Issues (994)

src/shim/Cipher.php (2 issues)

Labels
Severity
1
<?php
2
3
/**
4
 * Decrypt data from a CryptoJS json encoding string
5
 *
6
 * @param mixed $passphrase
7
 * @param mixed $jsonString
8
 * @return mixed
9
 */
10
function aesDecrypt($jsonString, $passphrase)
11
{
12
  $jsonString = base64_decode($jsonString);
13
  $jsondata = json_decode($jsonString, true);
14
  $salt = hex2bin($jsondata["s"]);
15
  $ct = base64_decode($jsondata["ct"]);
16
  $iv  = hex2bin($jsondata["iv"]);
17
  $concatedPassphrase = $passphrase . $salt;
18
  $md5 = array();
19
  $md5[0] = md5($concatedPassphrase, true);
20
  $result = $md5[0];
21
  for ($i = 1; $i < 3; $i++) {
22
    $md5[$i] = md5($md5[$i - 1] . $concatedPassphrase, true);
23
    $result .= $md5[$i];
24
  }
25
  $key = substr($result, 0, 32);
26
  $data = openssl_decrypt($ct, 'aes-256-cbc', $key, true, $iv);
0 ignored issues
show
true of type true is incompatible with the type integer expected by parameter $options of openssl_decrypt(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

26
  $data = openssl_decrypt($ct, 'aes-256-cbc', $key, /** @scrutinizer ignore-type */ true, $iv);
Loading history...
27
  return json_decode($data, true);
28
}
29
30
/**
31
 * Encrypt value to a cryptojs compatiable json encoding string
32
 *
33
 * @param mixed $passphrase
34
 * @param mixed $value
35
 * @return string
36
 */
37
function aesEncrypt($value, $passphrase)
38
{
39
  $salt = openssl_random_pseudo_bytes(8);
40
  $salted = '';
41
  $dx = '';
42
  while (strlen($salted) < 48) {
43
    $dx = md5($dx . $passphrase . $salt, true);
44
    $salted .= $dx;
45
  }
46
  $key = substr($salted, 0, 32);
47
  $iv  = substr($salted, 32, 16);
48
  $encrypted_data = openssl_encrypt(json_encode($value), 'aes-256-cbc', $key, true, $iv);
0 ignored issues
show
true of type true is incompatible with the type integer expected by parameter $options of openssl_encrypt(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

48
  $encrypted_data = openssl_encrypt(json_encode($value), 'aes-256-cbc', $key, /** @scrutinizer ignore-type */ true, $iv);
Loading history...
49
  $data = array("ct" => base64_encode($encrypted_data), "iv" => bin2hex($iv), "s" => bin2hex($salt));
50
  $json = json_encode($data);
51
  return base64_encode($json);
52
}
53