librenms/librenms

View on GitHub
LibreNMS/Authentication/SSOAuthorizer.php

Summary

Maintainability
C
1 day
Test Coverage

authSSOGetAttr accesses the super-global variable $_SERVER.
Open

    public function authSSOGetAttr($attr, $prefix = 'HTTP_')
    {
        // Check attribute originates from a trusted proxy - we check it on every attribute just in case this gets called after initial login
        if ($this->authSSOProxyTrusted()) {
            // Short circuit everything if the attribute is non-existant or null

Superglobals

Since: 0.2

Accessing a super-global variable directly is considered a bad practice. These variables should be encapsulated in objects that are provided by a framework, for instance.

Example

class Foo {
    public function bar() {
        $name = $_POST['foo'];
    }
}

Source

authSSOGetAttr accesses the super-global variable $_SERVER.
Open

    public function authSSOGetAttr($attr, $prefix = 'HTTP_')
    {
        // Check attribute originates from a trusted proxy - we check it on every attribute just in case this gets called after initial login
        if ($this->authSSOProxyTrusted()) {
            // Short circuit everything if the attribute is non-existant or null

Superglobals

Since: 0.2

Accessing a super-global variable directly is considered a bad practice. These variables should be encapsulated in objects that are provided by a framework, for instance.

Example

class Foo {
    public function bar() {
        $name = $_POST['foo'];
    }
}

Source

authSSOGetAttr accesses the super-global variable $_SERVER.
Open

    public function authSSOGetAttr($attr, $prefix = 'HTTP_')
    {
        // Check attribute originates from a trusted proxy - we check it on every attribute just in case this gets called after initial login
        if ($this->authSSOProxyTrusted()) {
            // Short circuit everything if the attribute is non-existant or null

Superglobals

Since: 0.2

Accessing a super-global variable directly is considered a bad practice. These variables should be encapsulated in objects that are provided by a framework, for instance.

Example

class Foo {
    public function bar() {
        $name = $_POST['foo'];
    }
}

Source

authSSOGetAttr accesses the super-global variable $_SERVER.
Open

    public function authSSOGetAttr($attr, $prefix = 'HTTP_')
    {
        // Check attribute originates from a trusted proxy - we check it on every attribute just in case this gets called after initial login
        if ($this->authSSOProxyTrusted()) {
            // Short circuit everything if the attribute is non-existant or null

Superglobals

Since: 0.2

Accessing a super-global variable directly is considered a bad practice. These variables should be encapsulated in objects that are provided by a framework, for instance.

Example

class Foo {
    public function bar() {
        $name = $_POST['foo'];
    }
}

Source

authSSOGetAttr accesses the super-global variable $_SERVER.
Open

    public function authSSOGetAttr($attr, $prefix = 'HTTP_')
    {
        // Check attribute originates from a trusted proxy - we check it on every attribute just in case this gets called after initial login
        if ($this->authSSOProxyTrusted()) {
            // Short circuit everything if the attribute is non-existant or null

Superglobals

Since: 0.2

Accessing a super-global variable directly is considered a bad practice. These variables should be encapsulated in objects that are provided by a framework, for instance.

Example

class Foo {
    public function bar() {
        $name = $_POST['foo'];
    }
}

Source

authSSOProxyTrusted accesses the super-global variable $_SERVER.
Open

    public function authSSOProxyTrusted()
    {
        // We assume IP is used - if anyone is using a non-ip transport, support will need to be added
        if (Config::get('sso.trusted_proxies')) {
            try {

Superglobals

Since: 0.2

Accessing a super-global variable directly is considered a bad practice. These variables should be encapsulated in objects that are provided by a framework, for instance.

Example

class Foo {
    public function bar() {
        $name = $_POST['foo'];
    }
}

Source

authSSOProxyTrusted accesses the super-global variable $_SERVER.
Open

    public function authSSOProxyTrusted()
    {
        // We assume IP is used - if anyone is using a non-ip transport, support will need to be added
        if (Config::get('sso.trusted_proxies')) {
            try {

Superglobals

Since: 0.2

Accessing a super-global variable directly is considered a bad practice. These variables should be encapsulated in objects that are provided by a framework, for instance.

