random.php ➔ random_bytes() - Code Metrics - Inspection of "Library Updates" - XOOPS/XoopsCore25 - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Pull Request — master (#528)

by Richard

created 2017-07-24 19:04 UTC

random.php ➔ random_bytes() B

↳ Parent: Project

Complexity

Conditions	5
Paths	4

Size

Total Lines	7
Code Lines	17

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	5
eloc	17
nc	4
nop	1
dl	0
loc	7
rs	8.8571
c	0
b	0
f	0

<?php

/**
 * Random_* Compatibility Library
 * for using the new PHP 7 random_* API in PHP 5 projects
 *
 * @version 2.0.10
 * @released 2017-03-13
 *
 * The MIT License (MIT)
 *
 * Copyright (c) 2015 - 2017 Paragon Initiative Enterprises
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 */

if (!defined('PHP_VERSION_ID')) {
    // This constant was introduced in PHP 5.2.7
    $RandomCompatversion = array_map('intval', explode('.', PHP_VERSION));
    define(
        'PHP_VERSION_ID',
        $RandomCompatversion[0] * 10000
        + $RandomCompatversion[1] * 100
        + $RandomCompatversion[2]
    );
    $RandomCompatversion = null;
}

/**
 * PHP 7.0.0 and newer have these functions natively.
 */
if (PHP_VERSION_ID >= 70000) {
    return;
}

if (!defined('RANDOM_COMPAT_READ_BUFFER')) {
    define('RANDOM_COMPAT_READ_BUFFER', 8);
}

$RandomCompatDIR = dirname(__FILE__);

require_once $RandomCompatDIR . '/byte_safe_strings.php';
require_once $RandomCompatDIR . '/cast_to_int.php';
require_once $RandomCompatDIR . '/error_polyfill.php';

if (!is_callable('random_bytes')) {
    /**
     * PHP 5.2.0 - 5.6.x way to implement random_bytes()
     *
     * We use conditional statements here to define the function in accordance
     * to the operating environment. It's a micro-optimization.
     *
     * In order of preference:
     *   1. Use libsodium if available.
     *   2. fread() /dev/urandom if available (never on Windows)
     *   3. mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM)
     *   4. COM('CAPICOM.Utilities.1')->GetRandom()
     *
     * See RATIONALE.md for our reasoning behind this particular order
     */
    if (extension_loaded('libsodium')) {
        // See random_bytes_libsodium.php
        if (PHP_VERSION_ID >= 50300 && is_callable('\\Sodium\\randombytes_buf')) {
            require_once $RandomCompatDIR . '/random_bytes_libsodium.php';
        } elseif (method_exists('Sodium', 'randombytes_buf')) {
            require_once $RandomCompatDIR . '/random_bytes_libsodium_legacy.php';
        }
    }

    /**
     * Reading directly from /dev/urandom:
     */
    if (DIRECTORY_SEPARATOR === '/') {
        // DIRECTORY_SEPARATOR === '/' on Unix-like OSes -- this is a fast
        // way to exclude Windows.
        $RandomCompatUrandom = true;
        $RandomCompat_basedir = ini_get('open_basedir');

        if (!empty($RandomCompat_basedir)) {
            $RandomCompat_open_basedir = explode(
                PATH_SEPARATOR,
                strtolower($RandomCompat_basedir)
            );
            $RandomCompatUrandom = (array() !== array_intersect(
                array('/dev', '/dev/', '/dev/urandom'),
                $RandomCompat_open_basedir
            ));
            $RandomCompat_open_basedir = null;
        }

        if (
            !is_callable('random_bytes')
            &&
            $RandomCompatUrandom
            &&
            @is_readable('/dev/urandom')
        ) {
            // Error suppression on is_readable() in case of an open_basedir
            // or safe_mode failure. All we care about is whether or not we
            // can read it at this point. If the PHP environment is going to
            // panic over trying to see if the file can be read in the first
            // place, that is not helpful to us here.

