Skip to content

Commit 15db903

Browse files
happydudehappydude
committed
code sniffer fixes
1 parent abc3701 commit 15db903

9 files changed

Lines changed: 102 additions & 39 deletions

File tree

‎bin/updateMetadata.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
declare(strict_types=1);
55

66
if (!isset($argv[1])) {
7+
// phpcs:ignore Generic.Files.LineLength.TooLong
78
echo "First and only argument is the filename of the FIDO Alliance Metadata v3 blob as can be downloaded from: https://mds3.fidoalliance.org/ \n";
89
exit(1);
910
}

‎src/Auth/Process/WebAuthn.php‎

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
* @author Stefan Winter <stefan.winter@restena.lu>
1010
* @package SimpleSAMLphp
1111
*/
12+
1213
declare(strict_types=1);
1314

1415
namespace SimpleSAML\Module\webauthn\Auth\Process;
@@ -17,12 +18,12 @@
1718
use SimpleSAML\Configuration;
1819
use SimpleSAML\Logger;
1920
use SimpleSAML\Module;
20-
use SimpleSAML\Session;
2121
use SimpleSAML\Module\webauthn\WebAuthn\StateData;
2222
use SimpleSAML\Module\webauthn\WebAuthn\StaticProcessHelper;
23+
use SimpleSAML\Session;
2324

24-
class WebAuthn extends Auth\ProcessingFilter {
25-
25+
class WebAuthn extends Auth\ProcessingFilter
26+
{
2627
/**
2728
* @var boolean should new users be considered as enabled by default?
2829
*/
@@ -74,7 +75,8 @@ class WebAuthn extends Auth\ProcessingFilter {
7475
*
7576
* @throws \SimpleSAML\Error\Exception if the configuration is not valid.
7677
*/
77-
public function __construct(array $config, $reserved) {
78+
public function __construct(array $config, $reserved)
79+
{
7880
parent::__construct($config, $reserved);
7981

8082
$moduleConfig = Configuration::getOptionalConfig('module_webauthn.php')->toArray();
@@ -107,7 +109,8 @@ public function __construct(array $config, $reserved) {
107109
*
108110
* @return void
109111
*/
110-
public function process(array &$state): void {
112+
public function process(array &$state): void
113+
{
111114
if (!array_key_exists($this->stateData->usernameAttrib, $state['Attributes'])) {
112115
Logger::warning('webauthn: cannot determine if user needs second factor, missing attribute "' .
113116
$this->stateData->usernameAttrib . '".');
@@ -118,15 +121,16 @@ public function process(array &$state): void {
118121
'urn:rsa:names:tc:SAML:2.0:ac:classes:FIDO';
119122
Logger::debug('webauthn: userid: ' . $state['Attributes'][$this->stateData->usernameAttrib][0]);
120123

121-
$localToggle = !empty($state['Attributes'][$this->toggleAttrib]) && !empty($state['Attributes'][$this->toggleAttrib][0]);
124+
$localToggle = !empty($state['Attributes'][$this->toggleAttrib]) &&
125+
!empty($state['Attributes'][$this->toggleAttrib][0]);
122126

123127
if (
124128
$this->stateData->store->is2FAEnabled(
125-
$state['Attributes'][$this->stateData->usernameAttrib][0],
126-
$this->defaultEnabled,
127-
$this->useDatabase,
128-
$localToggle,
129-
$this->force,
129+
$state['Attributes'][$this->stateData->usernameAttrib][0],
130+
$this->defaultEnabled,
131+
$this->useDatabase,
132+
$localToggle,
133+
$this->force,
130134
) === false
131135
) {
132136
// nothing to be done here, end authprocfilter processing
@@ -136,6 +140,7 @@ public function process(array &$state): void {
136140
if // did we do Passwordless mode successfully before?
137141
(
138142
isset($state['Attributes']['internal:FIDO2PasswordlessAuthentication']) &&
143+
// phpcs:ignore Generic.Files.LineLength.TooLong
139144
$state['Attributes']['internal:FIDO2PasswordlessAuthentication'][0] == $state['Attributes'][$this->stateData->usernameAttrib][0]
140145
) {
141146
// then no need to trigger a second 2-Factor via authproc
@@ -146,17 +151,16 @@ public function process(array &$state): void {
146151
$session = Session::getSessionFromRequest();
147152
$lastSecondFactor = $session->getData("DateTime", 'LastSuccessfulSecondFactor');
148153
if // do we need to do secondFactor in interval, or even every time?
149-
// we skip only if an interval is configured AND we did successfully authenticate, AND are within the interval
154+
// we skip only if an interval is configured AND we did successfully authenticate,
155+
// AND are within the interval
150156
(
151-
$this->SecondFactorMaxAge >= 0 && //
152-
(
153-
$lastSecondFactor instanceof \DateTime
154-
)
157+
$this->SecondFactorMaxAge >= 0 && $lastSecondFactor instanceof \DateTime
155158
) {
156-
$interval = $lastSecondFactor->diff( new \DateTime());
159+
$interval = $lastSecondFactor->diff(new \DateTime());
157160
if ($interval->invert == 1) {
158161
throw new \Exception("We are talking to a future self. Amazing.");
159162
}
163+
// phpcs:ignore Generic.Files.LineLength.TooLong
160164
$totalAge = $interval->s + 60 * $interval->i + 3600 * $interval->h + 86400 * $interval->d + 86400 * 30 * $interval->m + 86400 * 365 * $interval->y;
161165
if ($totalAge < $this->SecondFactorMaxAge) { // we are within the interval indeed, skip calling the AuthProc
162166
return;

