From 7aaab244631cf196d2583ea0e5b371abbe369d8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= Date: Tue, 11 Jan 2022 18:43:47 -0300 Subject: [PATCH] Remove the phpseclib dependency MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Maurício Meneghini Fauth --- ChangeLog | 2 +- composer.json | 1 - .../Plugins/Auth/AuthenticationCookie.php | 87 +++---------------- libraries/classes/Util.php | 13 +-- .../Plugins/Auth/AuthenticationCookieTest.php | 30 ------- 5 files changed, 17 insertions(+), 116 deletions(-) diff --git a/ChangeLog b/ChangeLog index e5455b0e29..4580ba9252 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,7 +6,7 @@ phpMyAdmin - ChangeLog - issue #16521 Drop support for Internet Explorer and others - issue Upgrade to shapefile 3 - issue #16555 Bump minimum PHP version to 7.2 -- issue Upgrade phpseclib to version 3 +- issue Remove the phpseclib dependency - issue Upgrade Symfony components to version 5.2 - issue Upgrade to Motranslator 4 - issue #16005 Improve the performance of the Export logic diff --git a/composer.json b/composer.json index a1277fb53d..c50a7039c4 100644 --- a/composer.json +++ b/composer.json @@ -55,7 +55,6 @@ "phpmyadmin/shapefile": "^3.0.1", "phpmyadmin/sql-parser": "^5.5", "phpmyadmin/twig-i18n-extension": "^4.0", - "phpseclib/phpseclib": "^3.0", "psr/http-factory": "^1.0", "psr/http-message": "^1.0", "slim/psr7": "^1.4", diff --git a/libraries/classes/Plugins/Auth/AuthenticationCookie.php b/libraries/classes/Plugins/Auth/AuthenticationCookie.php index 5b000a78bc..9cca460adf 100644 --- a/libraries/classes/Plugins/Auth/AuthenticationCookie.php +++ b/libraries/classes/Plugins/Auth/AuthenticationCookie.php @@ -18,15 +18,12 @@ use PhpMyAdmin\Session; use PhpMyAdmin\Url; use PhpMyAdmin\Util; use PhpMyAdmin\Utils\SessionCache; -use phpseclib3\Crypt\AES; -use phpseclib3\Crypt\Random; use ReCaptcha; use function __; use function array_keys; use function base64_decode; use function base64_encode; -use function class_exists; use function count; use function defined; use function explode; @@ -44,8 +41,8 @@ use function openssl_cipher_iv_length; use function openssl_decrypt; use function openssl_encrypt; use function openssl_error_string; -use function openssl_random_pseudo_bytes; use function preg_match; +use function random_bytes; use function session_id; use function strlen; use function substr; @@ -63,29 +60,6 @@ class AuthenticationCookie extends AuthenticationPlugin */ private $cookieIv = null; - /** - * Whether to use OpenSSL directly - * - * @var bool - */ - private $useOpenSsl; - - public function __construct() - { - parent::__construct(); - $this->useOpenSsl = ! class_exists(Random::class); - } - - /** - * Forces (not)using of openSSL - * - * @param bool $use The flag - */ - public function setUseOpenSSL($use): void - { - $this->useOpenSsl = $use; - } - /** * Displays authentication form * @@ -646,11 +620,7 @@ class AuthenticationCookie extends AuthenticationPlugin private function getSessionEncryptionSecret() { if (empty($_SESSION['encryption_key'])) { - if ($this->useOpenSsl) { - $_SESSION['encryption_key'] = openssl_random_pseudo_bytes(32); - } else { - $_SESSION['encryption_key'] = Random::string(32); - } + $_SESSION['encryption_key'] = random_bytes(32); } return $_SESSION['encryption_key']; @@ -740,8 +710,7 @@ class AuthenticationCookie extends AuthenticationPlugin } /** - * Encryption using openssl's AES or phpseclib's AES - * (phpseclib uses another extension when it is available) + * Encryption using openssl's AES * * @param string $data original data * @param string $secret the secret @@ -753,14 +722,7 @@ class AuthenticationCookie extends AuthenticationPlugin $mac_secret = $this->getMACSecret($secret); $aes_secret = $this->getAESSecret($secret); $iv = $this->createIV(); - if ($this->useOpenSsl) { - $result = openssl_encrypt($data, 'AES-128-CBC', $aes_secret, 0, $iv); - } else { - $cipher = new AES('cbc'); - $cipher->setIV($iv); - $cipher->setKey($aes_secret); - $result = base64_encode($cipher->encrypt($data)); - } + $result = openssl_encrypt($data, 'AES-128-CBC', $aes_secret, 0, $iv); $this->cleanSSLErrors(); $iv = base64_encode($iv); @@ -775,8 +737,7 @@ class AuthenticationCookie extends AuthenticationPlugin } /** - * Decryption using openssl's AES or phpseclib's AES - * (phpseclib uses another extension when it is available) + * Decryption using openssl's AES * * @param string $encdata encrypted data * @param string $secret the secret @@ -805,20 +766,13 @@ class AuthenticationCookie extends AuthenticationPlugin return false; } - if ($this->useOpenSsl) { - $result = openssl_decrypt( - $data['payload'], - 'AES-128-CBC', - $aes_secret, - 0, - base64_decode($data['iv']) - ); - } else { - $cipher = new AES('cbc'); - $cipher->setIV(base64_decode($data['iv'])); - $cipher->setKey($aes_secret); - $result = $cipher->decrypt(base64_decode($data['payload'])); - } + $result = openssl_decrypt( + $data['payload'], + 'AES-128-CBC', + $aes_secret, + 0, + base64_decode($data['iv']) + ); $this->cleanSSLErrors(); @@ -832,11 +786,7 @@ class AuthenticationCookie extends AuthenticationPlugin */ public function getIVSize() { - if ($this->useOpenSsl) { - return openssl_cipher_iv_length('AES-128-CBC'); - } - - return (new AES('cbc'))->getBlockLengthInBytes(); + return openssl_cipher_iv_length('AES-128-CBC'); } /** @@ -854,16 +804,7 @@ class AuthenticationCookie extends AuthenticationPlugin return $this->cookieIv; } - if ($this->useOpenSsl) { - $bytes = openssl_random_pseudo_bytes($this->getIVSize()); - if ($bytes !== false) { - return $bytes; - } - } - - return Random::string( - $this->getIVSize() - ); + return random_bytes($this->getIVSize()); } /** diff --git a/libraries/classes/Util.php b/libraries/classes/Util.php index 2656053ab3..59e9b4e6ad 100644 --- a/libraries/classes/Util.php +++ b/libraries/classes/Util.php @@ -12,7 +12,6 @@ use PhpMyAdmin\SqlParser\Components\Expression; use PhpMyAdmin\SqlParser\Context; use PhpMyAdmin\SqlParser\Token; use PhpMyAdmin\Utils\SessionCache; -use phpseclib3\Crypt\Random; use Stringable; use function __; @@ -26,7 +25,6 @@ use function array_unique; use function basename; use function bin2hex; use function chr; -use function class_exists; use function count; use function ctype_digit; use function date; @@ -64,6 +62,7 @@ use function parse_url; use function preg_match; use function preg_quote; use function preg_replace; +use function random_bytes; use function range; use function reset; use function round; @@ -2463,19 +2462,11 @@ class Util public static function generateRandom(int $length, bool $asHex = false): string { $result = ''; - if (class_exists(Random::class)) { - $randomFunction = [ - Random::class, - 'string', - ]; - } else { - $randomFunction = 'openssl_random_pseudo_bytes'; - } while (strlen($result) < $length) { // Get random byte and strip highest bit // to get ASCII only range - $byte = ord((string) $randomFunction(1)) & 0x7f; + $byte = ord(random_bytes(1)) & 0x7f; // We want only ASCII chars and no DEL character (127) if ($byte <= 32 || $byte === 127) { continue; diff --git a/test/classes/Plugins/Auth/AuthenticationCookieTest.php b/test/classes/Plugins/Auth/AuthenticationCookieTest.php index 260fa41c4f..6955549c22 100644 --- a/test/classes/Plugins/Auth/AuthenticationCookieTest.php +++ b/test/classes/Plugins/Auth/AuthenticationCookieTest.php @@ -942,21 +942,6 @@ class AuthenticationCookieTest extends AbstractNetworkTestCase ); } - public function testCookieEncryptPHPSecLib(): void - { - $this->object->setUseOpenSSL(false); - $this->testCookieEncrypt(); - } - - /** - * @requires extension openssl - */ - public function testCookieEncryptOpenSSL(): void - { - $this->object->setUseOpenSSL(true); - $this->testCookieEncrypt(); - } - public function testCookieDecrypt(): void { // works with the openssl extension active or inactive @@ -985,21 +970,6 @@ class AuthenticationCookieTest extends AbstractNetworkTestCase ); } - public function testCookieDecryptPHPSecLib(): void - { - $this->object->setUseOpenSSL(false); - $this->testCookieDecrypt(); - } - - /** - * @requires extension openssl - */ - public function testCookieDecryptOpenSSL(): void - { - $this->object->setUseOpenSSL(true); - $this->testCookieDecrypt(); - } - public function testCookieDecryptInvalid(): void { // works with the openssl extension active or inactive