; foreach ($parameters as $k => $v) { $qs[] = urlencode($k) . '=' . urlencode($v); @@ -83,7 +83,7 @@ function buildQueryString(array $parameters) { return join('&', $qs); } -function urlComponentsMatch($url1, $url2, ?array $components=null): bool { +function urlComponentsMatch(string $url1, string $url2, ?array $components=null): bool { $validComponents = [PHP_URL_HOST, PHP_URL_PASS, PHP_URL_PATH, PHP_URL_PORT, PHP_URL_USER, PHP_URL_QUERY, PHP_URL_SCHEME, PHP_URL_FRAGMENT]; $components = $components ?? $validComponents;