Skip to content

Commit b0e12fc

Browse files
slknijnenburgslknijnenburg
committed
Add SensitiveParameter attribute to sensitive parameters
Adds `#[SensitiveParameter]` to all potentially sensitive parameters, including key material, certificates and passphrases.
1 parent 8cf0783 commit b0e12fc

17 files changed

+160
-47
lines changed

‎src/Builder.php

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
use Lcobucci\JWT\Signer\InvalidKeyProvided;
1111
use Lcobucci\JWT\Signer\Key;
1212
use Lcobucci\JWT\Token\RegisteredClaimGiven;
13+
use SensitiveParameter;
1314

1415
/** @immutable */
1516
interface Builder
@@ -81,5 +82,9 @@ public function withClaim(string $name, mixed $value): Builder;
8182
* @throws InvalidKeyProvided When issue key is invalid/incompatible.
8283
* @throws ConversionFailed When signature could not be converted.
8384
*/
84-
public function getToken(Signer $signer, Key $key): UnencryptedToken;
85+
public function getToken(
86+
Signer $signer,
87+
#[SensitiveParameter]
88+
Key $key,
89+
): UnencryptedToken;
8590
}

‎src/Configuration.php

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
use Lcobucci\JWT\Encoding\JoseEncoder;
99
use Lcobucci\JWT\Signer\Key;
1010
use Lcobucci\JWT\Validation\Constraint;
11+
use SensitiveParameter;
1112

1213
/**
1314
* Configuration container for the JWT Builder and Parser
@@ -28,7 +29,9 @@ final class Configuration
2829

2930
private function __construct(
3031
private readonly Signer $signer,
32+
#[SensitiveParameter]
3133
private readonly Key $signingKey,
34+
#[SensitiveParameter]
3235
private readonly Key $verificationKey,
3336
Encoder $encoder,
3437
Decoder $decoder,
@@ -43,7 +46,9 @@ private function __construct(
4346

4447
public static function forAsymmetricSigner(
4548
Signer $signer,
49+
#[SensitiveParameter]
4650
Key $signingKey,
51+
#[SensitiveParameter]
4752
Key $verificationKey,
4853
Encoder $encoder = new JoseEncoder(),
4954
Decoder $decoder = new JoseEncoder(),
@@ -59,6 +64,7 @@ public static function forAsymmetricSigner(
5964

6065
public static function forSymmetricSigner(
6166
Signer $signer,
67+
#[SensitiveParameter]
6268
Key $key,
6369
Encoder $encoder = new JoseEncoder(),
6470
Decoder $decoder = new JoseEncoder(),

‎src/JwtFacade.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
use Lcobucci\JWT\Validation\ValidAt;
1414
use Lcobucci\JWT\Validation\Validator;
1515
use Psr\Clock\ClockInterface as Clock;
16+
use SensitiveParameter;
1617

1718
use function assert;
1819

@@ -35,6 +36,7 @@ public function now(): DateTimeImmutable
3536
/** @param Closure(Builder, DateTimeImmutable):Builder $customiseBuilder */
3637
public function issue(
3738
Signer $signer,
39+
#[SensitiveParameter]
3840
Key $signingKey,
3941
Closure $customiseBuilder,
4042
): UnencryptedToken {

‎src/Signer.php

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
use Lcobucci\JWT\Signer\Ecdsa\ConversionFailed;
88
use Lcobucci\JWT\Signer\InvalidKeyProvided;
99
use Lcobucci\JWT\Signer\Key;
10+
use SensitiveParameter;
1011

1112
interface Signer
1213
{
@@ -28,7 +29,11 @@ public function algorithmId(): string;
2829
* @throws InvalidKeyProvided When issue key is invalid/incompatible.
2930
* @throws ConversionFailed When signature could not be converted.
3031
*/
31-
public function sign(string $payload, Key $key): string;
32+
public function sign(
33+
string $payload,
34+
#[SensitiveParameter]
35+
Key $key,
36+
): string;
3237