‎src/Controller/AuthProcess.php‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,7 @@ public function main(Request $request): Response
137137

138138
if ($publicKey === false || sizeof($oneToken) === 0) {
139139
throw new Exception(
140+
// phpcs:ignore Generic.Files.LineLength.TooLong
140141
"User attempted to authenticate with an unknown credential ID. This should already have been prevented by the browser!",
141142
);
142143
}
@@ -167,11 +168,15 @@ public function main(Request $request): Response
167168
* the lower security level. (level upgrades are of course OK.)
168169
*/
169170
if ($oneToken[5] > $authObject->getPresenceLevel()) {
171+
// phpcs:ignore Generic.Files.LineLength.TooLong
170172
throw new Exception("Token was initially registered with higher identification guarantees than now authenticated with (was: " . $oneToken[5] . " now " . $authObject->getPresenceLevel() . "!");
171173
}
172174

173175
// no matter what: if we are passwordless it MUST be presence-verified
174-
if ($state['FIDO2PasswordlessAuthMode'] === true && $oneToken[5] !== WebAuthnAbstractEvent::PRESENCE_LEVEL_VERIFIED) {
176+
if (
177+
$state['FIDO2PasswordlessAuthMode'] === true &&
178+
$oneToken[5] !== WebAuthnAbstractEvent::PRESENCE_LEVEL_VERIFIED
179+
) {
175180
throw new Exception("Attempt to authenticate without User Verification in passwordless mode!");
176181
}
177182

@@ -193,6 +198,7 @@ public function main(Request $request): Response
193198
$store->updateSignCount($oneToken[0], $counter);
194199
} else {
195200
throw new Exception(
201+
// phpcs:ignore Generic.Files.LineLength.TooLong
196202
"Signature counter less or equal to a previous authentication! Token cloning likely (old: $previousCounter, new: $counter).",
197203
);
198204
}
@@ -214,7 +220,8 @@ public function main(Request $request): Response
214220
function (WebAuthnAuthenticationEvent $authObject, array $state) {
215221
echo $authObject->getDebugBuffer();
216222
echo $authObject->getValidateBuffer();
217-
echo "Debug mode, not continuing to " . ($state['FIDO2WantsRegister'] ? "credential registration page." : "destination.");
223+
echo "Debug mode, not continuing to " . ($state['FIDO2WantsRegister'] ?
224+
"credential registration page." : "destination.");
218225
},
219226
[$authObject, $state],
220227
);
@@ -228,7 +235,7 @@ function (WebAuthnAuthenticationEvent $authObject, array $state) {
228235
}
229236
}
230237
if ($state['FIDO2PasswordlessAuthMode'] === false) {
231-
// take note of the current timestamp so we know
238+
// take note of the current timestamp so we know
232239
// a) that second-factor was done successfully in the current sesssion
233240
// b) when that event occured, so as to make regular re-auths configurable
234241
$this->session->setData("DateTime", 'LastSuccessfulSecondFactor', new \DateTime());

‎src/Controller/PushbackUserPass.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,10 @@ public function loginOverload(string $username, string $password): array
9898
}
9999
};
100100

101-
$attribs = $overrideSource->loginOverload($request->request->get("username"), $request->request->get("password"));
101+
$attribs = $overrideSource->loginOverload(
102+
$request->request->get("username"),
103+
$request->request->get("password"),
104+
);
102105

103106
// this is the confirmed username, we store it just like the Passwordless
104107
// one would have been

