fwolf /
fwlib
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * Func about encrypt and decrypt. |
||
| 4 | * |
||
| 5 | * @package fwolflib |
||
| 6 | * @subpackage func |
||
| 7 | * @copyright Copyright 2009-2010, Fwolf |
||
| 8 | * @author Fwolf <[email protected]> |
||
| 9 | * @since 2009-10-22 |
||
| 10 | */ |
||
| 11 | |||
| 12 | |||
| 13 | require_once(dirname(__FILE__) . '/../fwolflib.php'); |
||
| 14 | require_once(FWOLFLIB . 'func/ecl.php'); |
||
| 15 | require_once(FWOLFLIB . 'func/env.php'); |
||
| 16 | |||
| 17 | if (!function_exists('mcrypt_module_open')) |
||
| 18 | die('Module mcrypt not installed.'); |
||
| 19 | |||
| 20 | |||
| 21 | // Get mcrypt supported algorithms: |
||
| 22 | /* |
||
| 23 | $algorithms = mcrypt_list_algorithms("/usr/local/lib/libmcrypt"); |
||
| 24 | |||
| 25 | foreach ($algorithms as $cipher) { |
||
| 26 | echo "$cipher\n"; |
||
| 27 | } |
||
| 28 | */ |
||
| 29 | /* |
||
| 30 | cast-128 |
||
| 31 | gost |
||
| 32 | rijndael-128 |
||
| 33 | twofish |
||
| 34 | arcfour |
||
| 35 | cast-256 |
||
| 36 | loki97 |
||
| 37 | rijndael-192 |
||
| 38 | saferplus |
||
| 39 | wake |
||
| 40 | blowfish-compat |
||
| 41 | des |
||
| 42 | rijndael-256 |
||
| 43 | serpent |
||
| 44 | xtea |
||
| 45 | blowfish |
||
| 46 | enigma |
||
| 47 | rc2 |
||
| 48 | tripledes |
||
| 49 | */ |
||
| 50 | |||
| 51 | |||
| 52 | /* |
||
| 53 | * McryptSmplIv |
||
| 54 | * |
||
| 55 | * Use part of secret key as IV, so need assign it from outside, |
||
| 56 | * or save it to use when decrypt. |
||
| 57 | */ |
||
| 58 | |||
| 59 | |||
| 60 | /** |
||
| 61 | * Do decrypt |
||
| 62 | * |
||
| 63 | * @deprecated Use Fwlib\Util\McryptSmplIv::decrypt() |
||
| 64 | * @param string $s_data Source data. |
||
| 65 | * @param string $s_key Secret key. |
||
| 66 | * @param string $algorithm Same as mcrypt_module_open(). |
||
| 67 | * @param string $algorithm_directory Same as mcrypt_module_open(). |
||
| 68 | * @param string $mode Same as mcrypt_module_open(). |
||
| 69 | * @param string $mode_directory Same as mcrypt_module_open(). |
||
| 70 | * @return string |
||
| 71 | */ |
||
| 72 | function McryptSmplIvDecrypt($s_data, $s_key, $algorithm, $algorithm_directory = '', $mode = 'cfb', $mode_directory = '') { |
||
| 73 | return McryptSmplIvProcess(1, $s_data, $s_key, $algorithm, $algorithm_directory, $mode, $mode_directory); |
||
| 74 | } // end of func McryptSmplIvDecrypt |
||
| 75 | |||
| 76 | |||
| 77 | /** |
||
| 78 | * Do encrypt |
||
| 79 | * |
||
| 80 | * @deprecated Use Fwlib\Util\McryptSmplIv::encrypt() |
||
| 81 | * @param string $s_data Source data. |
||
| 82 | * @param string $s_key Secret key. |
||
| 83 | * @param string $algorithm Same as mcrypt_module_open(). |
||
| 84 | * @param string $algorithm_directory Same as mcrypt_module_open(). |
||
| 85 | * @param string $mode Same as mcrypt_module_open(). |
||
| 86 | * @param string $mode_directory Same as mcrypt_module_open(). |
||
| 87 | * @return string |
||
| 88 | */ |
||
| 89 | function McryptSmplIvEncrypt($s_data, $s_key, $algorithm, $algorithm_directory = '', $mode = 'cfb', $mode_directory = '') { |
||
| 90 | return McryptSmplIvProcess(0, $s_data, $s_key, $algorithm, $algorithm_directory, $mode, $mode_directory); |
||
| 91 | } // end of func McryptSmplIvEncrypt |
||
| 92 | |||
| 93 | |||