3338
/**
3439
* Returns if the expected hash matches with the data and key
@@ -39,5 +44,10 @@ public function sign(string $payload, Key $key): string;
3944
* @throws InvalidKeyProvided When issue key is invalid/incompatible.
4045
* @throws ConversionFailed When signature could not be converted.
4146
*/
42-
public function verify(string $expected, string $payload, Key $key): bool;
47+
public function verify(
48+
string $expected,
49+
string $payload,
50+
#[SensitiveParameter]
51+
Key $key,
52+
): bool;
4353
}

‎src/Signer/Blake2b.php

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
namespace Lcobucci\JWT\Signer;
55

66
use Lcobucci\JWT\Signer;
7+
use SensitiveParameter;
78

89
use function hash_equals;
910
use function sodium_crypto_generichash;
@@ -18,8 +19,11 @@ public function algorithmId(): string
1819
return 'BLAKE2B';
1920
}
2021

21-
public function sign(string $payload, Key $key): string
22-
{
22+
public function sign(
23+
string $payload,
24+
#[SensitiveParameter]
25+
Key $key,
26+
): string {
2327
$actualKeyLength = 8 * strlen($key->contents());
2428

2529
if ($actualKeyLength < self::MINIMUM_KEY_LENGTH_IN_BITS) {
@@ -29,8 +33,12 @@ public function sign(string $payload, Key $key): string
2933
return sodium_crypto_generichash($payload, $key->contents());
3034
}
3135

32-
public function verify(string $expected, string $payload, Key $key): bool
33-
{
36+
public function verify(
37+
string $expected,
38+
string $payload,
39+
#[SensitiveParameter]
40+
Key $key,
41+
): bool {
3442
return hash_equals($expected, $this->sign($payload, $key));
3543
}
3644
}

‎src/Signer/Ecdsa.php

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55

66
use Lcobucci\JWT\Signer\Ecdsa\MultibyteStringConverter;
77
use Lcobucci\JWT\Signer\Ecdsa\SignatureConverter;
8+
use SensitiveParameter;
89

910
use const OPENSSL_KEYTYPE_EC;
1011

@@ -15,16 +16,23 @@ public function __construct(
1516
) {
1617
}
1718

18-
final public function sign(string $payload, Key $key): string
19-
{
19+
final public function sign(
20+
string $payload,
21+
#[SensitiveParameter]
22+
Key $key,
23+
): string {
2024
return $this->converter->fromAsn1(
2125
$this->createSignature($key->contents(), $key->passphrase(), $payload),
2226
$this->pointLength(),
2327
);
2428
}
2529

26-
final public function verify(string $expected, string $payload, Key $key): bool
27-
{
30+
final public function verify(
31+
string $expected,
32+
string $payload,
33+
#[SensitiveParameter]
34+
Key $key,
35+
): bool {
2836
return $this->verifySignature(
2937
$this->converter->toAsn1($expected, $this->pointLength()),
3038
$payload,

‎src/Signer/Eddsa.php

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
namespace Lcobucci\JWT\Signer;
55

66
use Lcobucci\JWT\Signer;
7+
use SensitiveParameter;
78
use SodiumException;
89

910
use function sodium_crypto_sign_detached;
@@ -16,17 +17,24 @@ public function algorithmId(): string
1617
return 'EdDSA';
1718
}
1819

19-
public function sign(string $payload, Key $key): string
20-
{
20+
public function sign(
21+
string $payload,
22+
#[SensitiveParameter]
23+
Key $key,
24+
): string {
2125
try {
2226
return sodium_crypto_sign_detached($payload, $key->contents());
2327
} catch (SodiumException $sodiumException) {
2428
throw new InvalidKeyProvided($sodiumException->getMessage(), 0, $sodiumException);
2529
}
2630
}
2731

28-
public function verify(string $expected, string $payload, Key $key): bool
29-
{
32+
public function verify(
33+
string $expected,
34+
string $payload,
35+
#[SensitiveParameter]
36+
Key $key,
37+
): bool {
3038
try {
3139
return sodium_crypto_sign_verify_detached($expected, $payload, $key->contents());
3240
} catch (SodiumException $sodiumException) {

‎src/Signer/Hmac.php

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,19 @@
44
namespace Lcobucci\JWT\Signer;
55

