Remove the phpseclib dependency

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>

ChangeLog

@@ -6,7 +6,7 @@ phpMyAdmin - ChangeLog
 - issue #16521 Drop support for Internet Explorer and others
 - issue        Upgrade to shapefile 3
 - issue #16555 Bump minimum PHP version to 7.2
-- issue        Upgrade phpseclib to version 3
+- issue        Remove the phpseclib dependency
 - issue        Upgrade Symfony components to version 5.2
 - issue        Upgrade to Motranslator 4
 - issue #16005 Improve the performance of the Export logic

composer.json

@@ -55,7 +55,6 @@
         "phpmyadmin/shapefile": "^3.0.1",
         "phpmyadmin/sql-parser": "^5.5",
         "phpmyadmin/twig-i18n-extension": "^4.0",
-        "phpseclib/phpseclib": "^3.0",
         "psr/http-factory": "^1.0",
         "psr/http-message": "^1.0",
         "slim/psr7": "^1.4",

libraries/classes/Plugins/Auth/AuthenticationCookie.php

@@ -18,15 +18,12 @@ use PhpMyAdmin\Session;
 use PhpMyAdmin\Url;
 use PhpMyAdmin\Util;
 use PhpMyAdmin\Utils\SessionCache;
-use phpseclib3\Crypt\AES;
-use phpseclib3\Crypt\Random;
 use ReCaptcha;
 
 use function __;
 use function array_keys;
 use function base64_decode;
 use function base64_encode;
-use function class_exists;
 use function count;
 use function defined;
 use function explode;
@@ -44,8 +41,8 @@ use function openssl_cipher_iv_length;
 use function openssl_decrypt;
 use function openssl_encrypt;
 use function openssl_error_string;
-use function openssl_random_pseudo_bytes;
 use function preg_match;
+use function random_bytes;
 use function session_id;
 use function strlen;
 use function substr;
@@ -63,29 +60,6 @@ class AuthenticationCookie extends AuthenticationPlugin
      */
     private $cookieIv = null;
 
-    /**
-     * Whether to use OpenSSL directly
-     *
-     * @var bool
-     */
-    private $useOpenSsl;
-
-    public function __construct()
-    {
-        parent::__construct();
-        $this->useOpenSsl = ! class_exists(Random::class);
-    }
-
-    /**
-     * Forces (not)using of openSSL
-     *
-     * @param bool $use The flag
-     */
-    public function setUseOpenSSL($use): void
-    {
-        $this->useOpenSsl = $use;
-    }
-
     /**
      * Displays authentication form
      *
@@ -646,11 +620,7 @@ class AuthenticationCookie extends AuthenticationPlugin
     private function getSessionEncryptionSecret()
     {
         if (empty($_SESSION['encryption_key'])) {
-            if ($this->useOpenSsl) {
-                $_SESSION['encryption_key'] = openssl_random_pseudo_bytes(32);
-            } else {
-                $_SESSION['encryption_key'] = Random::string(32);
-            }
+            $_SESSION['encryption_key'] = random_bytes(32);
         }
 
         return $_SESSION['encryption_key'];
@@ -740,8 +710,7 @@ class AuthenticationCookie extends AuthenticationPlugin
     }
 
     /**
-     * Encryption using openssl's AES or phpseclib's AES
-     * (phpseclib uses another extension when it is available)
+     * Encryption using openssl's AES
      *
      * @param string $data   original data
      * @param string $secret the secret
@@ -753,14 +722,7 @@ class AuthenticationCookie extends AuthenticationPlugin
         $mac_secret = $this->getMACSecret($secret);
         $aes_secret = $this->getAESSecret($secret);
         $iv = $this->createIV();
-        if ($this->useOpenSsl) {
-            $result = openssl_encrypt($data, 'AES-128-CBC', $aes_secret, 0, $iv);
-        } else {
-            $cipher = new AES('cbc');
-            $cipher->setIV($iv);
-            $cipher->setKey($aes_secret);
-            $result = base64_encode($cipher->encrypt($data));
-        }
+        $result = openssl_encrypt($data, 'AES-128-CBC', $aes_secret, 0, $iv);
 
         $this->cleanSSLErrors();
         $iv = base64_encode($iv);
@@ -775,8 +737,7 @@ class AuthenticationCookie extends AuthenticationPlugin
     }
 
     /**
-     * Decryption using openssl's AES or phpseclib's AES
-     * (phpseclib uses another extension when it is available)
+     * Decryption using openssl's AES
      *
      * @param string $encdata encrypted data
      * @param string $secret  the secret
@@ -805,20 +766,13 @@ class AuthenticationCookie extends AuthenticationPlugin
             return false;
         }
 