Example

class Foo {
    public function bar() {
        $name = $_POST['foo'];
    }
}

Source

Function authSSOProxyTrusted has a Cognitive Complexity of 19 (exceeds 5 allowed). Consider refactoring.
Open

    public function authSSOProxyTrusted()
    {
        // We assume IP is used - if anyone is using a non-ip transport, support will need to be added
        if (Config::get('sso.trusted_proxies')) {
            try {
Severity: Minor
Found in LibreNMS/Authentication/SSOAuthorizer.php - About 2 hrs to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Function getRoles has a Cognitive Complexity of 17 (exceeds 5 allowed). Consider refactoring.
Open

    public function getRoles(string $username): array|false
    {
        if (Config::get('sso.group_strategy') === 'attribute') {
            if (Config::get('sso.level_attr')) {
                if (is_numeric($this->authSSOGetAttr(Config::get('sso.level_attr')))) {
Severity: Minor
Found in LibreNMS/Authentication/SSOAuthorizer.php - About 2 hrs to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Function authSSOParseGroups has a Cognitive Complexity of 13 (exceeds 5 allowed). Consider refactoring.
Open

    public function authSSOParseGroups()
    {
        // Parse a delimited group list
        $groups = explode(Config::get('sso.group_delimiter', ';'), $this->authSSOGetAttr(Config::get('sso.group_attr')) ?? '');

Severity: Minor
Found in LibreNMS/Authentication/SSOAuthorizer.php - About 1 hr to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Function authSSOGetAttr has a Cognitive Complexity of 9 (exceeds 5 allowed). Consider refactoring.
Open

    public function authSSOGetAttr($attr, $prefix = 'HTTP_')
    {
        // Check attribute originates from a trusted proxy - we check it on every attribute just in case this gets called after initial login
        if ($this->authSSOProxyTrusted()) {
            // Short circuit everything if the attribute is non-existant or null
Severity: Minor
Found in LibreNMS/Authentication/SSOAuthorizer.php - About 55 mins to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Function authenticate has a Cognitive Complexity of 7 (exceeds 5 allowed). Consider refactoring.
Open

    public function authenticate($credentials)
    {
        if (empty($credentials['username'])) {
            throw new AuthenticationException('\'sso.user_attr\' config setting was not found or was empty');
        }
Severity: Minor
Found in LibreNMS/Authentication/SSOAuthorizer.php - About 35 mins to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Avoid too many return statements within this method.
Open

        return true;
Severity: Major
Found in LibreNMS/Authentication/SSOAuthorizer.php - About 30 mins to fix

    The method getRoles() has a Cyclomatic Complexity of 11. The configured cyclomatic complexity threshold is 10.
    Open

        public function getRoles(string $username): array|false
        {
            if (Config::get('sso.group_strategy') === 'attribute') {
                if (Config::get('sso.level_attr')) {
                    if (is_numeric($this->authSSOGetAttr(Config::get('sso.level_attr')))) {

    CyclomaticComplexity

    Since: 0.1

    Complexity is determined by the number of decision points in a method plus one for the method entry. The decision points are 'if', 'while', 'for', and 'case labels'. Generally, 1-4 is low complexity, 5-7 indicates moderate complexity, 8-10 is high complexity, and 11+ is very high complexity.

    Example

    // Cyclomatic Complexity = 11
    class Foo {
    1   public function example() {
    2       if ($a == $b) {
    3           if ($a1 == $b1) {
                    fiddle();
    4           } elseif ($a2 == $b2) {
                    fiddle();
                } else {
                    fiddle();
                }
    5       } elseif ($c == $d) {
    6           while ($c == $d) {
                    fiddle();
                }
    7        } elseif ($e == $f) {
    8           for ($n = 0; $n < $h; $n++) {
                    fiddle();
                }
            } else {
                switch ($z) {
    9               case 1:
                        fiddle();
                        break;
    10              case 2:
                        fiddle();
                        break;
    11              case 3:
                        fiddle();
                        break;
                    default:
                        fiddle();
                        break;
                }
            }
        }
    }

    Source https://phpmd.org/rules/codesize.html#cyclomaticcomplexity

    The method getRoles uses an else expression. Else clauses are basically not necessary and you can simplify the code by not using them.
    Open

                } else {
                    throw new AuthenticationException('group assignment by level map requested, but \'sso.group_level_map\', \'sso.group_attr\', or \'sso.group_delimiter\' are not set in your config');
                }

    ElseExpression

    Since: 1.4.0

    An if expression with an else branch is basically not necessary. You can rewrite the conditions in a way that the else clause is not necessary and the code becomes simpler to read. To achieve this, use early return statements, though you may need to split the code it several smaller methods. For very simple assignments you could also use the ternary operations.

