Skip to content

Commit 6be91ef

Browse files
slknijnenburgslknijnenburg
committed
Add SensitiveParameter attribute to sensitive parameters
Adds `#[SensitiveParameter]` to all potentially sensitive parameters, including key material, certificates and passphrases.
1 parent 848815d commit 6be91ef

File tree

15 files changed

+135
-53
lines changed

15 files changed

+135
-53
lines changed

‎src/Builder.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
use Lcobucci\JWT\Signer\InvalidKeyProvided;
1111
use Lcobucci\JWT\Signer\Key;
1212
use Lcobucci\JWT\Token\RegisteredClaimGiven;
13+
use SensitiveParameter;
1314

1415
/** @immutable */
1516
interface Builder
@@ -81,5 +82,8 @@ public function withClaim(string $name, mixed $value): Builder;
8182
* @throws InvalidKeyProvided When issue key is invalid/incompatible.
8283
* @throws ConversionFailed When signature could not be converted.
8384
*/
84-
public function getToken(Signer $signer, Key $key): UnencryptedToken;
85+
public function getToken(
86+
Signer $signer,
87+
Key $key,
88+
): UnencryptedToken;
8589
}

‎src/Configuration.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
use Lcobucci\JWT\Encoding\JoseEncoder;
99
use Lcobucci\JWT\Signer\Key;
1010
use Lcobucci\JWT\Validation\Constraint;
11+
use SensitiveParameter;
1112

1213
/**
1314
* Configuration container for the JWT Builder and Parser
@@ -59,6 +60,7 @@ public static function forAsymmetricSigner(
5960

6061
public static function forSymmetricSigner(
6162
Signer $signer,
63+
#[SensitiveParameter]
6264
Key $key,
6365
Encoder $encoder = new JoseEncoder(),
6466
Decoder $decoder = new JoseEncoder(),

‎src/Signer.php

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,10 @@ public function algorithmId(): string;
2828
* @throws InvalidKeyProvided When issue key is invalid/incompatible.
2929
* @throws ConversionFailed When signature could not be converted.
3030
*/
31-
public function sign(string $payload, Key $key): string;
31+
public function sign(
32+
string $payload,
33+
Key $key,
34+
): string;
3235

3336
/**
3437
* Returns if the expected hash matches with the data and key
@@ -39,5 +42,9 @@ public function sign(string $payload, Key $key): string;
3942
* @throws InvalidKeyProvided When issue key is invalid/incompatible.
4043
* @throws ConversionFailed When signature could not be converted.
4144
*/
42-
public function verify(string $expected, string $payload, Key $key): bool;
45+
public function verify(
46+
string $expected,
47+
string $payload,
48+
Key $key,
49+
): bool;
4350
}

‎src/Signer/Blake2b.php

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,10 @@ public function algorithmId(): string
1818
return 'BLAKE2B';
1919
}
2020

21-
public function sign(string $payload, Key $key): string
22-
{
21+
public function sign(
22+
string $payload,
23+
Key $key,
24+
): string {
2325
$actualKeyLength = 8 * strlen($key->contents());
2426

2527
if ($actualKeyLength < self::MINIMUM_KEY_LENGTH_IN_BITS) {
@@ -29,8 +31,11 @@ public function sign(string $payload, Key $key): string
2931
return sodium_crypto_generichash($payload, $key->contents());
3032
}
3133

32-
public function verify(string $expected, string $payload, Key $key): bool
33-
{
34+
public function verify(
35+
string $expected,
36+
string $payload,
37+
Key $key,
38+
): bool {
3439
return hash_equals($expected, $this->sign($payload, $key));
3540
}
3641
}

‎src/Signer/Ecdsa.php

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,21 @@ public function __construct(
1515
) {
1616
}
1717

18-
final public function sign(string $payload, Key $key): string
19-
{
18+
final public function sign(
19+
string $payload,
20+
Key $key,
21+
): string {
2022
return $this->converter->fromAsn1(
2123
$this->createSignature($key->contents(), $key->passphrase(), $payload),
2224
$this->pointLength(),
2325
);
2426
}
2527

26-
final public function verify(string $expected, string $payload, Key $key): bool
27-
{
28+
final public function verify(
29+
string $expected,
30+
string $payload,
31+
Key $key,
32+
): bool {
2833
return $this->verifySignature(
2934
$this->converter->toAsn1($expected, $this->pointLength()),
3035
$payload,

‎src/Signer/Eddsa.php

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,22 @@ public function algorithmId(): string
1616
return 'EdDSA';
1717
}
1818

19-
public function sign(string $payload, Key $key): string
20-
{
19+
public function sign(
20+
string $payload,
21+
Key $key,
22+
): string {
2123
try {
2224
return sodium_crypto_sign_detached($payload, $key->contents());
2325
} catch (SodiumException $sodiumException) {
2426
throw new InvalidKeyProvided($sodiumException->getMessage(), 0, $sodiumException);
2527
}
2628
}
2729

28-
public function verify(string $expected, string $payload, Key $key): bool
29-
{
30+
public function verify(
31+
string $expected,
32+
string $payload,
33+
Key $key,
34+
): bool {
3035
try {
3136
return sodium_crypto_sign_verify_detached($expected, $payload, $key->contents());
3237
} catch (SodiumException $sodiumException) {

‎src/Signer/Hmac.php

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,10 @@
1111

1212
abstract class Hmac implements Signer
1313
{
14-
final public function sign(string $payload, Key $key): string
15-
{
14+
final public function sign(
15+
string $payload,
16+
Key $key,
17+
): string {
1618
$actualKeyLength = 8 * strlen($key->contents());
1719
$expectedKeyLength = $this->minimumBitsLengthForKey();
1820