            // See random_bytes_dev_urandom.php
            require_once $RandomCompatDIR . '/random_bytes_dev_urandom.php';
        }
        // Unset variables after use
        $RandomCompat_basedir = null;
    } else {
        $RandomCompatUrandom = false;
    }

    /**
     * mcrypt_create_iv()
     *
     * We only want to use mcypt_create_iv() if:
     *
     * - random_bytes() hasn't already been defined
     * - the mcrypt extensions is loaded
     * - One of these two conditions is true:
     *   - We're on Windows (DIRECTORY_SEPARATOR !== '/')
     *   - We're not on Windows and /dev/urandom is readabale
     *     (i.e. we're not in a chroot jail)
     * - Special case:
     *   - If we're not on Windows, but the PHP version is between
     *     5.6.10 and 5.6.12, we don't want to use mcrypt. It will
     *     hang indefinitely. This is bad.
     *   - If we're on Windows, we want to use PHP >= 5.3.7 or else
     *     we get insufficient entropy errors.
     */
    if (
        !is_callable('random_bytes')
        &&
        // Windows on PHP < 5.3.7 is broken, but non-Windows is not known to be.
        (DIRECTORY_SEPARATOR === '/' || PHP_VERSION_ID >= 50307)
        &&
        // Prevent this code from hanging indefinitely on non-Windows;
        // see https://bugs.php.net/bug.php?id=69833
        (
            DIRECTORY_SEPARATOR !== '/' ||
            (PHP_VERSION_ID <= 50609 || PHP_VERSION_ID >= 50613)
        )
        &&
        extension_loaded('mcrypt')
    ) {
        // See random_bytes_mcrypt.php
        require_once $RandomCompatDIR . '/random_bytes_mcrypt.php';
    }
    $RandomCompatUrandom = null;

    /**
     * This is a Windows-specific fallback, for when the mcrypt extension
     * isn't loaded.
     */
    if (
        !is_callable('random_bytes')
        &&
        extension_loaded('com_dotnet')
        &&
        class_exists('COM')
    ) {
        $RandomCompat_disabled_classes = preg_split(
            '#\s*,\s*#',
            strtolower(ini_get('disable_classes'))
        );

        if (!in_array('com', $RandomCompat_disabled_classes)) {
            try {
                $RandomCompatCOMtest = new COM('CAPICOM.Utilities.1');

                if (method_exists($RandomCompatCOMtest, 'GetRandom')) {
                    // See random_bytes_com_dotnet.php
                    require_once $RandomCompatDIR . '/random_bytes_com_dotnet.php';
                }
            } catch (com_exception $e) {
                // Don't try to use it.
            }
        }
        $RandomCompat_disabled_classes = null;
        $RandomCompatCOMtest = null;
    }

    /**
     * throw new Exception
     */
    if (!is_callable('random_bytes')) {
        /**
         * We don't have any more options, so let's throw an exception right now
         * and hope the developer won't let it fail silently.
         *
         * @param mixed $length
         * @return void

         * @throws Exception
         */
        function random_bytes($length)
        {
            unset($length); // Suppress "variable not used" warnings.
            throw new Exception(
                'There is no suitable CSPRNG installed on your system'
            );
        }
    }
}

if (!is_callable('random_int')) {
    require_once $RandomCompatDIR . '/random_int.php';
}

$RandomCompatDIR = null;