‎src/Controller/RegProcess.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,8 @@ public function main(Request $request): Response
112112
base64_decode($request->request->get('attestation_object')),
113113
$request->request->get('response_id'),
114114
$request->request->get('attestation_client_data_json'),
115-
($request->request->get('passwordless') == "on" ? $state['authenticatorAcceptabilityPasswordless'] : $state['authenticatorAcceptability2FA']),
115+
($request->request->get('passwordless') == "on" ?
116+
$state['authenticatorAcceptabilityPasswordless'] : $state['authenticatorAcceptability2FA']),
116117
$debugEnabled,
117118
);
118119
// at this point, we need to talk to the DB
@@ -160,7 +161,10 @@ public function main(Request $request): Response
160161

161162
// did we get any client extensions?
162163
$isResidentKey = 0;
163-
if (strlen($request->request->get('clientext')) > 0 && count(json_decode($request->request->get('clientext'), true)) > 0) {
164+
if (
165+
strlen($request->request->get('clientext')) > 0 &&
166+
count(json_decode($request->request->get('clientext'), true)) > 0
167+
) {
164168
$extensions = json_decode($request->request->get('clientext'), true);
165169
if ($extensions['credProps']['rk'] === true) {
166170
$isResidentKey = 1;

‎src/Controller/Registration.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,13 +108,15 @@ public function main(/** @scrutinizer ignore-unused */ Request $request): Runnab
108108
$state['Attributes'] = $attrs;
109109

110110
$stateData = new StateData();
111+
// phpcs:disable Generic.Files.LineLength.TooLong
111112
$stateData->requestTokenModel = ($registrationConfig['policy_2fa']['minimum_certification_level'] == WebAuthnRegistrationEvent::CERTIFICATION_NOT_REQUIRED ? false : true);
112113
$stateData->minCertLevel2FA = $registrationConfig['policy_2fa']['minimum_certification_level'];
113114
$stateData->aaguidWhitelist2FA = $registrationConfig['policy_2fa']['aaguid_whitelist'] ?? [];
114115
$stateData->attFmtWhitelist2FA = $registrationConfig['policy_2fa']['attestation_format_whitelist'] ?? [];
115116
$stateData->minCertLevelPasswordless = $registrationConfig['policy_passwordless']['minimum_certification_level'];
116117
$stateData->aaguidWhitelistPasswordless = $registrationConfig['policy_passwordless']['aaguid_whitelist'] ?? [];
117118
$stateData->attFmtWhitelistPasswordless = $registrationConfig['policy_passwordless']['attestation_format_whitelist'] ?? [];
119+
// phpcs:enable Generic.Files.LineLength.TooLong
118120

119121
try {
120122
$stateData->store = Store::parseStoreConfig($moduleConfig->getArray('store'));

‎src/Controller/WebAuthn.php‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,10 @@ public static function workflowStateMachine(array $state)
8282
// OTOH, if we are invoked for passwordless auth, we don't know the
8383
// username nor whether the user has any credentials. The only thing
8484
// we can do is authenticate -> final else
85-
if ($state['FIDO2PasswordlessAuthMode'] != true && (!isset($state['FIDO2Tokens']) || count($state['FIDO2Tokens']) == 0)) {
85+
if (
86+
$state['FIDO2PasswordlessAuthMode'] != true &&
87+
(!isset($state['FIDO2Tokens']) || count($state['FIDO2Tokens']) == 0)
88+
) {
8689
return self::STATE_MGMT;
8790
}
8891
// from here on we do have a credential to work with
@@ -100,7 +103,8 @@ public static function workflowStateMachine(array $state)
100103
} else { // in inflow, allow to check the management box; otherwise,
101104
// only auth
102105
$moduleConfig = Configuration::getOptionalConfig('module_webauthn.php')->toArray();
103-
return $moduleConfig['registration']['use_inflow_registration'] ? self::STATE_AUTH_ALLOWMGMT : self::STATE_AUTH_NOMGMT;
106+
return $moduleConfig['registration']['use_inflow_registration'] ?
107+
self::STATE_AUTH_ALLOWMGMT : self::STATE_AUTH_NOMGMT;
104108
}
105109
}
106110

@@ -124,23 +128,29 @@ public static function loadModuleConfig(array $moduleConfig, StateData &$stateDa
124128
if (array_key_exists('identifyingAttribute', $moduleConfig)) {
125129
$stateData->usernameAttrib = $moduleConfig['identifyingAttribute'];
126130
} else {
127-
throw new Error\CriticalConfigurationError('webauthn: it is required to set identifyingAttribute in config.');
131+
throw new Error\CriticalConfigurationError(
132+
'webauthn: it is required to set identifyingAttribute in config.',
133+
);
128134
}
129135