@@ -23,8 +25,11 @@ final public function sign(string $payload, Key $key): string
2325
return hash_hmac($this->algorithm(), $payload, $key->contents(), true);
2426
}
2527

26-
final public function verify(string $expected, string $payload, Key $key): bool
27-
{
28+
final public function verify(
29+
string $expected,
30+
string $payload,
31+
Key $key,
32+
): bool {
2833
return hash_equals($expected, $this->sign($payload, $key));
2934
}
3035

‎src/Signer/Key/InMemory.php

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
use Lcobucci\JWT\Signer\InvalidKeyProvided;
77
use Lcobucci\JWT\Signer\Key;
88
use Lcobucci\JWT\SodiumBase64Polyfill;
9+
use SensitiveParameter;
910
use SplFileObject;
1011
use Throwable;
1112

@@ -15,21 +16,30 @@
1516
final class InMemory implements Key
1617
{
1718
/** @param non-empty-string $contents */
18-
private function __construct(public readonly string $contents, public readonly string $passphrase)
19-
{
19+
private function __construct(
20+
public readonly string $contents,
21+
#[SensitiveParameter]
22+
public readonly string $passphrase,
23+
) {
2024
}
2125

2226
/** @param non-empty-string $contents */
23-
public static function plainText(string $contents, string $passphrase = ''): self
24-
{
27+
public static function plainText(
28+
string $contents,
29+
#[SensitiveParameter]
30+
string $passphrase = '',
31+
): self {
2532
self::guardAgainstEmptyKey($contents);
2633

2734
return new self($contents, $passphrase);
2835
}
2936

3037
/** @param non-empty-string $contents */
31-
public static function base64Encoded(string $contents, string $passphrase = ''): self
32-
{
38+
public static function base64Encoded(
39+
string $contents,
40+
#[SensitiveParameter]
41+
string $passphrase = '',
42+
): self {
3343
$decoded = SodiumBase64Polyfill::base642bin(
3444
$contents,
3545
SodiumBase64Polyfill::SODIUM_BASE64_VARIANT_ORIGINAL,
@@ -45,8 +55,11 @@ public static function base64Encoded(string $contents, string $passphrase = ''):
4555
*
4656
* @throws FileCouldNotBeRead
4757
*/
48-
public static function file(string $path, string $passphrase = ''): self
49-
{
58+
public static function file(
59+
string $path,
60+
#[SensitiveParameter]
61+
string $passphrase = '',
62+
): self {
5063
try {
5164
$file = new SplFileObject($path);
5265
} catch (Throwable $exception) {

‎src/Signer/OpenSSL.php

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55

66
use Lcobucci\JWT\Signer;
77
use OpenSSLAsymmetricKey;
8+
use SensitiveParameter;
89

910
use function array_key_exists;
1011
use function assert;
@@ -40,7 +41,9 @@ abstract class OpenSSL implements Signer
4041
* @throws InvalidKeyProvided
4142
*/
4243
final protected function createSignature(
44+
#[SensitiveParameter]
4345
string $pem,
46+
#[SensitiveParameter]
4447
string $passphrase,
4548
string $payload,
4649
): string {
@@ -56,15 +59,20 @@ final protected function createSignature(
5659
}
5760

5861
/** @throws CannotSignPayload */
59-
private function getPrivateKey(string $pem, string $passphrase): OpenSSLAsymmetricKey
60-
{
62+
private function getPrivateKey(
63+
#[SensitiveParameter]
64+
string $pem,
65+
#[SensitiveParameter]
66+
string $passphrase,
67+
): OpenSSLAsymmetricKey {
6168
return $this->validateKey(openssl_pkey_get_private($pem, $passphrase));
6269
}
6370

6471
/** @throws InvalidKeyProvided */
6572
final protected function verifySignature(
6673
string $expected,
6774
string $payload,
75+
#[SensitiveParameter]
6876
string $pem,
6977
): bool {
7078
$key = $this->getPublicKey($pem);
@@ -74,8 +82,10 @@ final protected function verifySignature(
7482
}
7583

7684
/** @throws InvalidKeyProvided */
77-
private function getPublicKey(string $pem): OpenSSLAsymmetricKey
78-
{
85+
private function getPublicKey(
86+
#[SensitiveParameter]
87+
string $pem,
88+
): OpenSSLAsymmetricKey {
7989
return $this->validateKey(openssl_pkey_get_public($pem));
8090
}
8191

@@ -84,8 +94,10 @@ private function getPublicKey(string $pem): OpenSSLAsymmetricKey
8494
*
8595
* @throws InvalidKeyProvided
8696
*/
87-
private function validateKey(OpenSSLAsymmetricKey|bool $key): OpenSSLAsymmetricKey
88-
{
97+
private function validateKey(
98+
#[SensitiveParameter]
99+
OpenSSLAsymmetricKey|bool $key,
100+
): OpenSSLAsymmetricKey {
89101
if (is_bool($key)) {
90102
throw InvalidKeyProvided::cannotBeParsed($this->fullOpenSSLErrorString());
91103
}

‎src/Signer/Rsa.php

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,18 @@ abstract class Rsa extends OpenSSL
99
{
1010
private const MINIMUM_KEY_LENGTH = 2048;
1111

12-
final public function sign(string $payload, Key $key): string
13-
{
12+
final public function sign(
13+
string $payload,
14+
Key $key,
15+
): string {
1416
return $this->createSignature($key->contents(), $key->passphrase(), $payload);
1517
}
1618

17-
final public function verify(string $expected, string $payload, Key $key): bool
18-
{
19+
final public function verify(
20+
string $expected,
21+
string $payload,
22+
Key $key,
23+
): bool {
1924
return $this->verifySignature($expected, $payload, $key->contents());
2025
}
2126

0 commit comments

Comments
 (0)