From eb9bcbc040ace2a99375fb043c7de4f44533ea10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= <mauricio@fauth.dev>
Date: Wed, 13 Oct 2021 11:51:56 -0300
Subject: [PATCH] Encrypt the URL query when sensitive data is present
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
---
 libraries/classes/Url.php | 53 +++++++++++++++++++++++++++++++++++++++
 libraries/common.inc.php  | 12 +++++++++
 2 files changed, 65 insertions(+)

diff --git a/libraries/classes/Url.php b/libraries/classes/Url.php
index f527819fbb..d63d7b6989 100644
--- a/libraries/classes/Url.php
+++ b/libraries/classes/Url.php
@@ -7,6 +7,9 @@
  */
 namespace PhpMyAdmin;
 
+use phpseclib\Crypt\AES;
+use phpseclib\Crypt\Random;
+
 /**
  * Static methods for URL/hidden inputs generating
  *
@@ -220,6 +223,11 @@ class Url
 
         $query = http_build_query($params, null, $separator);
 
+        if (isset($params['db'])) {
+            $encryptedQuery = self::encryptQuery($query);
+            $query = http_build_query(['eq' => $encryptedQuery], null, $separator);
+        }
+
         if ($divider != '?' || strlen($query) > 0) {
             return $divider . $query;
         }
@@ -227,6 +235,51 @@ class Url
         return '';
     }
 
+    /**
+     * @param string $query
+     * @return string
+     */
+    public static function encryptQuery($query)
+    {
+        global $PMA_Config;
+
+        $key = $_SESSION[' HMAC_secret '] . $PMA_Config->get('blowfish_secret');
+        $cipher = new AES(AES::MODE_CBC);
+        $iv = Random::string(16);
+        $cipher->setIV($iv);
+        $cipher->setKey($key);
+        $ciphertext = $cipher->encrypt($query);
+        $hmac = hash_hmac('sha256', $iv . $ciphertext, $key, true);
+
+        return strtr(base64_encode($hmac . $iv . $ciphertext), '+/', '-_');
+    }
+
+    /**
+     * @param string $query
+     * @return string|null
+     */
+    public static function decryptQuery($query)
+    {
+        global $PMA_Config;
+
+        $encryptedQuery = base64_decode(strtr($query, '-_', '+/'));
+        $hmac = mb_substr($encryptedQuery, 0, 32, '8bit');
+        $iv = mb_substr($encryptedQuery, 32, 16, '8bit');
+        $ciphertext = mb_substr($encryptedQuery, 48, null, '8bit');
+        $key = $_SESSION[' HMAC_secret '] . $PMA_Config->get('blowfish_secret');
+        $calculated = hash_hmac('sha256', $iv . $ciphertext, $key, true);
+
+        if (! hash_equals($hmac, $calculated)) {
+            return null;
+        }
+
+        $cipher = new AES(AES::MODE_CBC);
+        $cipher->setIV($iv);
+        $cipher->setKey($key);
+
+        return $cipher->decrypt($ciphertext);
+    }
+
     /**
      * Returns url separator
      *
diff --git a/libraries/common.inc.php b/libraries/common.inc.php
index 8ec80a9638..fafc6d7353 100644
--- a/libraries/common.inc.php
+++ b/libraries/common.inc.php
@@ -43,6 +43,7 @@ use PhpMyAdmin\Response;
 use PhpMyAdmin\Session;
 use PhpMyAdmin\ThemeManager;
 use PhpMyAdmin\Tracker;
+use PhpMyAdmin\Url;
 use PhpMyAdmin\Util;
 
 /**
@@ -132,6 +133,17 @@ if (! defined('PMA_NO_SESSION')) {
     Session::setUp($GLOBALS['PMA_Config'], $GLOBALS['error_handler']);
 }
 
+if (isset($_GET['eq']) && is_string($_GET['eq'])) {
+    $decryptedQuery = Url::decryptQuery($_GET['eq']);
+    if ($decryptedQuery !== null) {
+        parse_str($decryptedQuery, $urlQueryParams);
+        foreach ($urlQueryParams as $urlQueryParamKey => $urlQueryParamValue) {
+            $_GET[$urlQueryParamKey] = $urlQueryParamValue;
+            $_REQUEST[$urlQueryParamKey] = $urlQueryParamValue;
+        }
+    }
+}
+
 /**
  * init some variables LABEL_variables_init
  */