1			<?php
			0 ignored issues – show Coding Style Compatibility introduced 2017-07-24 19:17 UTC by Report Bug Copy Issue Report For compatibility and reusability of your code, PSR1 recommends that a file should introduce either new symbols (like classes, functions, etc.) or have side-effects (like outputting something, or including other files), but not both at the same time. The first symbol is defined on line 35 and the first side effect is on line 34. The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file. The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place. To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1. Loading history...
2			/**
3			* Random_* Compatibility Library
4			* for using the new PHP 7 random_* API in PHP 5 projects
5			*
6			* @version 2.0.10
7			* @released 2017-03-13
8			*
9			* The MIT License (MIT)
10			*
11			* Copyright (c) 2015 - 2017 Paragon Initiative Enterprises
12			*
13			* Permission is hereby granted, free of charge, to any person obtaining a copy
14			* of this software and associated documentation files (the "Software"), to deal
15			* in the Software without restriction, including without limitation the rights
16			* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
17			* copies of the Software, and to permit persons to whom the Software is
18			* furnished to do so, subject to the following conditions:
19			*
20			* The above copyright notice and this permission notice shall be included in
21			* all copies or substantial portions of the Software.
22			*
23			* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
24			* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
25			* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
26			* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
27			* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
28			* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
29			* SOFTWARE.
30			*/
31
32			if (!defined('PHP_VERSION_ID')) {
33			// This constant was introduced in PHP 5.2.7
34			$RandomCompatversion = array_map('intval', explode('.', PHP_VERSION));
35			define(
36			'PHP_VERSION_ID',
37			$RandomCompatversion[0] * 10000
38			+ $RandomCompatversion[1] * 100
39			+ $RandomCompatversion[2]
40			);
41			$RandomCompatversion = null;
42			}
43
44			/**
45			* PHP 7.0.0 and newer have these functions natively.
46			*/
47			if (PHP_VERSION_ID >= 70000) {
48			return;
49			}
50
51			if (!defined('RANDOM_COMPAT_READ_BUFFER')) {
52			define('RANDOM_COMPAT_READ_BUFFER', 8);
53			}
54
55			$RandomCompatDIR = dirname(__FILE__);
56
57			require_once $RandomCompatDIR . '/byte_safe_strings.php';
58			require_once $RandomCompatDIR . '/cast_to_int.php';
59			require_once $RandomCompatDIR . '/error_polyfill.php';
60
61			if (!is_callable('random_bytes')) {
62			/**
63			* PHP 5.2.0 - 5.6.x way to implement random_bytes()
64			*
65			* We use conditional statements here to define the function in accordance
66			* to the operating environment. It's a micro-optimization.
67			*
68			* In order of preference:
69			* 1. Use libsodium if available.
70			* 2. fread() /dev/urandom if available (never on Windows)
71			* 3. mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM)
72			* 4. COM('CAPICOM.Utilities.1')->GetRandom()
73			*
74			* See RATIONALE.md for our reasoning behind this particular order
75			*/
76			if (extension_loaded('libsodium')) {
77			// See random_bytes_libsodium.php
78			if (PHP_VERSION_ID >= 50300 && is_callable('\\Sodium\\randombytes_buf')) {
79			require_once $RandomCompatDIR . '/random_bytes_libsodium.php';
80			} elseif (method_exists('Sodium', 'randombytes_buf')) {
81			require_once $RandomCompatDIR . '/random_bytes_libsodium_legacy.php';
82			}
83			}
84
85			/**
86			* Reading directly from /dev/urandom:
87			*/
88			if (DIRECTORY_SEPARATOR === '/') {
89			// DIRECTORY_SEPARATOR === '/' on Unix-like OSes -- this is a fast
90			// way to exclude Windows.
91			$RandomCompatUrandom = true;
92			$RandomCompat_basedir = ini_get('open_basedir');
93
94			if (!empty($RandomCompat_basedir)) {
95			$RandomCompat_open_basedir = explode(
96			PATH_SEPARATOR,
97			strtolower($RandomCompat_basedir)
98			);
99			$RandomCompatUrandom = (array() !== array_intersect(
100			array('/dev', '/dev/', '/dev/urandom'),
101			$RandomCompat_open_basedir
102			));
103			$RandomCompat_open_basedir = null;
104			}
105
106			if (
107			!is_callable('random_bytes')