-        if ($this->useOpenSsl) {
-            $result = openssl_decrypt(
-                $data['payload'],
-                'AES-128-CBC',
-                $aes_secret,
-                0,
-                base64_decode($data['iv'])
-            );
-        } else {
-            $cipher = new AES('cbc');
-            $cipher->setIV(base64_decode($data['iv']));
-            $cipher->setKey($aes_secret);
-            $result = $cipher->decrypt(base64_decode($data['payload']));
-        }
+        $result = openssl_decrypt(
+            $data['payload'],
+            'AES-128-CBC',
+            $aes_secret,
+            0,
+            base64_decode($data['iv'])
+        );
 
         $this->cleanSSLErrors();
 
@@ -832,11 +786,7 @@ class AuthenticationCookie extends AuthenticationPlugin
      */
     public function getIVSize()
     {
-        if ($this->useOpenSsl) {
-            return openssl_cipher_iv_length('AES-128-CBC');
-        }
-
-        return (new AES('cbc'))->getBlockLengthInBytes();
+        return openssl_cipher_iv_length('AES-128-CBC');
     }
 
     /**
@@ -854,16 +804,7 @@ class AuthenticationCookie extends AuthenticationPlugin
             return $this->cookieIv;
         }
 
-        if ($this->useOpenSsl) {
-            $bytes = openssl_random_pseudo_bytes($this->getIVSize());
-            if ($bytes !== false) {
-                return $bytes;
-            }
-        }
-
-        return Random::string(
-            $this->getIVSize()
-        );
+        return random_bytes($this->getIVSize());
     }
 
     /**

libraries/classes/Util.php

@@ -12,7 +12,6 @@ use PhpMyAdmin\SqlParser\Components\Expression;
 use PhpMyAdmin\SqlParser\Context;
 use PhpMyAdmin\SqlParser\Token;
 use PhpMyAdmin\Utils\SessionCache;
-use phpseclib3\Crypt\Random;
 use Stringable;
 
 use function __;
@@ -26,7 +25,6 @@ use function array_unique;
 use function basename;
 use function bin2hex;
 use function chr;
-use function class_exists;
 use function count;
 use function ctype_digit;
 use function date;
@@ -64,6 +62,7 @@ use function parse_url;
 use function preg_match;
 use function preg_quote;
 use function preg_replace;
+use function random_bytes;
 use function range;
 use function reset;
 use function round;
@@ -2463,19 +2462,11 @@ class Util
     public static function generateRandom(int $length, bool $asHex = false): string
     {
         $result = '';
-        if (class_exists(Random::class)) {
-            $randomFunction = [
-                Random::class,
-                'string',
-            ];
-        } else {
-            $randomFunction = 'openssl_random_pseudo_bytes';
-        }
 
         while (strlen($result) < $length) {
             // Get random byte and strip highest bit
             // to get ASCII only range
-            $byte = ord((string) $randomFunction(1)) & 0x7f;
+            $byte = ord(random_bytes(1)) & 0x7f;
             // We want only ASCII chars and no DEL character (127)
             if ($byte <= 32 || $byte === 127) {
                 continue;

test/classes/Plugins/Auth/AuthenticationCookieTest.php

@@ -942,21 +942,6 @@ class AuthenticationCookieTest extends AbstractNetworkTestCase
         );
     }
 
-    public function testCookieEncryptPHPSecLib(): void
-    {
-        $this->object->setUseOpenSSL(false);
-        $this->testCookieEncrypt();
-    }
-
-    /**
-     * @requires extension openssl
-     */
-    public function testCookieEncryptOpenSSL(): void
-    {
-        $this->object->setUseOpenSSL(true);
-        $this->testCookieEncrypt();
-    }
-
     public function testCookieDecrypt(): void
     {
         // works with the openssl extension active or inactive
@@ -985,21 +970,6 @@ class AuthenticationCookieTest extends AbstractNetworkTestCase
         );
     }
 
-    public function testCookieDecryptPHPSecLib(): void
-    {
-        $this->object->setUseOpenSSL(false);
-        $this->testCookieDecrypt();
-    }
-
-    /**
-     * @requires extension openssl
-     */
-    public function testCookieDecryptOpenSSL(): void
-    {
-        $this->object->setUseOpenSSL(true);
-        $this->testCookieDecrypt();
-    }
-
     public function testCookieDecryptInvalid(): void
     {
         // works with the openssl extension active or inactive