| 94 | /** |
||
| 95 | * Real process func McryptSmplIv |
||
| 96 | * |
||
| 97 | * @deprecated Use Fwlib\Util\McryptSmplIv::process() |
||
| 98 | * @param int $i_action 0=encrypt, else=decrypt. |
||
| 99 | * @param string $s_data Source data. |
||
| 100 | * @param string $s_key Secret key. |
||
| 101 | * @param string $algorithm Same as mcrypt_module_open(). |
||
| 102 | * @param string $algorithm_directory Same as mcrypt_module_open(). |
||
| 103 | * @param string $mode Same as mcrypt_module_open(). |
||
| 104 | * @param string $mode_directory Same as mcrypt_module_open(). |
||
| 105 | * @return string |
||
| 106 | */ |
||
| 107 | View Code Duplication | function McryptSmplIvProcess($i_action, $s_data, $s_key, $algorithm, $algorithm_directory = '', $mode = 'cfb', $mode_directory = '') { |
|
| 108 | /* Open the cipher */ |
||
| 109 | $td = mcrypt_module_open($algorithm, |
||
| 110 | $algorithm_directory, |
||
| 111 | $mode, |
||
| 112 | $mode_directory); |
||
| 113 | |||
| 114 | $ks = mcrypt_enc_get_key_size($td); |
||
| 115 | |||
| 116 | /* Create key */ |
||
| 117 | $key = substr(sha1($s_key), 0, $ks); |
||
| 118 | |||
| 119 | // The IV must be unique and must be the same when decrypting/encrypting. |
||
| 120 | |||
| 121 | // But encrypt/decrypt are executed on 2 machine, |
||
| 122 | // randon IV will cause decrypt wrong result |
||
| 123 | // Bad offical example, all put encrypt/decrypt together ! |
||
| 124 | |||
| 125 | /* Create the IV and determine the keysize length, use MCRYPT_RAND |
||
| 126 | * on Windows instead */ |
||
| 127 | /* |
||
| 128 | if (true == NixOs()) |
||
| 129 | $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_DEV_RANDOM); |
||
| 130 | else |
||
| 131 | $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND); |
||
| 132 | */ |
||
| 133 | |||
| 134 | // So now, I use part/duplicate sha1 value of key as IV |
||
| 135 | $iv = sha1($key); // Sha1 again :-) |
||
| 136 | $l_sha1 = strlen($iv); |
||
| 137 | $l_iv = mcrypt_enc_get_iv_size($td); |
||
| 138 | if ($l_sha1 < $l_iv) { |
||
| 139 | // Duplicate sha1 value to generate IV |
||
| 140 | $iv = str_repeat($iv, round($l_iv / $l_sha1) + 1); |
||
| 141 | } |
||
| 142 | $iv = substr($iv, 0, $l_iv); |
||
| 143 | |||
| 144 | /* Intialize encryption */ |
||
| 145 | mcrypt_generic_init($td, $key, $iv); |
||
| 146 | |||
| 147 | if (0 == $i_action) { |
||
| 148 | /* Encrypt data */ |
||
| 149 | $encrypted = mcrypt_generic($td, $s_data); |
||
| 150 | } |
||
| 151 | else { |
||
| 152 | /* Decrypt encrypted string */ |
||
| 153 | $encrypted = mdecrypt_generic($td, $s_data); |
||
| 154 | } |
||
| 155 | |||
| 156 | /* Terminate decryption handle and close module */ |
||
| 157 | mcrypt_generic_deinit($td); |
||
| 158 | mcrypt_module_close($td); |
||
| 159 | |||
| 160 | return($encrypted); |
||
| 161 | } // end of func McryptSmplIvProcess |
||
| 162 | |||
| 163 | ?> |
||
|
0 ignored issues
–
show
|
|||
| 164 |
Using a closing tag in PHP files that only contain PHP code is not recommended as you might accidentally add whitespace after the closing tag which would then be output by PHP. This can cause severe problems, for example headers cannot be sent anymore.
A simple precaution is to leave off the closing tag as it is not required, and it also has no negative effects whatsoever.