108			&&
109			$RandomCompatUrandom
110			&&
111			@is_readable('/dev/urandom')
112			) {
113			// Error suppression on is_readable() in case of an open_basedir
114			// or safe_mode failure. All we care about is whether or not we
115			// can read it at this point. If the PHP environment is going to
116			// panic over trying to see if the file can be read in the first
117			// place, that is not helpful to us here.
118
119			// See random_bytes_dev_urandom.php
120			require_once $RandomCompatDIR . '/random_bytes_dev_urandom.php';
121			}
122			// Unset variables after use
123			$RandomCompat_basedir = null;
124			} else {
125			$RandomCompatUrandom = false;
126			}
127
128			/**
129			* mcrypt_create_iv()
130			*
131			* We only want to use mcypt_create_iv() if:
132			*
133			* - random_bytes() hasn't already been defined
134			* - the mcrypt extensions is loaded
135			* - One of these two conditions is true:
136			* - We're on Windows (DIRECTORY_SEPARATOR !== '/')
137			* - We're not on Windows and /dev/urandom is readabale
138			* (i.e. we're not in a chroot jail)
139			* - Special case:
140			* - If we're not on Windows, but the PHP version is between
141			* 5.6.10 and 5.6.12, we don't want to use mcrypt. It will
142			* hang indefinitely. This is bad.
143			* - If we're on Windows, we want to use PHP >= 5.3.7 or else
144			* we get insufficient entropy errors.
145			*/
146			if (
147			!is_callable('random_bytes')
148			&&
149			// Windows on PHP < 5.3.7 is broken, but non-Windows is not known to be.
150			(DIRECTORY_SEPARATOR === '/' \|\| PHP_VERSION_ID >= 50307)
151			&&
152			// Prevent this code from hanging indefinitely on non-Windows;
153			// see https://bugs.php.net/bug.php?id=69833
154			(
155			DIRECTORY_SEPARATOR !== '/' \|\|
156			(PHP_VERSION_ID <= 50609 \|\| PHP_VERSION_ID >= 50613)
157			)
158			&&
159			extension_loaded('mcrypt')
160			) {
161			// See random_bytes_mcrypt.php
162			require_once $RandomCompatDIR . '/random_bytes_mcrypt.php';
163			}
164			$RandomCompatUrandom = null;
165
166			/**
167			* This is a Windows-specific fallback, for when the mcrypt extension
168			* isn't loaded.
169			*/
170			if (
171			!is_callable('random_bytes')
172			&&
173			extension_loaded('com_dotnet')
174			&&
175			class_exists('COM')
176			) {
177			$RandomCompat_disabled_classes = preg_split(
178			'#\s,\s#',
179			strtolower(ini_get('disable_classes'))
180			);
181
182			if (!in_array('com', $RandomCompat_disabled_classes)) {
183			try {
184			$RandomCompatCOMtest = new COM('CAPICOM.Utilities.1');
			0 ignored issues – show Unused Code introduced 2017-07-24 19:17 UTC by Report Bug Copy Issue Report The call to `com::__construct()` has too many arguments starting with `'CAPICOM.Utilities.1'`. This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. In this case you can add the `@ignore` PhpDoc annotation to the duplicate definition and it will be ignored. Loading history...
185			if (method_exists($RandomCompatCOMtest, 'GetRandom')) {
186			// See random_bytes_com_dotnet.php
187			require_once $RandomCompatDIR . '/random_bytes_com_dotnet.php';
188			}
189			} catch (com_exception $e) {
190			// Don't try to use it.
191			}
192			}
193			$RandomCompat_disabled_classes = null;
194			$RandomCompatCOMtest = null;
195			}
196
197			/**
198			* throw new Exception
199			*/
200			if (!is_callable('random_bytes')) {
201			/**
202			* We don't have any more options, so let's throw an exception right now
203			* and hope the developer won't let it fail silently.
204			*
205			* @param mixed $length
206			* @return void
			0 ignored issues – show Documentation introduced 2017-07-24 19:17 UTC by Report Bug Copy Issue Report Should the return type not be `string`? This check compares the return type specified in the `@return` annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch. Loading history...
207			* @throws Exception
208			*/
209			function random_bytes($length)
210			{
211			unset($length); // Suppress "variable not used" warnings.
212			throw new Exception(
213			'There is no suitable CSPRNG installed on your system'
214			);
215			}
216			}
217			}
218
219			if (!is_callable('random_int')) {
220			require_once $RandomCompatDIR . '/random_int.php';
221			}
222
223			$RandomCompatDIR = null;
224

XOOPS / XoopsCore25

Pull Request — master (#528)

random.php ➔ random_bytes() B

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like