From 76f420e6b261eb08eda08f0ab73ba0c8de81afe4 Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Mon, 15 Apr 2024 21:40:19 +0200 Subject: [PATCH 1/4] add SensitiveParameter to sensitive arguments This change adds the PHP attribute SensitiveParameter to the secret holding variables. See: https://www.php.net/manual/en/class.sensitiveparameter This feature is only available in PHP 8.2, so the minimum php version required has been updated. Github Actions now use PHP 8.2 and 8.3 for the tests. The checkout action has been updated to v4, too. Fix issue #118 --- .github/workflows/test-bacon.yml | 4 ++-- .github/workflows/test-endroid.yml | 4 ++-- .github/workflows/test.yml | 4 ++-- CHANGELOG.md | 12 ++++++++++++ README.md | 2 +- TwoFactorAuth.phpproj | 2 +- composer.json | 2 +- lib/TwoFactorAuth.php | 6 +++--- 8 files changed, 24 insertions(+), 12 deletions(-) diff --git a/.github/workflows/test-bacon.yml b/.github/workflows/test-bacon.yml index a4903ad..82faaaf 100644 --- a/.github/workflows/test-bacon.yml +++ b/.github/workflows/test-bacon.yml @@ -10,10 +10,10 @@ jobs: strategy: matrix: - php-version: ['8.1', '8.2'] + php-version: ['8.2', '8.3'] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - uses: shivammathur/setup-php@v2 with: diff --git a/.github/workflows/test-endroid.yml b/.github/workflows/test-endroid.yml index 23b3867..7312acb 100644 --- a/.github/workflows/test-endroid.yml +++ b/.github/workflows/test-endroid.yml @@ -10,11 +10,11 @@ jobs: strategy: matrix: - php-version: ['8.1', '8.2'] + php-version: ['8.2', '8.3'] endroid-version: ["^3","^4","^5"] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - uses: shivammathur/setup-php@v2 with: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a51e67e..e9564dc 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -10,10 +10,10 @@ jobs: strategy: matrix: - php-version: ['8.1', '8.2'] + php-version: ['8.2', '8.3'] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - uses: shivammathur/setup-php@v2 with: diff --git a/CHANGELOG.md b/CHANGELOG.md index 11c01b5..86aa156 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,17 @@ # RobThree\TwoFactorAuth changelog +# Version 3.x + +## Breaking changes + +### PHP Version + +Version 3.x requires at least PHP 8.2. + +### Add SensitiveParameter + +The new attribute SensitiveParameter was added to the code, to prevent accidental leak of secrets in stack traces. + # Version 2.x ## Breaking changes diff --git a/README.md b/README.md index 96f566d..4c8ecd8 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ You can make use of the included [Endroid](https://robthree.github.io/TwoFactorA ## Requirements -* Requires PHP version >=8.1 +* Requires PHP version >=8.2 * [cURL](http://php.net/manual/en/book.curl.php) when using the provided `QRServerProvider` (default), `ImageChartsQRCodeProvider` or `QRicketProvider` but you can also provide your own QR-code provider. * [random_bytes()](http://php.net/manual/en/function.random-bytes.php), [OpenSSL](http://php.net/manual/en/book.openssl.php) or [Hash](http://php.net/manual/en/book.hash.php) depending on which built-in RNG you use (TwoFactorAuth will try to 'autodetect' and use the best available); however: feel free to provide your own (CS)RNG. diff --git a/TwoFactorAuth.phpproj b/TwoFactorAuth.phpproj index 2a55b72..2ed68af 100644 --- a/TwoFactorAuth.phpproj +++ b/TwoFactorAuth.phpproj @@ -15,7 +15,7 @@ localhost http://localhost:41315/ PHP - 8.1 + 8.2 true diff --git a/composer.json b/composer.json index a3264a0..52884a0 100644 --- a/composer.json +++ b/composer.json @@ -27,7 +27,7 @@ "source": "https://github.com/RobThree/TwoFactorAuth" }, "require": { - "php": ">=8.1.0" + "php": ">=8.2.0" }, "require-dev": { "phpunit/phpunit": "^9", diff --git a/lib/TwoFactorAuth.php b/lib/TwoFactorAuth.php index f3f867e..af917e3 100644 --- a/lib/TwoFactorAuth.php +++ b/lib/TwoFactorAuth.php @@ -69,7 +69,7 @@ public function createSecret(int $bits = 80, bool $requirecryptosecure = true): /** * Calculate the code with given secret and point in time */ - public function getCode(string $secret, ?int $time = null): string + public function getCode(#[\SensitiveParameter] string $secret, ?int $time = null): string { $secretkey = $this->base32Decode($secret); @@ -107,7 +107,7 @@ public function verifyCode(string $secret, string $code, int $discrepancy = 1, ? /** * Get data-uri of QRCode */ - public function getQRCodeImageAsDataUri(string $label, string $secret, int $size = 200): string + public function getQRCodeImageAsDataUri(string $label, #[\SensitiveParameter] string $secret, int $size = 200): string { if ($size <= 0) { throw new TwoFactorAuthException('Size must be > 0'); @@ -153,7 +153,7 @@ public function ensureCorrectTime(?array $timeproviders = null, int $leniency = /** * Builds a string to be encoded in a QR code */ - public function getQRText(string $label, string $secret): string + public function getQRText(string $label, #[\SensitiveParameter] string $secret): string { return 'otpauth://totp/' . rawurlencode($label) . '?secret=' . rawurlencode($secret) From 061a2a39b48bff88c43c116a1d709102c581e0bf Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Mon, 15 Apr 2024 21:42:23 +0200 Subject: [PATCH 2/4] don't include the sensitive param change in breaking changes section in changelog --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 86aa156..8d59041 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,9 +8,9 @@ Version 3.x requires at least PHP 8.2. -### Add SensitiveParameter +## Other changes -The new attribute SensitiveParameter was added to the code, to prevent accidental leak of secrets in stack traces. +* The new PHP attribute SensitiveParameter was added to the code, to prevent accidental leak of secrets in stack traces. # Version 2.x From bba4c207c2af9009379e18922c50a2991953ac1c Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Mon, 15 Apr 2024 21:43:53 +0200 Subject: [PATCH 3/4] use global import --- lib/TwoFactorAuth.php | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/TwoFactorAuth.php b/lib/TwoFactorAuth.php index af917e3..0bc5685 100644 --- a/lib/TwoFactorAuth.php +++ b/lib/TwoFactorAuth.php @@ -14,6 +14,7 @@ use RobThree\Auth\Providers\Time\ITimeProvider; use RobThree\Auth\Providers\Time\LocalMachineTimeProvider; use RobThree\Auth\Providers\Time\NTPTimeProvider; +use SensitiveParameter; // Based on / inspired by: https://github.com/PHPGangsta/GoogleAuthenticator // Algorithms, digits, period etc. explained: https://github.com/google/google-authenticator/wiki/Key-Uri-Format @@ -69,7 +70,7 @@ public function createSecret(int $bits = 80, bool $requirecryptosecure = true): /** * Calculate the code with given secret and point in time */ - public function getCode(#[\SensitiveParameter] string $secret, ?int $time = null): string + public function getCode(#[SensitiveParameter] string $secret, ?int $time = null): string { $secretkey = $this->base32Decode($secret); @@ -107,7 +108,7 @@ public function verifyCode(string $secret, string $code, int $discrepancy = 1, ? /** * Get data-uri of QRCode */ - public function getQRCodeImageAsDataUri(string $label, #[\SensitiveParameter] string $secret, int $size = 200): string + public function getQRCodeImageAsDataUri(string $label, #[SensitiveParameter] string $secret, int $size = 200): string { if ($size <= 0) { throw new TwoFactorAuthException('Size must be > 0'); @@ -153,7 +154,7 @@ public function ensureCorrectTime(?array $timeproviders = null, int $leniency = /** * Builds a string to be encoded in a QR code */ - public function getQRText(string $label, #[\SensitiveParameter] string $secret): string + public function getQRText(string $label, #[SensitiveParameter] string $secret): string { return 'otpauth://totp/' . rawurlencode($label) . '?secret=' . rawurlencode($secret) From 83c74492702ddd501d48f0b8bb26138386b75908 Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Mon, 15 Apr 2024 22:43:29 +0200 Subject: [PATCH 4/4] use a link in CHANGELOG.md for SensitiveParameter --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8d59041..16c097d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,7 @@ Version 3.x requires at least PHP 8.2. ## Other changes -* The new PHP attribute SensitiveParameter was added to the code, to prevent accidental leak of secrets in stack traces. +* The new PHP attribute [SensitiveParameter](https://www.php.net/manual/en/class.sensitiveparameter.php) was added to the code, to prevent accidental leak of secrets in stack traces. # Version 2.x