    Example

    class Foo
    {
        public function bar($flag)
        {
            if ($flag) {
                // one branch
            } else {
                // another branch
            }
        }
    }

    Source https://phpmd.org/rules/cleancode.html#elseexpression

    The method getRoles uses an else expression. Else clauses are basically not necessary and you can simplify the code by not using them.
    Open

                } else {
                    throw new AuthenticationException('group assignment by attribute requested, but \'sso.level_attr\' not set in your config');
                }

    ElseExpression

    Since: 1.4.0

    An if expression with an else branch is basically not necessary. You can rewrite the conditions in a way that the else clause is not necessary and the code becomes simpler to read. To achieve this, use early return statements, though you may need to split the code it several smaller methods. For very simple assignments you could also use the ternary operations.

    Example

    class Foo
    {
        public function bar($flag)
        {
            if ($flag) {
                // one branch
            } else {
                // another branch
            }
        }
    }

    Source https://phpmd.org/rules/cleancode.html#elseexpression

    The method authSSOProxyTrusted uses an else expression. Else clauses are basically not necessary and you can simplify the code by not using them.
    Open

                    } else {
                        return false;
                    }

    ElseExpression

    Since: 1.4.0

    An if expression with an else branch is basically not necessary. You can rewrite the conditions in a way that the else clause is not necessary and the code becomes simpler to read. To achieve this, use early return statements, though you may need to split the code it several smaller methods. For very simple assignments you could also use the ternary operations.

    Example

    class Foo
    {
        public function bar($flag)
        {
            if ($flag) {
                // one branch
            } else {
                // another branch
            }
        }
    }

    Source https://phpmd.org/rules/cleancode.html#elseexpression

    The method authSSOGetAttr uses an else expression. Else clauses are basically not necessary and you can simplify the code by not using them.
    Open

            } else {
                throw new AuthenticationException('\'sso.trusted_proxies\'] is set in your config, but this connection did not originate from trusted source: ' . $_SERVER['REMOTE_ADDR']);
            }

    ElseExpression

    Since: 1.4.0

    An if expression with an else branch is basically not necessary. You can rewrite the conditions in a way that the else clause is not necessary and the code becomes simpler to read. To achieve this, use early return statements, though you may need to split the code it several smaller methods. For very simple assignments you could also use the ternary operations.

    Example

    class Foo
    {
        public function bar($flag)
        {
            if ($flag) {
                // one branch
            } else {
                // another branch
            }
        }
    }

    Source https://phpmd.org/rules/cleancode.html#elseexpression

    The method getRoles uses an else expression. Else clauses are basically not necessary and you can simplify the code by not using them.
    Open

                } else {
                    throw new AuthenticationException('group assignment by static level was requested, but \'sso.group_level_map\' was not set in your config');
                }

    ElseExpression

    Since: 1.4.0

    An if expression with an else branch is basically not necessary. You can rewrite the conditions in a way that the else clause is not necessary and the code becomes simpler to read. To achieve this, use early return statements, though you may need to split the code it several smaller methods. For very simple assignments you could also use the ternary operations.

    Example

    class Foo
    {
        public function bar($flag)
        {
            if ($flag) {
                // one branch
            } else {
                // another branch
            }
        }
    }

    Source https://phpmd.org/rules/cleancode.html#elseexpression

    The method getRoles uses an else expression. Else clauses are basically not necessary and you can simplify the code by not using them.
    Open

                    } else {
                        throw new AuthenticationException('group assignment by attribute requested, but httpd is not setting the attribute to a number');
                    }

    ElseExpression

    Since: 1.4.0

    An if expression with an else branch is basically not necessary. You can rewrite the conditions in a way that the else clause is not necessary and the code becomes simpler to read. To achieve this, use early return statements, though you may need to split the code it several smaller methods. For very simple assignments you could also use the ternary operations.

