Add SensitiveParameter attribute to sensitive parameters

Adds `#[SensitiveParameter]` to all potentially sensitive parameters,
including key material, certificates and passphrases.

Author: slknijnenburg

src/Signer/Key/InMemory.php

@@ -6,6 +6,7 @@
 use Lcobucci\JWT\Signer\InvalidKeyProvided;
 use Lcobucci\JWT\Signer\Key;
 use Lcobucci\JWT\SodiumBase64Polyfill;
+use SensitiveParameter;
 use SplFileObject;
 use Throwable;
 
@@ -15,21 +16,30 @@
 final class InMemory implements Key
 {
     /** @param non-empty-string $contents */
-    private function __construct(public readonly string $contents, public readonly string $passphrase)
-    {
+    private function __construct(
+        public readonly string $contents,
+        #[SensitiveParameter]
+        public readonly string $passphrase,
+    ) {
     }
 
     /** @param non-empty-string $contents */
-    public static function plainText(string $contents, string $passphrase = ''): self
-    {
+    public static function plainText(
+        string $contents,
+        #[SensitiveParameter]
+        string $passphrase = '',
+    ): self {
         self::guardAgainstEmptyKey($contents);
 
         return new self($contents, $passphrase);
     }
 
     /** @param non-empty-string $contents */
-    public static function base64Encoded(string $contents, string $passphrase = ''): self
-    {
+    public static function base64Encoded(
+        string $contents,
+        #[SensitiveParameter]
+        string $passphrase = '',
+    ): self {
         $decoded = SodiumBase64Polyfill::base642bin(
             $contents,
             SodiumBase64Polyfill::SODIUM_BASE64_VARIANT_ORIGINAL,
@@ -45,8 +55,11 @@ public static function base64Encoded(string $contents, string $passphrase = ''):
      *
      * @throws FileCouldNotBeRead
      */
-    public static function file(string $path, string $passphrase = ''): self
-    {
+    public static function file(
+        string $path,
+        #[SensitiveParameter]
+        string $passphrase = '',
+    ): self {
         try {
             $file = new SplFileObject($path);
         } catch (Throwable $exception) {

src/Signer/OpenSSL.php

@@ -5,6 +5,7 @@
 
 use Lcobucci\JWT\Signer;
 use OpenSSLAsymmetricKey;
+use SensitiveParameter;
 
 use function array_key_exists;
 use function assert;
@@ -40,7 +41,9 @@ abstract class OpenSSL implements Signer
      * @throws InvalidKeyProvided
      */
     final protected function createSignature(
+        #[SensitiveParameter]
         string $pem,
+        #[SensitiveParameter]
         string $passphrase,
         string $payload,
     ): string {
@@ -56,15 +59,20 @@ final protected function createSignature(
     }
 
     /** @throws CannotSignPayload */
-    private function getPrivateKey(string $pem, string $passphrase): OpenSSLAsymmetricKey
-    {
+    private function getPrivateKey(
+        #[SensitiveParameter]
+        string $pem,
+        #[SensitiveParameter]
+        string $passphrase,
+    ): OpenSSLAsymmetricKey {
         return $this->validateKey(openssl_pkey_get_private($pem, $passphrase));
     }
 
     /** @throws InvalidKeyProvided */
     final protected function verifySignature(
         string $expected,
         string $payload,
+        #[SensitiveParameter]
         string $pem,
     ): bool {
         $key    = $this->getPublicKey($pem);
@@ -74,8 +82,10 @@ final protected function verifySignature(
     }
 
     /** @throws InvalidKeyProvided */
-    private function getPublicKey(string $pem): OpenSSLAsymmetricKey
-    {
+    private function getPublicKey(
+        #[SensitiveParameter]
+        string $pem,
+    ): OpenSSLAsymmetricKey {
         return $this->validateKey(openssl_pkey_get_public($pem));
     }