66
use Lcobucci\JWT\Signer;
7+
use SensitiveParameter;
78

89
use function hash_equals;
910
use function hash_hmac;
1011
use function strlen;
1112

1213
abstract class Hmac implements Signer
1314
{
14-
final public function sign(string $payload, Key $key): string
15-
{
15+
final public function sign(
16+
string $payload,
17+
#[SensitiveParameter]
18+
Key $key,
19+
): string {
1620
$actualKeyLength = 8 * strlen($key->contents());
1721
$expectedKeyLength = $this->minimumBitsLengthForKey();
1822

@@ -23,8 +27,12 @@ final public function sign(string $payload, Key $key): string
2327
return hash_hmac($this->algorithm(), $payload, $key->contents(), true);
2428
}
2529

26-
final public function verify(string $expected, string $payload, Key $key): bool
27-
{
30+
final public function verify(
31+
string $expected,
32+
string $payload,
33+
#[SensitiveParameter]
34+
Key $key,
35+
): bool {
2836
return hash_equals($expected, $this->sign($payload, $key));
2937
}
3038

‎src/Signer/Key/InMemory.php

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
use Lcobucci\JWT\Signer\InvalidKeyProvided;
77
use Lcobucci\JWT\Signer\Key;
88
use Lcobucci\JWT\SodiumBase64Polyfill;
9+
use SensitiveParameter;
910
use SplFileObject;
1011
use Throwable;
1112

@@ -15,8 +16,11 @@
1516
final class InMemory implements Key
1617
{
1718
/** @param non-empty-string $contents */
18-
private function __construct(public readonly string $contents, public readonly string $passphrase)
19-
{
19+
private function __construct(
20+
public readonly string $contents,
21+
#[SensitiveParameter]
22+
public readonly string $passphrase,
23+
) {
2024
}
2125

2226
/** @param non-empty-string $contents */

‎src/Signer/OpenSSL.php

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55

66
use Lcobucci\JWT\Signer;
77
use OpenSSLAsymmetricKey;
8+
use SensitiveParameter;
89

910
use function array_key_exists;
1011
use function assert;
@@ -40,7 +41,9 @@ abstract class OpenSSL implements Signer
4041
* @throws InvalidKeyProvided
4142
*/
4243
final protected function createSignature(
44+
#[SensitiveParameter]
4345
string $pem,
46+
#[SensitiveParameter]
4447
string $passphrase,
4548
string $payload,
4649
): string {
@@ -56,8 +59,12 @@ final protected function createSignature(
5659
}
5760

5861
/** @throws CannotSignPayload */
59-
private function getPrivateKey(string $pem, string $passphrase): OpenSSLAsymmetricKey
60-
{
62+
private function getPrivateKey(
63+
#[SensitiveParameter]
64+
string $pem,
65+
#[SensitiveParameter]
66+
string $passphrase,
67+
): OpenSSLAsymmetricKey {
6168
return $this->validateKey(openssl_pkey_get_private($pem, $passphrase));
6269
}
6370

@@ -74,8 +81,10 @@ final protected function verifySignature(
7481
}
7582

7683
/** @throws InvalidKeyProvided */
77-
private function getPublicKey(string $pem): OpenSSLAsymmetricKey
78-
{
84+
private function getPublicKey(
85+
#[SensitiveParameter]
86+
string $pem,
87+
): OpenSSLAsymmetricKey {
7988
return $this->validateKey(openssl_pkey_get_public($pem));
8089
}
8190

@@ -84,8 +93,10 @@ private function getPublicKey(string $pem): OpenSSLAsymmetricKey
8493
*
8594
* @throws InvalidKeyProvided
8695
*/
87-
private function validateKey(OpenSSLAsymmetricKey|bool $key): OpenSSLAsymmetricKey
88-
{
96+
private function validateKey(
97+
#[SensitiveParameter]
98+
OpenSSLAsymmetricKey|bool $key,
99+
): OpenSSLAsymmetricKey {
89100
if (is_bool($key)) {
90101
throw InvalidKeyProvided::cannotBeParsed($this->fullOpenSSLErrorString());
91102
}

0 commit comments

Comments
 (0)