    Example

    class Foo
    {
        public function bar($flag)
        {
            if ($flag) {
                // one branch
            } else {
                // another branch
            }
        }
    }

    Source https://phpmd.org/rules/cleancode.html#elseexpression

    The method authSSOGetAttr uses an else expression. Else clauses are basically not necessary and you can simplify the code by not using them.
    Open

                } else {
                    return null;
                }

    ElseExpression

    Since: 1.4.0

    An if expression with an else branch is basically not necessary. You can rewrite the conditions in a way that the else clause is not necessary and the code becomes simpler to read. To achieve this, use early return statements, though you may need to split the code it several smaller methods. For very simple assignments you could also use the ternary operations.

    Example

    class Foo
    {
        public function bar($flag)
        {
            if ($flag) {
                // one branch
            } else {
                // another branch
            }
        }
    }

    Source https://phpmd.org/rules/cleancode.html#elseexpression

    Avoid unused parameters such as '$username'.
    Open

        public function getRoles(string $username): array|false

    UnusedFormalParameter

    Since: 0.2

    Avoid passing parameters to methods or constructors and then not using those parameters.

    Example

    class Foo
    {
        private function bar($howdy)
        {
            // $howdy is not used
        }
    }

    Source https://phpmd.org/rules/unusedcode.html#unusedformalparameter

    Avoid excessively long variable names like $HAS_AUTH_USERMANAGEMENT. Keep variable name length under 20.
    Open

        protected static $HAS_AUTH_USERMANAGEMENT = true;

    LongVariable

    Since: 0.2

    Detects when a field, formal or local variable is declared with a long name.

    Example

    class Something {
        protected $reallyLongIntName = -3; // VIOLATION - Field
        public static function main( array $interestingArgumentsList[] ) { // VIOLATION - Formal
            $otherReallyLongName = -5; // VIOLATION - Local
            for ($interestingIntIndex = 0; // VIOLATION - For
                 $interestingIntIndex < 10;
                 $interestingIntIndex++ ) {
            }
        }
    }

    Source https://phpmd.org/rules/naming.html#longvariable

    The property $CAN_UPDATE_USER is not named in camelCase.
    Open

    class SSOAuthorizer extends MysqlAuthorizer
    {
        protected static $HAS_AUTH_USERMANAGEMENT = true;
        protected static $CAN_UPDATE_USER = true;
        protected static $CAN_UPDATE_PASSWORDS = false;

    CamelCasePropertyName

    Since: 0.2

    It is considered best practice to use the camelCase notation to name attributes.

    Example

    class ClassName {
        protected $property_name;
    }

    Source

    The property $AUTH_IS_EXTERNAL is not named in camelCase.
    Open

    class SSOAuthorizer extends MysqlAuthorizer
    {
        protected static $HAS_AUTH_USERMANAGEMENT = true;
        protected static $CAN_UPDATE_USER = true;
        protected static $CAN_UPDATE_PASSWORDS = false;

    CamelCasePropertyName

    Since: 0.2

    It is considered best practice to use the camelCase notation to name attributes.

    Example

    class ClassName {
        protected $property_name;
    }

    Source

    The property $CAN_UPDATE_PASSWORDS is not named in camelCase.
    Open

    class SSOAuthorizer extends MysqlAuthorizer
    {
        protected static $HAS_AUTH_USERMANAGEMENT = true;
        protected static $CAN_UPDATE_USER = true;
        protected static $CAN_UPDATE_PASSWORDS = false;

    CamelCasePropertyName

    Since: 0.2

    It is considered best practice to use the camelCase notation to name attributes.

    Example

    class ClassName {
        protected $property_name;
    }

    Source

    The property $HAS_AUTH_USERMANAGEMENT is not named in camelCase.
    Open

    class SSOAuthorizer extends MysqlAuthorizer
    {
        protected static $HAS_AUTH_USERMANAGEMENT = true;
        protected static $CAN_UPDATE_USER = true;
        protected static $CAN_UPDATE_PASSWORDS = false;

    CamelCasePropertyName

    Since: 0.2

    It is considered best practice to use the camelCase notation to name attributes.

    Example

    class ClassName {
        protected $property_name;
    }

    Source

    There are no issues that match your filters.

    Category
    Status