130136
if (array_key_exists('attrib_displayname', $moduleConfig)) {
131137
$stateData->displaynameAttrib = $moduleConfig['attrib_displayname'];
132138
} else {
133-
throw new Error\CriticalConfigurationError('webauthn: it is required to set attrib_displayname in config.');
139+
throw new Error\CriticalConfigurationError(
140+
'webauthn: it is required to set attrib_displayname in config.',
141+
);
134142
}
135143

136144
if (array_key_exists('minimum_certification_level', $moduleConfig['registration']['policy_2fa'])) {
145+
// phpcs:disable Generic.Files.LineLength.TooLong
137146
$stateData->requestTokenModel = ($moduleConfig['registration']['policy_2fa']['minimum_certification_level'] == Module\webauthn\WebAuthn\WebAuthnRegistrationEvent::CERTIFICATION_NOT_REQUIRED ? false : true);
138147
$stateData->minCertLevel2FA = $moduleConfig['registration']['policy_2fa']['minimum_certification_level'];
139148
$stateData->aaguidWhitelist2FA = $moduleConfig['registration']['policy_2fa']['aaguid_whitelist'] ?? [];
140149
$stateData->attFmtWhitelist2FA = $moduleConfig['registration']['policy_2fa']['attestation_format_whitelist'] ?? [];
141150
$stateData->minCertLevelPasswordless = $moduleConfig['registration']['policy_passwordless']['minimum_certification_level'];
142151
$stateData->aaguidWhitelistPasswordless = $moduleConfig['registration']['policy_passwordless']['aaguid_whitelist'] ?? [];
143152
$stateData->attFmtWhitelistPasswordless = $moduleConfig['registration']['policy_passwordless']['attestation_format_whitelist'] ?? [];
153+
// phpcs:enable Generic.Files.LineLength.TooLong
144154
} else {
145155
$stateData->requestTokenModel = false;
146156
}
@@ -223,7 +233,8 @@ public function main(Request $request): Template
223233

224234
$t->data['authForm'] = "";
225235
if (
226-
$this->workflowStateMachine($state) == self::STATE_AUTH_ALLOWMGMT || $this->workflowStateMachine($state) == self::STATE_AUTH_NOMGMT
236+
$this->workflowStateMachine($state) == self::STATE_AUTH_ALLOWMGMT ||
237+
$this->workflowStateMachine($state) == self::STATE_AUTH_NOMGMT
227238
) {
228239
$t->data['authURL'] = Module::getModuleURL('webauthn/authprocess?StateId=' . urlencode($stateId));
229240
$t->data['delURL'] = Module::getModuleURL('webauthn/managetoken?StateId=' . urlencode($stateId));

‎src/WebAuthn/Store/Database.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ public function __construct(array $config)
5959
$this->config = $config;
6060
$this->db = SSP_Database::getInstance(Configuration::loadFromArray($config));
6161
$driver = $this->db->getDriver();
62+
// phpcs:disable Generic.Files.LineLength.TooLong
6263
try {
6364
$this->db->read("SELECT COUNT(*) FROM credentials");
6465
} catch (\Exception $e) {
@@ -95,6 +96,7 @@ public function __construct(array $config)
9596
CONSTRAINT userstatus_user_id_key UNIQUE (user_id)
9697
)");
9798
}
99+
// phpcs:enable Generic.Files.LineLength.TooLong
98100
}
99101

100102
/**
@@ -226,6 +228,7 @@ public function storeTokenData(
226228
string $aaguid,
227229
string $attLevel,
228230
): bool {
231+
// phpcs:disable Generic.Files.LineLength.TooLong
229232
$this->db->write(
230233
'INSERT INTO credentials ' .
231234
'(user_id, credentialId, credential, algo, presenceLevel, isResidentKey, signCounter, friendlyName, hashedId, aaguid, attLevel) VALUES ' .
@@ -244,6 +247,7 @@ public function storeTokenData(
244247
'attLevel' => $attLevel,
245248
],
246249
);
250+
// phpcs:enable Generic.Files.LineLength.TooLong
247251

248252
return true;
249253
}
@@ -299,6 +303,7 @@ public function getTokenData(string $userId): array
299303
$ret = [];
300304

301305
$st = $this->db->read(
306+
// phpcs:ignore Generic.Files.LineLength.TooLong
302307
'SELECT credentialId, credential, signCounter, friendlyName, algo, presenceLevel, isResidentKey FROM credentials WHERE user_id = :userId',
303308
['userId' => $userId],
304309
);

0 commit comments

Comments
 (0)